Transport Canada's response to the Aviation Safety Recommendations A00-01, A00-02, A00-03, A00-04, A00-05, A00-06, A00-07, A00-08, A00-09, A00-10, A00-11, A00-12, A00-13, A00-14, A00-15, A00-16, A00-17, A00-18, A00-19 and A00-20 issued by the Transport...

A98A0067 - Engine Failure / Forced Landing - V. Kelner Airways Limited - Pilatus PC-12 C-FKAL - Clarenville, Newfoundland 1.5 nm SE 18 May 1998

Synopsis

The aircraft, a Pilatus PC-12, serial number 151, was on a scheduled domestic flight from St. John's, Newfoundland, to Goose Bay, Labrador, with the pilot, a company observer, and eight passengers on board. Twenty-three minutes into the flight, the aircraft turned back towards St. John's because of a low oil pressure indication. Eight minutes later, the engine (Pratt &Whitney PT6A-67B) had to be shut down because of a severe vibration. The pilot then turned towards Clarenville Airport, but was unable to reach the airfield. The aircraft was destroyed during the forced landing in a bog one and a half miles from the Clarenville Airport. The pilot, the company observer, and one passenger sustained serious injuries.

The Board determined that the pilot did not follow the prescribed emergency procedure for low oil pressure, and the engine failed before he could land safely. The pilot's decision making was influenced by his belief that the low oil pressure indications were not valid. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined.

V. Kelner Airways Limited Pilatus PC-12 C-FKAL

Safety Action Taken
(as presented in the TSB report)

Chip Detector Operability

As the chip detector was rendered inoperable when the landing gear was retracted, the aircraft did not meet the approval requirements for SEIFR flight, which requires a chip detector system to warn the pilot of excessive ferrous material in the engine lubricating system. When apprised of the situation, TC, on 15 July 1998, sent a letter to all TC regional managers for redistribution to all operators of Canadian-registered PC-12 aircraft advising them that they had 90 days to modify their aircraft to make the chip detector functional in all regimes of flight.

ELT Availability

There is a proposed CAR amendment which will allow CAR 703 air taxi operations for up to thirty days without an ELT on board. For private owners, or operators who have a low aircraft utilization rate and low overall risk, 30 days may be an appropriate period of time to allow flight without an ELT; however, for commercial operators with a high utilization rate, or for those who are performing operations that involve greater risk, 30 days may represent an unacceptable period of operation for flight without an ELT. Therefore, the TSB forwarded a Safety Advisory letter to TC which suggested that TC consider a further reduction or elimination of the 30-day allowance for commercial operators.

There is also a Notice of Proposed Amendment to reduce the allowable time period for flight without an operable ELT for aircraft operated under CAR 705 and CAR 704.

Emergency Procedures Terminologies

Some aircraft manufacturers define the terms "possible" and "practical", and employ only these defined terms. Similarly, TC, in its Extended Range Twin-Engine Operations (ETOPS) Manual, defines "suitable" and "adequate" airports. This reduces subjectivity and allows all involved (manufacturers, pilots, dispatchers, and maintenance personnel) to accurately and similarly gauge the degree of urgency related to an airborne emergency. Consistent interpretation of terminology related to emergency procedures is necessary to ensure an appropriate response. Consequently, the TSB, on 18 June 1998, forwarded a Safety Advisory letter to TC to suggest that TC consider a means to standardize these terms throughout the aviation industry.

TC responded to the Safety Advisory letter by issuing, on 21 October 1999, Commercial and Business Aviation Advisory Circular (CBAAC 0163), which deals with "standardisation of terminology related to aircraft emergency procedures." TC has also asked Pilatus Aircraft to review the PC-12 POH with regard to this subject and has recommended that the POH include comprehensive definitions of the terms that are used.

Safety Action Required
(as presented in the TSB Report)

Oxygen System Requirements

The requirement for pressurized aircraft tocarry a supplemental oxygen supply is set out in CAR 605.31. The CAR requires a ten-minute minimum supply of oxygen for passengers and crew, or an amount sufficient to allow an emergency descent to below 13 000 feet, whichever is greater. The standard oxygen system on board the Pilatus PC-12 meets the requirements set out in these CARs (ten minutes). The SEIFR rule does not stipulate any additional oxygen equipment requirements.

According to the POH, the standard PC-12 oxygen system is "for use by crew and passengers in the event of contaminated air being introduced into the cabin or a loss of pressurization with a rapid descent to lower altitudes." The system "will supply two crew and nine passengers for a minimum of 10 minutes in which time a descent from 30 000 feet to 10 000 feet is performed." A rapid descent is the best course of action for air contamination or depressurization while under power; however, if the aircraft loses pressurization due to engine failure, a rapid descent would compromise the aircraft's glide profile and lessen the chances of reaching a suitable aerodrome.

Maintaining the aircraft's optimal glide profile is a fundamental aspect of coping with a total power loss. But, in a high-altitude engine failure scenario, the need to maintain optimal glide speed is at odds with the requirement to descend rapidly to below 13 000 feet due to depressurization and limited supplemental oxygen reserves. The PC-12 POH states that at the PC-12's optimum engine-out glide configuration, it would take 16 minutes to descend from 30 000 feet (the maximum altitude for PC-12 dual-pilot operations) to 13 000 feet. In a descent from 30 000 feet, supplemental oxygen would have been depleted six minutes prior to reaching 13 000 feet; from 25 000 feet (the maximum altitude for single-pilot operations), it would take about 11.5 minutes for the descent. Although the PC-12 meets CAR requirements for oxygen equipment, the standard oxygen supply carried is insufficient to allow engine-out let-down using the optimal glide profile while at the same time maintaining oxygen reserves.

The oxygen equipment and supply regulation predates SEIFR operations and has not been amended since the implementation of the SEIFR policy. The rule does not reflect the requirement for single-engine aircraft to maintain an optimal glide profile throughout the entirety of an engine-out descent. Other regulatory authorities have recognized the need for a specific oxygen equipment rule for SEIFR operations. The Australian Civil Aviation Safety Authority (CASA) SEIFR rule requires that pressurized SEIFR aeroplanes be equipped with "sufficient additional oxygen for all occupants to allow the descent from cruising level following engine failure to be made at the best range gliding speed and in the best gliding configuration, assuming the maximum cabin leak rate, until a cabin altitude of 13 000 feet is reached." European JAR-OPS SEIFR draft regulations propose the same oxygen rule.

Although oxygen supply was not a factor in this occurrence, it has been demonstrated that pressurized SEIFR aircraft operating in Canada may have insufficient oxygen reserves to allow for an optimal engine-out descent from maximum operating level. Therefore, the Board recommends that:

• The Department of Transport require that pressurized SEIFR aircraft have sufficient supplemental oxygen to allow for an optimal glide profile during an engine-out let-down from the aircraft's maximum operating level until a cabin altitude of 13 000 feet is attained. (A00-01)

Transport Canada's Response:

Transport Canada (TC) agrees with the recommendation on additional oxygen supply for pressurized SEIFR aircraft and, subject to the Canadian Aviation Regulation Advisory Council (CARAC) consultation process, will develop Notices of Proposed Amendment (NPAs) for the applicable areas of the Canadian Aviation Regulations and associated Standards. Transport Canada is anticipating submitting these documents to the December 2000 meeting of the CARAC’s Commercial Air Services Operations Technical Committee.

Safety Action Taken
(as presented in the TSB report)

Electrical System Requirements

The SEIFR requirement for electrical power is for two independent power generating sources, either of which is capable of sustaining essential flight instruments and electrical equipment. The PC-12 meets this requirement with two generators. According to the PC-12 POH, the battery provides power for engine starting, and can also provide power to essential electrical systems for 20 minutes in the event of a dual generator or engine failure if the electrical load is less than 60 amps. If the load is reduced to below 50 amps, the battery should last for 30 minutes. Maintaining optimal glide performance after an engine failure is fundamental and, during the glide, the aircraft battery is the sole source of electrical power. Instrument meteorological conditions may exist during the descent, and, therefore, it is crucial that the battery be capable of powering the flight instruments until landing.

At the PC-12's optimal glide speed and configuration, it would take about 32 minutes to descend from 30 000 feet to sea level; a glide from 25 000 feet would take about 28 minutes. The typical electrical load from essential equipment on the PC-12 is about 50 amps, and according to the aircraft manufacturer, a 70%-capacity battery with a rated battery power of 40 amp hours can supply this load for 31 minutes. Powering only the essential instruments and lights, battery power might be nearly or completely spent prior to touchdown. It may also be necessary to power other electrical systems, further reducing battery life. An attempted engine re-light or the use of a landing light at night would both place a large draw on a battery. Electric windshield heat may also be required. With the pilot windshield heat continuously on light mode, the estimated battery life is 24 minutes; on heavy mode, the estimated life is only 22.5 minutes, which is below the optimal gliding time from the maximum operating altitude.

Other rule-making authorities have recognized that standard battery supplies are inadequate for emergency SEIFR purposes. The Australian SEIFR requirement for emergency electrical supply is for a system of:

sufficient capacity and duration that is capable of providing power following the failure of all generated power, for those loads essential for--

i. one attempt at engine restart; and

ii. descent from maximum operating altitude to be made at the best range gliding speed and in the best gliding configuration, or for a minimum of one hour, whichever is greater; and

iii. continued safe landing; and

iv. if appropriate, the extension of landing gear and flaps.

European JAR-OPS SEIFR draft regulations have proposed a similar requirement. The standard emergency power supply (battery) on SEIFR aircraft may be insufficient to power essential aircraft electrical systems throughout an engine-out descent from maximum operating altitudes at the optimal glide configuration and speed, and there is no CAR requirement that such a system be required. Therefore, the Board recommends that:

The Department of Transport require that SEIFR aircraft have a sufficient emergency electrical supply to power essential electrical systems following engine failure throughout the entirety of a descent, at optimal glide speed and configuration, from the aircraft's maximum operating level to ground level. (A00-02)

Transport Canada's Response:

Transport Canada (TC) agrees with the recommendation and, subject to the Canadian Aviation Regulation Advisory Council (CARAC) consultation process, will develop Notices of Proposed Amendment (NPAs) for applicable areas of the Canadian Aviation Regulations and associated Standards. Transport Canada is anticipating submitting these documents to the December 2000 meeting of the CARAC’s Commercial Air Services Operations Technical Committee.

Safety Action Required
(as presented in the TSB report)

Engine Chip Detector Requirements

The SEIFR equipment standard requires a chip detector system to warn the pilot of excessive ferrous material in the engine lubrication system (4). The chip detector on the accident PC-12 was designed to be disabled in flight and did not meet the intent of the equipment standard. TC has since advised operators of the PC-12 to install an engine chip detector that functions in all regimes of flight.

The chip detector system on board the PC-12 is installed at the six o'clock position in the RGB. Only the oil lubricating the RGB and a portion of the lubricating oil from the number three and four engine bearings pass over the chip detector before returning to the scavenge oil pump. None of the lubricating oil from the number one and two engine bearings and none of the oil from the AGB pass over a chip detector before returning to the scavenge oil pump. Oil from these areas goes first through the scavenge oil pump, then through the pressure pump and oil filter, before returning to lubricate the engine components. Therefore, metal generated in these areas would be filtered out prior to encountering the chip detector in the RGB. The chip detector system, as installed, is still not able to warn the pilot of ferrous material generated by all the engine components. Installation of a second chip detector, in the location of the AGB drain plug, would allow for the monitoring of all the unfiltered oil, and could also indicate the presence of ferrous particles if tied into the existing chip indicating system. The engine manufacturer has advised that this chip detecting configuration also exists on other aircraft types equipped with the PT-6 engine.

The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles, and other aircraft types using the PT-6 may be similarly configured. Therefore, the Board recommends that:

The Department of Transport require that the magnetic chip detecting system on PT-6-equipped single-engine aircraft be modified to provide a warning to the pilot of excessive ferrous material in the entire engine oil lubricating system. (A00-03)

Transport Canada's Response:

Transport Canada will review the consistency of certification and operational requirements of the chip detector system for single-engine aircraft. The results of this review will determine if any additional requirements need to be initiated.

Engine Trend Monitoring Requirements

Prior to the implementation of the Canadian SEIFR regulation, TC staff produced a position paper which proposed means of managing the associated risk. One of the proposals was for an engine performance monitoring system capable of monitoring engine parameters and comparing actual engine performance against the ideal. This system would provide operators with early indications of engine damage and deterioration. The final SEIFR rule, however, did not include a requirement for such a system.

The Australian CASA has included a requirement for automatic engine performance and condition monitoring, and the draft European policy has adopted this requirement. The FAA requires an inspection program that incorporates either the manufacturer's recommended engine trend monitoring program, which includes an oil analysis, if appropriate, or an FAA-approved engine trend monitoring program that includes an oil analysis at defined intervals.

TC initially proposed an engine monitoring system, and other regulating authorities have recognized the value of these systems and have included the requirement. These systems can provide early warning of engine deterioration and of the necessity to conduct an early removal and overhaul of the engine. Therefore, the Board recommends that:

The Department of Transport require that single-engine instrument flight rules (SEIFR) operators have in place an automatic system or an approved program that will monitor and record those engine parameters critical to engine performance and condition. (A00-04)

Transport Canada's Response:

Transport Canada (TC) agrees with the recommendation and, subject to the Canadian Aviation Regulation Advisory Council (CARAC) consultation process, will develop Notices of Proposed Amendment (NPAs) for applicable areas of the Canadian Aviation Regulations and associated Standards. Transport Canada is anticipating submitting these documents to the December 2000 meeting of the CARAC’s Commercial Air Services Operations Technical Committee.

FOOTNOTE

(4) CASS 723.22 (1)(d).

V. Kelner Airways Limited
Pilatus PC-12 C-FKAL

Mesures à prendre
(tel qu'indiqué dans le rapport du BST)

Autres exigences relatives à l'équipement

Depuis 1993, date à laquelle les vols SEIFR ont été autorisés au Canada, des améliorations technologiques importantes ont été apportées à l'équipement des aéronefs. La navigation par satellite à l'aide du GPS est maintenant chose courante en aviation commerciale, et les systèmes HUMS ainsi que les systèmes de bord élaborés de surveillance des particules dans l'huile qui peuvent détecter les matériaux non ferreux dans l'huile sont plus facilement disponibles. L'organisme de réglementation de l'Australie a ajouté certains de ces nouveaux systèmes dans ses exigences applicables aux vols SEIFR. En Australie, on exige également que les dispositifs électriques, comme les phares d'atterrissage et les altimètres radar ou les radioaltimètres, puissent être alimentés par le circuit d'alimentation électrique de secours de l'avion (autrement dit, la batterie). Il y a plusieurs autres exigences en matière d'équipement qui figurent dans la réglementation australienne mais que l'on ne retrouve pas dans la réglementation canadienne. Les équipements suivants méritent notamment d'être signalés :

• des sièges passagers ayant subi des essais dynamiques répondant aux exigences minimales des normes de la partie 23 des FAR, modification 36;
• une ceinture-baudrier ou une ceinture de sécurité avec une bretelle en diagonale homologuée pour chaque siège passager;
• un radar météorologique de bord;
• un système HUMS;
• un avertisseur d'incendie moteur.

Certains de ces équipements aident à prévenir les pertes de puissance moteur et certains permettent d'atténuer les conséquences des pannes moteur.

La politique canadienne de 1993 en matière de vols SEIFR était innovatrice. D'autres organismes de réglementation s'en sont d'ailleurs inspirés pour autoriser ce type de vol. Toutefois, il semble que la réglementation préparée par ces autres organismes ait abouti à des exigences relatives à l'équipement nécessaire pour effectuer des vols SEIFR qui soient plus strictes que celles qui figurent dans la réglementation canadienne. Les nouvelles technologies visant l'équipement des aéronefs et des modifications au montage de l'ancien équipement devraient permettre de réduire le nombre de pannes moteur pendant les vols SEIFR ou d'en atténuer les conséquences. C'est pourquoi le Bureau recommande que :

Le ministère des Transports examine la norme relative à l'équipement des aéronefs effectuant des vols SEIFR et ajoute les moyens technologiques susceptibles de minimiser les dangers associés à ce type de vol. (A00-05)

Réponse de Transports Canada :

Transports Canada (TC) accepte cette recommandation et examinera les exigences relatives à l’équipement des aéronefs effectuant des vols SEIFR en tentant de réduire le plus possible les dangers associés à ce type de vol. Les efforts pour mettre en oeuvre les recommandations du Bureau relativement aux systèmes de surveillance EMS, à la réserve d’oxygène additionnelle et à l’alimentation électrique additionnelle feront partie intégrante de cet examen. Pour toute modification proposée à la réglementation, les résultats de cet examen feront l’objet de consultations par l’entremise du CCRAC.

Prise de décisions du pilote

Dans le présent accident, le pilote a mal interprété l'indication de basse pression d'huile et n'a pas éprouvé le besoin « d'atterrir le plus vite possible », si bien que le moteur est tombé en panne avant qu'il ne puisse se poser en toute sécurité. Les décisions du pilote ont été influencées par le fait qu'il croyait à tort que les indications de basse pression d'huile étaient fausses. Le pilote a été victime du phénomène de « dépistage des erreurs ». Dans le passé, le BST a fait la recommandation A95-11 au sujet de la formation CRM et de la formation PDM à l'intention de tous les exploitants et membres d'équipage oeuvrant dans l'aviation commerciale. Encore de nos jours, des pilotes au service de petits exploitants aériens commerciaux ont du mal à prendre de bonnes décisions et la situation inquiète le BST. La qualification SEIFR n'oblige pas à avoir suivi un cours précis en PDM; toutefois cette formation est exigée pour pouvoir recevoir des qualifications autorisant à évoluer dans des milieux moins complexes, par exemple en limites VFR réduites.

La seule exigence réglementaire qui oblige les pilotes professionnels à recevoir la formation PDM officielle se trouve dans les exigences des NSAC portant sur les pilotes évoluant par visibilité réduite. Le rapport de Transports Canada sur l'examen de la sécurité de l'exploitation d'un taxi (SATOPS) spécifie qu'on estime que ce cours à lui seul n'est pas suffisant pour l'exécution de vols en visibilité réduite, compte tenu de la nouvelle information sur les facteurs humains et la prise de décisions. Le rapport SATOPS précise également que le cours standard dispensé contient une information désuète et ne répond pas aux besoins de l'industrie.

Transports Canada a élaboré son cours PDM au cours des années 80. Les théories et les modèles entourant le comportement humain et la prise de décisions ont évolué depuis, mais le contenu du cours n'a pas été modifié pour tenir compte de cette évolution. La valeur de la formation en PDM est généralement reconnue dans tout le milieu de l'aviation. Le rapport SATOPS précise que les pilotes et les exploitants croient que la formation sur la prise de décisions du pilote peut être très utile et pratique pour l'exploitation quotidienne. Certains croient même que le cours devrait être obligatoire pour les pilotes et la direction.

La formation en simulateur qui met l'accent sur la prise de décisions dans des situations complexes est un moyen très efficace d'augmenter les compétences en PDM.

Le pilote de l'avion accidenté n'a pu compter ni sur une formation PDM, ni sur des SOP de compagnie, ni sur une formation en simulateur de PC-12 pour l'aider à prendre des décisions. Sans une approche systémique visant à améliorer la PDM, des accidents liés à de mauvaises décisions prises dans des situations complexes vont continuer à se produire dans l'aviation commerciale. Le Bureau croit qu'une meilleure formation PDM officielle est nécessaire pour tous les pilotes professionnels. Le Bureau estime également qu'il faut insister davantage sur la prise de décisions lors de la formation des pilotes et de toutes les activités liées au pilotage et également que la mise en place de procédures d'utilisation normalisées devraient permettre de réduire le nombre d'accidents liés à de mauvaises décisions. C'est pourquoi le Bureau recommande que :

Le ministère des Transports établisse des normes de formation pour les membres d'équipage en vue d'améliorer la qualité de la formation sur la prise de décisions destinée aux pilotes de l'aviation commerciale. (A00-06)

Réponse de Transports Canada :

Transports Canada est d’accord avec l’éventualité que le cours Prise de décision du pilote - général, actuellement offert aux pilotes et exigé en vertu de la norme d’exploitation dans des conditions de visibilité réduite, soit amélioré pour les aéronefs effectuant des vols SEIFR à haute altitude dans un appareil pressurisé comme le PC12. TC examinera la norme de formation et, au besoin, la modifiera par le processus de consultation du CCRAC.

A98O0184 - Main Landing Gear Collapsed - Transport Canada - Beech A100 King Air C-FDOR - Ottawa MacDonald-Cartier International Airport, Ontario - 16 July 1998

Summary

The Beech A100 King Air, serial number B-103, departed Ottawa MacDonald-Cartier International Airport at 0830 eastern daylight saving time on an instrument flight rules (IFR) training flight to North Bay, Ontario, with two flight crew on board. At North Bay, the crew conducted a radar-vectored back-course approach to runway 26 with a touch-and-go landing followed by two visual flight rules touch-and-go landings, then a full-stop landing. The flight crew switched seat positions in the aircraft and departed on a return IFR flight to Ottawa. At Ottawa, when the landing gear was selected down, the crew observed an unsafe landing gear indication in the cockpit and requested and received overshoot instructions from air traffic control. Visual observation from the ground during the overshoot confirmed the landing gear was not extended. The flight crew carried out the emergency landing gear extension procedure, but still observed an unsafe landing gear position indication for the right main landing gear; however, the landing gear appeared to be extended when observed from the ground. The flight crew discussed how the landing would be carried out, requested emergency rescue services for the landing, and proceeded to land on runway 25. On the landing roll, the right main landing gear collapsed and the aircraft went off the right side of the runway. There were no injuries. The accident occurred during the hours of daylight in visual meteorological conditions.

Transport Canada
Beech A100 King Air C-FDOR

 

Safety Action Taken(as presented in the TSB Report)

 

Since the occurrence Transport Canada, ASD, has taken the following actions:

1. The Beech A100 King Air SOPs have been amended to allow a single, in-flight reset of the electric hydraulic pump motor 60-amp circuit breaker.
2. The 60-amp circuit breaker in the accident aircraft has been relocated to the aircraft cockpit. This location is now the same as on the other Beech King Air aircraft in the ASD fleet that have the Aviadesign STC hydraulic landing gear.
3. A mirror has been installed on the inboard side of the Beech A100 King Air engine cowlings to provide a means for pilots to observe the nose landing gear position from the aircraft cockpit.
4. The ASD Flight Operations Manual was amended to read, "where practicable, it is recommended that the pilot contact the applicable ASD operations centre, and state the nature of the problem, the assistance required, and the time remaining before a landing is necessary."

Safety Action Required
(as presented in the TSB Report)

The safety actions taken by Transport Canada, ASD, have possible continuing airworthiness operational implications for the fleet of similar aircraft operating elsewhere in Canada and in other countries. These actions include permitting a single in-flight reset of the electric hydraulic pump motor 60-amp circuit breaker, relocating the 60-amp circuit breaker to the cockpit, and installing a mirror to provide a means for the pilot to observe the nose landing gear position from the cockpit. Dissemination of this information to other King Air operators in Canada and around the world for the purpose of possible similar safety actions by other operators would reduce the risk of similar accidents.

Annex 8, "Airworthiness of Aircraft," to the Convention on International Civil Aviation contains provisions urging the State of Registry of an aircraft to notify the State of Design about information that might cause adverse effects on the continuing airworthiness of an aircraft. It seems appropriate that the changes to the configuration and operating procedures for the Transport Canada King Air fleet should be brought to the attention of the Federal Aviation Administration in the United States, the State of Design, for possible fleet-wide safety action. Therefore, the Board recommends that:

The Department of Transport ensure that all Canadian operators of the Beech King Air with the Aviadesign landing gear modification are advised of the circumstances of this accident and the safety actions taken, with the view toward implementing similar changes to prevent a future similar accident. (A00-07)

Transport Canada's Response:

A Service Difficulty Advisory ( HTML or PDF ) has been published and distributed to all Aircraft Maintenance Engineers, owners, and operators of affected aircraft. In addition, Transport Canada will publish an article in the Aviation Safety Letter to inform operators of the accident and the safety actions taken.

The Department of Transport notify the United States Federal Aviation Administration, in accordance with Annex 8, "Airworthiness of Aircraft," to the Convention on International Civil Aviation, about the circumstances of this accident and the safety actions taken, with the view toward wider application of the safety actions. (A00-08)

Transport Canada's Response:

A letter has been sent to the FAA outlining Transport Canada’s concerns regarding the Aviadesign Supplemental Type Certificate SA 0313WE
( HTML or PDF )

Service Difficulty Advisory

This Service Difficulty Advisory brings to your attention a potential problem identified by the Service Difficulty Reporting Program. It is a non-mandatory notification and does not preclude issuance of an airworthiness directive.

Aviadesign STC SA4013WE (Beech 99, King Air, Queen Air & Swearingen SA26)

Main Landing Gear Collapse

Following an incident resulting in a gear collapse on a Beech A100 equipped with Aviadesign Hydraulic Gear Installation, STC SA 4013WE, Transport Canada has concerns that certain characteristics of this STC and the subsequent changes to the Aircraft Flight Manual may have safety implications that other operators of aircraft equipped with this STC should be made aware of.

During routine flight training, repeated cycling of the gear, coupled with a partially depleted landing gear hydraulic accumulator, led to the overheating of the landing gear hydraulic system circuit breaker, causing it to trip. This led to an unsuccessful emergency gear extension.

A depleted nitrogen charge in the landing gear hydraulic accumulator will cause the landing gear hydraulic pump electric motor to cycle excessively and may lead to the overheating of the circuit breaker, causing it to trip. The STC holder recommends inspection of the nitrogen charge every 1000 hours of aircraft operation or at major inspection (Aviadesign Maintenance Manual M-8101). It is strongly recommended that this inspection interval be decreased to 200 hours or less.

Transport Canada also reminds operators with a mixed fleet of similar aircraft, some incorporating this modification to the landing gear system and some not, to ensure that flight crews are fully cognizant of the different procedures amongst the types and understand changes to standard and emergency operating procedures (ref. CARs 705.138 (1) and 604.83).

For further information, contact a Transport Canada Centre, or Mr. Paul Jones, Continuing Airworthiness, Ottawa

Telephone (613) 952-4431, facsimile (613) 996-9178 or
e-mail jonesp@tc.gc.ca.

For Director, Aircraft Certification

B. Goyaniuk Chief,
Continuing Airworthiness Chef

To request a change of address, contact the Civil Aviation
Communications Centre (AARA) at Place de Ville, Ottawa,
Ontario K1A 0N8, or 1-800-305-2059, or
http://www.tc.gc.ca/eng/civilaviation/opssvs/contact-us-137.htm
24-0058 (02-2000)
No. AV-2000-03 2/2

Service Difficulty Advisory

Department of Transportation
Federal Aviation Administation
Regulation and Certification
Aircraft Certification
800 Independence Avenue SW.
Washington, DC
USA 20591

Subject Aviadesign STC SA 4013WE Hydraulic Gear Installation

Dear Sir:

Following an incident involving a gear collapse on a Beech King Air 100 equipped with Aviadesign Hydraulic Gear Installation, STC SA 013WE, Transport Canada, Continuing Airworthiness has concerns that certain characteristics of this STC may have safety implications that other operators of aircraft equipped with this STC should be made aware of.

An accurate reading of the nitrogen charge in the system accumulator is only possible with the system pressure depleted and the accumulator disconnected. This check is required every 1000 hours of aircraft operation or at major inspection (Aviadesign maintenance manual M-8101). Should this charge be depleted the landing gear hydraulic electric motor will cycle excessively and may lead to the oeverheating of the circuit breaker, causing it to trip. Transport Canada recommends that this inspection interval should be decreased to 200 hours of aircraft operation.

Repeated cycling of the gear, as in a training situation may also lead to the overheating of the circuit breaker, causing it to trip.

Transport Canada also recommends that operators review the Aircraft Flight Manual to ensure the changes in the emergency gear extension procedures as well as the normal operation of the system and identification of a malfunction are clearly stated.

Transport Canada will be issuing a Service Difficulty Advisory ot notify the Canadian operators of these concerns.

If there are questions on this letter, please contact Paul Jones, 613-952-4431, jones@tc.gc.ca.

Yours truly,

B. Goyaniuk
Chief, Continuing Airworthiness

A98Q0114 - Spin - Loss of Directional Control - Laurentide Aviation - Cessna 152 C-GZLZ - Lac Saint-François, Quebec - 18 July 1998

Summary

At about 0850 eastern daylight time, a flight instructor and a student took off on a local training flight from runway 25 at Montréal/Les Cèdres Aerodrome, Quebec. The student pilot was practicing spins and recoveries. The student initiated a spin to the left, his sixth of the day, at an altitude of 3 600 feet above sea level. The first five spins were to the right. The aircraft entered the spin normally. After one and a half turns, the flight instructor asked the student to recover. The student applied pressure on the right rudder pedal, as taught by the flight instructor, and the rotation did not stop. The flight instructor took over the controls and applied pressure on the right rudder pedal to stop the rotation, but the rotation did not stop. The aircraft, by then, was established in a stabilized spin, rotating to the left, and continuing its descent. The flight instructor applied full power for a moment, then full flaps, to no avail. Throughout the recovery attempt, the flight instructor continued in his efforts to avoid the crash. The aircraft struck the surface of Lac Saint-François. The student pilot sustained serious injuries but managed to evacuate the sinking aircraft through the right, rear window. He then tried to pull out the unconscious flight instructor, but without success. A fisherman close to the scene rescued the student and transported him ashore where emergency vehicles were standing by. The flight instructor did not evacuate the aircraft and died in the accident.

Laurentide Aviation Cessna 152 C-GZLZ

 

Safety Action Taken(as presented in the TSB Report)

 

On 14 March 2000, Cessna notified the TSB that it had designed a rudder horn stop bolt with a larger head diameter to prevent over-travel of the rudder following a hard rudder input. Cessna has notified the Federal Aviation Administration (FAA) Aircraft Certification Office about this matter and expects to issue a Service Bulletin offering the new configuration rudder stop bolt for all Cessna 150s and 152s built after 1966. A time frame for these actions was not specified.

On 09 May 2000, Transport Canada issued Service Difficulty Alert (SDA) No. AL-2000-04 following information gathered during the tests carried out at Saint-Hubert on 22 February 2000. The SDA discusses the accident circumstances and outlines details regarding the inspection of the rudder control system.

Safety Action Required
(as presented in the TSB Report)

While stated action by Cessna to develop a Service Bulletin designed to prevent over-travel of the rudder is appropriate, the Board is concerned that, since the proposed Service Bulletin will be voluntary, not all Canadian-registered Cessna 150s and 152s will be modified. Therefore, the Board recommends that:

The Department of Transport issue an Airworthiness Directive to all Canadian owners and operators of Cessna 150 and 152 aircraft addressing a mandatory retrofit design change of the rudder horn stop bolt system to preclude over-travel and jamming of the rudder following a full rudder input. (A00-09)

Transport Canada's Response :

Transport Canada (TC) is responsible for regulating the airworthiness of aircraft operated in Canada. Transport Canada has been in continual discussions with the United States Federal Aviation Administration (FAA), which is the state of design airworthiness authority responsible for the Cessna 150 and 152 aircraft. The FAA informed Transport Canada that Cessna has not yet developed a retrofit design change. Cessna is, however, planning to provide a product improvement kit to modify the rudder system stops on these aircraft.

To further ensure the safety of the Canadian Cessna 150/152 fleet, Transport Canada has issued Emergency Airworthiness Directive (AD) CF-2000-20 dated August 2, 2000 to be effective August 4, 2000. The AD prohibits intentional spins and incipient spins until an airworthiness inspection of the rudder system is complete and imposes thereafter an inspection every 110 hours or 12 months, whichever occurs first. The FAA has not taken such a mandatory action but is cognizant of Transport Canada’s action.

When a modification is made available by Cessna, Transport Canada, together with the FAA, will review the modification and assess whether mandatory retrofit is appropriate.

Any mandatory airworthiness actions to retrofit Cessna 150 and 152 aircraft with newly designed rudder horn stop bolt systems will likely take considerable time to complete. In the meantime, these aircraft will be flying with a known safety deficiency. The circumstances of this accident suggest that the serious implications of the broken or missing rudder cable return spring were not fully understood. Moreover, the possibility of an irreversibly jammed rudder during intentional spin entry by full rudder deflection was not understood until this accident investigation was completed. Therefore, the Board recommends that:

The Department of Transport, in conjunction with the Federal Aviation Administration, take steps to have all operators of Cessna 150 and 152 aircraft notified about the circumstances and findings of this accident investigation and the need to restrict spin operations until airworthiness action is taken to prevent rudder jamming. (A00-10)

Transport Canada's Response :

The Cessna 150 and Cessna 152 are primary flight training aircraft. There are approximately 1,500 such aircraft in Canada and an estimated 21,000 of these aircraft in service world-wide. Investigations by Transport Canada and the FAA have not found evidence of a previous occurrence of such an accident. There is, however evidence that under certain conditions, the rudder of the Cessna 150/152 aircraft can over-travel the rudder stops. This would be a prerequisite to the rudder jamming in a fully deflected position.

To ensure awareness, Transport Canada issued Service Difficulty Alert No. AL-2000-04 ( HTML or PDF ) dated May 9, 2000 to owners, operators and the aviation maintenance community, informing them of the circumstances and safety issues related to this accident. The Service Difficulty Alert, similar to FAA ACE-118W ( HTML or PDF ), recommends a detailed inspection of the rudder control system.

Laurentide Aviation Cessna 152 C-GZLZ

 

Safety Action Required(as presented in the TSB Report)

 

The required logbook entries regarding the maintenance performed on the rudder system were not made, and it was evident that the operator, in general, did not maintain the aircraft journey logbooks in accordance with the Canadian Aviation Regulations (CARs). Therefore, the Board recommends that:

The Department of Transport take steps to ensure that operators and maintenance personnel are aware, in the interests of safety, of the importance of proper maintenance of aircraft journey logbooks and are aware of their responsibilities in this regard. (A00-11)

Transport Canada's Response:

Canadian Aviation Regulation 605.94 (Schedule 1) requires that defects be entered in the aircraft journey log "...as soon as practicable after (the) defect is discovered but, at the latest, before the next flight...". However, there is evidence that the practice of not using the aircraft journey log to document all aircraft defects is not an isolated condition in the flight training community. Transport Canada will identify causes for this practice and develop a co-ordinated effort to redress the situation.

Transport Canada will develop an article for publication in Transport Canada’s Aviation Safety Newsletter "The Maintainer". The article will use the facts of the accident to illustrate the importance of correctly documenting aircraft defects and maintenance action. Transport Canada intends to place emphasis on maintenance documentation during field inspections, audits and visits to commercial operators.

Transport Canada has already addressed the necessity of, and relevant regulation concerning, correct maintenance record keeping at recent Flight Instructor Refresher Courses. This will be a recurrent instructional item at Refresher Courses. Regional Flight Training inspectors communicate regularly with flight training units in their area. There will be further emphasis placed on this issue through audits and inspections of these training organizations. A Guidance Note on this issue has been drafted and will be posted to the Transport Canada Flight Training web site.

The FAA, as the regulatory body in the state of design and manufacture, has primary responsibilities with regard to continuing airworthiness of both the Cessna 150 and 152 aircraft. Therefore, the Board recommends that:

The National Transportation Safety Board review the circumstances and findings of this investigation and evaluate the need for mandatory airworthiness action by the Federal Aviation Administration. (A00-12)

Transport Canada's Response:

Although this recommendation is not directed at Transport Canada, Transport Canada will continue to share all relevant information with the FAA in the interests of safety and efficiency in dealing with this issue.

A99W0061 - In-Flight Fire - Aerospatiale AS 355 F1 Twinstar (Helicopter) C-GTUI - Fairview, Alberta 10 nm E - 28 April 1999

Summary

The Aerospatiale AS 355 F1 Twinstar helicopter had completed a routine gas pipeline patrol and was returning to Fairview, Alberta, with the pilot and one passenger on board. During a shallow cruise descent into Fairview, at about 800 feet above ground, the red battery temperature light illuminated on the warning caution advisory panel. The pilot observed that the voltmeter and ammeter indications were normal and turned off the battery. About three minutes later, at approximately 500 feet above ground and as the pilot was contemplating a precautionary landing, the helicopter lost all electrical power and the cabin and cockpit began to fill with smoke and fumes. The pilot and passenger opened the side windows to ventilate the cabin, and the pilot accomplished an emergency landing at once on an available farm field. After landing, the pilot shut down the engines and both occupants evacuated the helicopter without further incident or injury. Flames were observed to be emanating from the vicinity of the right baggage compartment, and the helicopter was subsequently destroyed by an intense ground fire.

Safety Action Taken
(as presented in the TSB Report)

The operator took the following actions since this occurrence:

• all aviation staff members were briefed, emphasizing the importance of conducting all Daily Operating Checks, as specified in the AFM;
• all pyrotechnics carried in survival kits on board the operator's Twinstar fleet were removed and replaced with an updated product;
• all pyrotechnics in company survival kits are stored in a suitable container; and,
• all pyrotechnics on the merging operator's Bell 206 fleet were checked to ensure that they were not outdated and that they were stored in accordance with the operational specification.

Transport Canada published, in Aviation Safety Maintainer (Issue 4/99), Floating Battery Cable Fire Hazard, an article in which risks and hazards associated with this occurrence were identified.

Safety Action Required
(as presented in the TSB Report)

Packaging Standards

The survival and emergency equipment carried on board the helicopter included a five-person survival shelter and an emergency survival kit that contained emergency flares. The bags that housed the survival and emergency equipment were made of flammable nylon; the bags were not required to be flame-resistant. During testing, the bag materials ignited quickly, melted, dripped, and were totally destroyed by fire. The highly combustible nature of this packaging material contributed to the severity of this occurrence by providing a ready source of fuel in the face of the arcing event. In addition, survival equipment transported in flammable packaging reduces the likelihood that this equipment will be available for its intended purpose.

The survival kits in each of the four company helicopters contained two hand-held, marine-type, parachute flares and four day/night smoke flares. All flares on board the accident helicopter had ignited and discharged during the fire. The flares are classified as 1.2G and 1.4G explosives. Materials classified as 1.2G explosives are forbidden to be shipped on cargo and passenger aircraft under International Air Transport Association (IATA) dangerous goods regulations. Goods classified as 1.4G explosives can be shipped on cargo aircraft, provided that they are packaged in accordance with the appropriate packaging instructions. The emergency flares in two of the three survival bags in the company sister ships were packaged in crumpled newspaper to prevent abrasion. IATA Dangerous Goods Packing Instruction 905 requires signal devices transported as dangerous goods to be packaged in plastic or fibreboard inner containers. Current dangerous goods regulations do not apply to products that are necessary for the safety of the persons on board the means of transport. Any condition that unnecessarily increases the potential for the initiation or propagation of a fire on board an aircraft is hazardous, putting passengers and crew at risk. Therefore the Board recommends that:

The Department of Transport ensure that air operators store aircraft survival gear on aircraft in flame-resistant material and package emergency pyrotechnics and other highly flammable survival equipment at least to the standards required by International Air Transport Association (IATA) Dangerous Goods Regulations. (A00-13)

Transport Canada's Response:

Transport Canada agrees with the intent of the Recommendation which is to ensure the likelihood that survival equipment will be available after an accident for the intended purposes and to reduce the potential for this equipment to initiate or propagate a fire on board an aircraft.

Transport Canada will proceed with the development and distribution of a Commercial & Business Aviation Advisory Circular (CBAAC) incorporating the TSB recommendation to store flares in survival equipment to International Civil Aviation Organisation (ICAO) Technical Instruction packing standards. A Notice of Proposed Amendment (NPA) to the Canadian Aviation Regulations (CARs) will also be prepared. The NPA will be submitted to the Part VI Technical Committee of the Canadian Aviation Regulation Advisory Council (CARAC) for consultation with stakeholders by June 2001.

Safety Action Required
(as presented in the TSB Report)

Maintenance Control System

Canadian air regulations require that a private operator that transports passengers in a turbine-powered, pressurized airplane or a large airplane comply with the conditions and specifications in either a private OC or an air OC. Under these provisions, the operator is required, as a condition of the OC, to maintain the airplane in accordance with an approved maintenance control system. However, no regulations require private helicopter operators, carrying passengers as above, to operate under the authority of an OC or to maintain the helicopters in accordance with an approved maintenance control system. Moreover, there is no provision for an operator to voluntarily apply for or obtain an OC.

The company was operating four complex, high-performance, twin-engine helicopters to transport company employees throughout Alberta. The company maintenance organization structure, policies, and guidelines would not have met TC standards for a maintenance control system. Such a system is designed to minimize the probability of maintenance errors. The Board is concerned that passengers are regularly being carried in helicopters that are not subject to the more stringent maintenance standards required for fixed-wing aircraft that carry passengers, and it recommends that:

The Department of Transport ensure that helicopters used by private operators to transport passengers receive a standard of maintenance equivalent to that for fixed-wing aircraft for the same type of operation. (A00-14)

Transport Canada's Response:

Transport Canada has reviewed the TSB Recommendation and understands that the intent of the recommendation is that helicopters used by private operators, such as the AS 355 be maintained under the provisions of a maintenance control system as required by the regulation governing the carriage of passengers in privately owned, turbine-powered, pressurized or large aeroplanes under Canadian Aviation Regulation (CAR) 604. This requires that an operator have a Private Operator Certificate, which in turn requires that a maintenance control system be in effect.

Transport Canada’s safety oversight philosophy is based on risk management principles, with consideration given to the size of the aircraft, the number of passengers carried onboard, the technical sophistication of the aircraft and the complexity of the environment in which the aircraft operates under.

The AS 355 is turbine powered, carries a maximum of five passengers and operates under Visual Flight Rules. The AS 355 would not be considered to meet the criteria which would require the acquisition of a Private Operator Certificate, even if helicopters were to be included in the regulations governing corporate aeroplanes.

There has been no demonstrated systemic safety deficiencies in this type of helicopter operation that would justify increasing regulatory requirements and the level of oversight by Transport Canada.

Transport Canada believes that enhanced safety awareness of the necessity to follow proper maintenance procedures would be the best approach to addressing the safety concern raised by the TSB in this recommendation. An article highlighting the Safety lessons learned from this occurrence will be published in the Aviation Safety Letter and the Aviation Safety Maintainer newsletter.

A99H0001 - Loss of Separation between Air Canada Boeing 767-233 C-GPWB and Canadian Airlines International Boeing 767-300 C-FCAG Langruth, Manitoba, 35 nm W - 18 January 1999

Loss of Separation - between Air Canada and Canadian Airlines
Langruth, Manitoba- 18 January 1999

Summary

Canadian Airlines International Flight 987 (CDN 987), a Boeing 767, departed Toronto, Ontario, en route to Vancouver, British Columbia, at flight level (FL) 390. Air Canada Flight 118 (ACA 118), a Boeing 767, departed Calgary, Alberta, en route to Toronto at FL 370. Approximately 55 nautical miles (nm) west of the Langruth, Manitoba, VOR (very high frequency omni-directional radio range), ACA 118 requested and was cleared to climb to FL410. The pilot of CDN 987, when approximately 35 nm west of the Langruth VOR, advised the controller that he was climbing out of FL 390 because of a traffic alert and collision-avoidance system (TCAS) resolution advisory (RA) straight ahead. A loss of separation occurred when the two aircraft passed within 3 nm horizontally with less than 1 000 feet of vertical spacing. The required separation is 5 nm horizontally or 2 000 feet vertically.

Air Canada Boeing 767-233 C-GPWB and
Canadian Airlines International Boeing 767-300 C-FCAG

Safety Action Taken
(as presented in the TSB Report)

The Canadian Air Traffic Control Association and NAV CANADA concluded a collective agreement which increased the minimum time between shifts from 8 hours to 10 hours and reduced the maximum consecutive hours of work from 12 hours to 11 hours.

NAV CANADA has initiated a process to reduce the number of extended shifts worked by controllers. As well, NAV CANADA has adopted a policy of staffing all air traffic services units to 105 per cent of NAV CANADA's defined staffing levels and has committed 50 million dollars annually to training in order to reach this goal.

Safety Action Required
(as presented in the TSB Report)

Risk-of-collision occurrences between large transport-category aeroplanes operating in a radar environment continue to occur in Canadian airspace. There are several ground and airborne layers of defence to prevent midair collisions caused by human errors. The last available ground-based defence that could have prevented this occurrence, human redundancy, was absent because the sector was operated by only one controller and the supervisor was actively controlling at another position. The TCAS provided an airborne defence that alleviated this dangerous situation. However, reliance on a TCAS as the sole automated defence against human error leading to midair collisions does not provide protection for all Canadian passenger-carrying aircraft. There are no Canadian regulatory requirements for TCAS installation on domestic, passenger-carrying aeroplanes, and there are no requirements for TCAS on any cargo aeroplanes.

The TSB has investigated other similar loss-of-separation occurrences (A98H0002, A97H0007, and A99W0064, under investigation) that contain many of the same elements addressed in this report. In the most recent occurrence (A00H0002, under investigation), two Airbus A340 aeroplanes were at the same altitude on undetected collision courses over the Gulf of St. Lawrence when the pilot of one aeroplane received a TCAS advisory and alerted the controller. These occurrences raise concerns about the lack of adequate, ground-based, conflict prediction and alerting systems in Canada.

The CASB identified the need to develop and install automated conflict prediction and alerting systems in the Canadian air traffic services system in its recommendation CASB 90-36. Although work has been ongoing over the years by Transport Canada, and most recently by NAV CANADA, there are no definitive commitments to set an implementation date.

There are serious consequences to midair collisions between large transport-category aeroplanes. Additionally, there is a lack of sufficient ground-based defences to contain normal levels of human error, which may lead to losses of separation. Therefore, the Board recommends, for the consideration of both NAV CANADA and the Minister of Transport, that:

NAV CANADA commit, with a set date, to the installation and operation of an automated conflict prediction and alerting system at the nation's air traffic control facilities to reduce the risk of a midair collision. (A00-15)

Transport Canada's Response:

NAV CANADA is in the process of developing an Air Traffic Control conflict alert system and will begin testing of the system in Toronto Area Control Centre by March 31, 2001. Transport Canada will monitor this testing and assess the necessity of a regulatory approach to address the Board’s recommendation.

Further, a Notice of Proposed Amendment (NPA) was presented at a June 2000 Canadian Aviation Regulations Advisory Council (CARAC) Technical Committee meeting. The NPA states "... by 1 January 2003 no person shall conduct a take-off in a turbine-powered aeroplane that has a maximum certificated take off weight of more than 15,000 kg or for which a type certificate has been issued authorising the transport of more than 30 passengers, unless the aeroplane is equipped with an Airborne Collision Avoidance System (ACAS) that conforms to the Aircraft Equipment and Maintenance Standards." The amendment to the Canadian Aviation Regulation (CAR) will exceed the International Civil Aviation Organization (ICAO) standard which will come in to effect in 2003.

A98H0003 - Interim Aviation Safety Recommendations - In-flight Firefighting (Swissair Flight III)

The Circumstances of Swissair Flight 111 Accident

On 02 September 1998, Swissair Flight 111 (SR 111), a McDonnell Douglas MD-11 aircraft, was travelling from New York to Geneva with 215 passengers and 14 crew on board. Approximately 53 minutes after take-off, as the aircraft was cruising at flight level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes, the flight crew noted smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Air Traffic Services (ATS). SR 111 was cleared to the Halifax airport from its position 58 nautical miles to the southwest. While manoeuvring in preparation for landing, the crew advised ATS that they had to land immediately and declared an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about 7 minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants.

Interim Aviation Safety Recommendations
In-flight Firefighting - Swissair Flight III

Background

The aircraft crashed into the ocean, and all fire damage occurred in flight. The investigation (A98H0003) has identified extensive fire damage above the ceiling in the forward section of the aircraft extending about 1.5 metres forward and 5 metres aft of the cockpit bulkhead. Although the origin of the fire has not been determined, the investigation has revealed safety deficiencies in design, equipment, and crew training, awareness, and procedures related to in-flight firefighting. The elimination of these safety deficiencies would reduce the loss of life by increasing the probability of the prompt detection and suppression of in-flight fires.

The TSB is concerned with the approach taken by the aviation community in minimizing the risk and in addressing the means that are available for an aircraft crew to consistently detect and suppress fires within the pressurized portion of the aircraft.⁽¹⁾

When confronted with an in-flight fire, an aircraft crew must be prepared to rely solely on their experience and training, and on the aircraft equipment at hand. Therefore, effective in-flight firefighting measures should allow an aircraft crew to quickly detect, analyse and suppress any in-flight fire.⁽²⁾ While it is difficult to predict how much time might be required to bring a particular in-flight fire under control, the earlier a fire is detected, the better.

Anecdotal information suggests that odour/fumes/smoke occurrences that do not develop into in-flight fires are not unusual but that, where an in-flight fire does develop, there is very little time available to gain control of the fire. The TSB reviewed a number of databases to validate this information. The review confirmed that there are numerous odour/fumes/smoke occurrences; however, occurrences leading to accidents as a result of uncontrolled fires similar to SR 111 are rare. Details of the TSB review of available data are included in Appendix A. This sample of in-flight fire accidents was compiled based on similarity to SR 111. These data indicate that, in situations where there is an in-flight fire that continues to develop, the time from detection until the aircraft crashed varied from 5 to 35 minutes.

Furthermore, the TSB looked at numerous in-flight fire events that, because of variances with the criteria established for the review, were not included in the validation process. Many of these events resulted in fatalities and each contains examples of where one or more components of the firefighting system failed to provide adequate protection. Appendix B contains a sample of these events.

Safety Deficiencies

The TSB has identified safety deficiencies in several aspects of the current government requirements and industry standards involving in-flight firefighting. These deficiencies increase the time required to assess and gain control of what could be a rapidly deteriorating situation. When viewed together, these deficiencies reflect a weakness in the efforts of governments and industry to recognize the need for dealing with in-flight fire in a systematic and effective way.

The Board's interim air safety recommendations address safety deficiencies in the following areas:

• The lack of a coordinated and comprehensive approach to in-flight firefighting increases the overall risk.
• Smoke/fire detection and suppression systems are insufficient.
• The importance of making prompt preparations for a possible emergency landing is not recognized.
• The time required to troubleshoot smoke/fire problems is excessive.
• Access to critical areas within aircraft is inadequate.

Integrated Firefighting Measures

An important aspect of the Board's mandate to advance transportation safety is to look beyond the specific circumstances of any single occurrence and identify systemic safety deficiencies. Over the years, lessons learned from a number of accidents have resulted in modifications to aircraft, systems, and procedures as a direct response to specific failures.⁽³⁾ However, aircraft and equipment design changes aimed at providing better firefighting measures have sometimes been made in isolation from each other. Although considerable efforts have been made to prepare and equip aircraft crews to handle in-flight fires, these efforts have fallen short of adequately preparing aircraft crews to detect, locate, access, assess, and suppress in-flight fires in a coherent and coordinated manner.

In-flight firefighting "systems" should include all procedures and equipment necessary to prevent, detect, control, and eliminate fires in aircraft. This systems approach would include material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures and training. All of these components should be examined together and the inter-relationships between individual firefighting measures should be re-assessed with a view to developing improved, comprehensive firefighting measures. The Board believes that the most effective in-flight firefighting capability will exist when the various elements of the firefighting system are integrated and complementary; it therefore recommends:

Appropriate regulatory authorities, in conjunction with the aviation community, review the adequacy of in-flight firefighting as a whole, to ensure that aircraft crews are provided with a system whose elements are complementary and optimized to provide the maximum probability of detecting and suppressing any in-flight fire. (A00-16)

Smoke/Fire Detection and Suppression

Designated Fire Zones

Presently, the requirements for built-in smoke/fire detection and suppression systems are restricted to those areas that are not readily accessible, and in which a high degree of precaution must be taken.⁽⁴⁾ Areas such as these, either inside or outside the pressurized portion of the aircraft, are designated as "fire zones" due to the presence of both ignition sources and flammable materials. Consequently, aircraft manufacturers must provide built-in detection and suppression systems in powerplants (including Auxiliary Power Unit (APU)), lavatories, and cargo and baggage compartments.⁽⁵⁾ The built-in suppression features are either automatic, as in lavatories, or controlled from the cockpit, as in powerplants. In each case the extinguishing agent must consist of an amount and nature tailored to the types of fire most likely to occur in the area where the extinguisher is used.⁽⁶⁾

There are no requirements for built-in smoke/fire detection and suppression systems in the remaining areas of the pressurized portion of the aircraft. Detection and suppression in non-designated fire zones, such as the cockpit, cabin, galleys, electrical and electronic equipment (E&E) compartments, and attic spaces are, for the most part, dependant on human intervention.⁽⁷⁾

Non-Designated Fire Zones

Detection of smoke and fire in non-designated fire zones depends on the eyes, ears and noses of the crew and passengers. However, while some areas of an aircraft are almost certain to have a human presence during much of a flight, other areas, such as E&E compartments and attic areas, are more remote. A fire may ignite and propagate in these areas well out of the range of any human detection. The United States National Transportation Safety Board (NTSB) report on an Air Canada DC-9 in-flight fire that occurred near Cincinnati on 02 June 1983 suggests that the crew first detected smoke approximately 11 minutes after the related circuit breakers tripped.⁽⁸⁾ Compounding this problem, in most transport category aircraft the occupied areas are isolated from the inaccessible areas by highly efficient aircraft ventilation/filtering systems, which can effectively remove combustion products from small fires. These systems can allow small fires to burn undetected by cabin occupants.⁽⁹⁾

Some areas not designated as fire zones have been treated as "benign", from a fire potential perspective. They have not been assessed by the aviation industry as needing built-in fire detection or suppression equipment. Furthermore, there has not been a recognized need either to train aircraft crews for firefighting in all of the non-designated fire zones, or to design aircraft so as to allow quick and easy access to these areas for firefighting purposes.

Aircraft materials must conform to fire-related standards. These requirements necessitate that materials used in compartment interiors, and in cargo and baggage compartments, meet the applicable test criteria.⁽¹⁰⁾ In interim Air Safety Recommendation A99-08, dated 11 August 1999, the TSB identified limitations in these test criteria which allowed flammable material, used as a covering on thermal-acoustical insulation blankets, to be certified for use in aircraft. The Federal Aviation Administration (FAA) is actively pursuing a replacement program for a specific insulation cover material (metallized Mylar), which it deems to pose the greatest risk. Additionally, a more effective test is in development. The FAA's applicable Notices of Proposed Rulemaking (NPRMs) indicate that there are other insulation blanket cover materials that exhibit flame propagation properties similar to those of metallized Mylar.⁽¹¹⁾ Therefore, even with the FAA's metallized Mylar replacement initiatives, many inaccessible areas containing combustible materials will remain in aircraft remote from smoke/fire detection systems. Additionally, such materials, located in inaccessible areas, are prone to surface contamination which may provide fuel for flame propagation.

There are many spaces, including some large areas, within transport category aircraft that are seldom inspected and that can become contaminated with dust, debris and metal shavings. Inspections conducted under the auspices of the FAA's Aging Transport Non-Structural Systems Plan identified surface contamination on wiring bundles as a hazard.⁽¹²⁾ The SR 111 investigation team has observed, in a variety of aircraft, similar contamination on insulation blanket material and on wire bundles. While the extent of the overall contamination problem has yet to be determined, over time debris such as metal shavings may damage wire insulation, which could lead to short-circuiting and, potentially arcing of wires. Additionally, dust and combustible debris would provide fuel and would contribute to fire propagation. Well-designed and well-executed maintenance programs may limit such contamination, but it is unlikely that contamination can be completely eliminated.

In recent years, there have been changes in requirements regarding detection and suppression in areas not previously designated as fire zones. For instance, the inclusion of lavatories as fire zones was largely a result of the lessons learned from the DC-9 accident near Cincinnati. The SR 111 accident, and other occurrences, clearly demonstrate that early detection and suppression are critical in controlling an in-flight fire. The present situation is inadequate, and more needs to be done to improve detection and suppression capabilities in some of the pressurized areas of aircraft. There are significant areas within the pressurized portion of the aircraft, not now deemed to be fire zones, that are virtually inaccessible and in which ignition sources and combustible materials may both be present.

The Board believes that the risk to the travelling public can be reduced by re-examining fire zone designations in order to determine which additional areas of the aircraft ought to be provided with enhanced smoke/fire detection and suppression systems. Therefore, the Board recommends:

• Appropriate regulatory authorities, together with the aviation community, review the methodology for establishing designated fire zones within the pressurized portion of the aircraft, with a view to providing improved detection and suppression capability. (A00-17)

Interim Aviation Safety Recommendations
In-flight Firefighting - Swissair Flight III

The Risk of Remaining Airborne--Emergency Landing

Both the TSB review and an FAA study indicate that odour/smoke occurrences rarely develop into uncontrolled in-flight fires.⁽¹³⁾ Within the aviation industry, there has been much debate concerning appropriate decision making when flight crews are faced with odour/smoke situations. Within the industry, many believe that one of these situations will likely turn out to be a "non-event". This expectation has led to a diminished concern about "minor" odours. Within the aviation industry, there is an experience-based expectation that the source of such odours will be discovered quickly and that troubleshooting procedures will "fix the problem." The same TSB review shows that in situations where there is an unsuppressed in-flight fire, there is a limited amount of time to get the aircraft safely on the ground. Therefore, in situations where odour/smoke from an unknown source occurs, the decision to initiate a diversion and a potential emergency landing must be made quickly.

There are a number of factors that could distract flight crews from initiating an immediate diversion and potential landing. These include: company culture; commercial considerations; general inconvenience; passenger comfort and safety concerns associated with initiating emergency descents; the complications inherent in a diversion to an unfamiliar airport; and aircraft operating limitations.

The SR 111 accident raised awareness of the consequences of an odour/smoke event, and the rate for flight diversions increased as a result. Typically, this post-accident awareness will subside. Recently, some airlines have modified their checklists and procedures to ensure that flight crews have policies, procedures, and training to divert and land immediately if visible smoke from an unknown source appears and cannot be readily eliminated. Along with other initiatives, Swissair amended their MD-11 checklist for "Smoke/Fumes of Unknown Origin" to indicate "Land at the nearest emergency aerodrome" as the first action item.

The Boeing Company issued a Flight Operations Bulletin (No. MD-11-99-04), which states: "Boeing advises that any time smoke has been detected and the source cannot be POSITIVELY identified and eliminated, the aircraft should be landed as soon as possible."

While such initiatives reduce the risk of an accident, the Board believes that more needs to be done, industry-wide. Along with initiating the other elements of a comprehensive firefighting plan, it is essential that flight crews give attention without delay to preparing the aircraft for a possible landing at the nearest suitable airport. Therefore, the Board recommends:

Appropriate regulatory authorities take action to ensure that industry standards reflect a philosophy that when odour/smoke from an unknown source appears in an aircraft, the most appropriate course of action is to prepare to land the aircraft expeditiously. (A00-18)

Time Required to Troubleshoot in Odour/Smoke Situations

When the source of odour/smoke is not readily apparent, flight crews are trained to follow troubleshooting procedures, in checklists, to eliminate the origin of the odour/smoke. Some of these procedures involve removing electrical power or isolating an environmental system. A variable amount of time is required to assess the impact of each action. It can take a long time to complete the checklist, including troubleshooting actions. For example, the MD-11 Smoke/Fumes of Unknown Origin Checklist can take up to 30 minutes to complete.⁽¹⁴⁾ There is no regulatory direction or industry standard specifying how much time it should take to complete these checklists. The longer it takes to complete prescribed checklists, the greater the chance that a fire will become uncontrollable.

Troubleshooting procedures are most effective if the actions taken by the flight crew eliminate the source of the odour/smoke before it ignites a fire. These procedures can also eliminate an incipient fire if the crew detects the source early enough. However, once a fire reaches a stage where it is able to propagate without continuous re-ignition from the source, further troubleshooting to eliminate the source will not be sufficient to eliminate the fire.

Aircraft accident data indicate that a self-propagating fire can develop in a short period of time. Therefore, odour/smoke checklists must be designed such that the appropriate troubleshooting procedures are completed quickly and effectively. The Board is concerned that this is not the case and recommends:

• Appropriate regulatory authorities ensure that emergency checklist procedures for the condition of odour/smoke of unknown origin be designed so as to be completed in a timeframe that will minimize the possibility of an in-flight fire being ignited or sustained. (A00-19)

Efficiency of Fire Suppression in the Pressurized Portion of the Aircraft

Fire suppression for the pressurized portion of an aircraft is provided by hand-held fire extinguishers. The quantity and location of these fire extinguishers depends on the passenger capacity of the aircraft.⁽¹⁵⁾ Hand-held fire extinguishers are mandatory in such spaces as the cockpit and galleys. The effectiveness of hand-held firefighting equipment depends on the size, type and location of the fire, on how accessible the fire is, and on crew training. By design, hand-held fire extinguishers are most effective against small fires, at limited range (up to three metres). Hand-held fire extinguishers have been used most successfully where the fire was small and accessible. In a large commercial aircraft such as the MD-11, there are areas to which the aircraft crew have only limited access and areas that are inaccessible. For example, it would be difficult for an aircraft crew to suppress some fires, using hand-held fire extinguishers, in the attic areas or E&E compartments of a large commercial aircraft.

Where access is relatively easy, such as exposed galley areas, existing procedures and training using hand-held fire extinguishers have proven to be adequate. However, where the source of the smoke/fire is not obvious, or access to the area is difficult, the situation can become hazardous very quickly. Areas that are not readily accessible have not been considered when planning for in-flight firefighting. Therefore, there has been little or no training provided for aircraft crews on how to access areas behind electrical or other panels, attic areas, or E&E compartments. Typically, present designs do not incorporate quick-access openings or other such means to facilitate access to these areas.

The TSB review of SR 111 and other in-flight fire occurrences has shown that where an in-flight fire continues to develop, there is little time between detection of the fire and the loss of aircraft control. It must be anticipated that aircraft systems will be affected, either as a direct result of the fire, or as a result of emergency procedures such as the de-powering of electrical busses. It is imperative that firefighting procedures be well defined and that aircraft crews be well trained in handling all in-flight fires.

Although aircraft crews are trained to fight in-flight fires, there are no requirements that cabin and flight crews train together, or that they be trained to follow an integrated firefighting plan and checklist procedure.⁽¹⁶⁾ For example, neither flight crews nor cabin crews are trained to fight in-flight fires in the cockpit. Several operators contacted by the TSB indicate that flight crews and cabin crews do not receive training specific to fighting fire in the cockpit. The division of roles and responsibilities between the flight and cabin crews with respect to who will be combatting an in-flight fire in the cockpit is not clearly identified in manuals and company procedures.

An uncontrollable in-flight fire constitutes a serious and complicated emergency. A fire may originate from a variety of sources, and can propagate very rapidly. Time is critical. Aircraft crews must be knowledgeable about the aircraft and its systems, and be trained to combat any fire quickly and effectively in all areas, including those which may not be readily accessible. The Board believes that the lack of comprehensive in-flight firefighting procedures, and coordinated aircraft crew training to use those procedures, constitutes a safety deficiency. Therefore, the Board recommends:

• Appropriate regulatory authorities review current in-flight firefighting standards including procedures, training, equipment, and accessibility to spaces such as attic areas to ensure that aircraft crews are prepared to respond immediately, effectively and in a coordinated manner to any in-flight fire. (A00-20)

Transport Canada's Response:

Transport Canada supports the goals of these recommendations and has begun working towards addressing them with its international partners. The recommendations are very broad-reaching and their goal will be reached only through international coordination and cooperation among regulatory authorities, aircraft manufacturers and air operators.

On December 19, 2000, a letter was sent to the United States Federal Aviation Administration (FAA) and the European Joint Aviation Authorities (JAA). The letter supported the intent of the recommendations, acknowledged that none of the issues can be addressed in isolation, and invited the major civil aviation regulatory authorities to harmonize a strategy for their resolution.

In this letter, Transport Canada also proposed to hold a meeting in March 2001 suggested tothat it would be beneficial to meet and discuss the recommendations, in the light of existing priorities, to identify existing initiatives and groups that may already address some aspects covered by the recommendations, and to establish a team to develop an appropriate action strategy. The FAA responded positively on January 19, 2001 and a positive response is anticipated from the JAA.

Transport Canada will keep the TSB apprised of the outcome of the meeting and of its progress towards achieving the goals of these recommendations.

FOOTNOTES

1. For the purposes of this discussion, the pressurized portion of the aircraft, or pressure vessel, includes cockpit, cabin, avionic compartments, cargo compartments, etc.

2. For the purposes of this discussion, the term in-flight firefighting includes all procedures and equipment intended to prevent, detect, control, or eliminate fires in aircraft. These include, but are not limited to material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures, and training.

3. Specific improvements were made to fire detection and suppression in lavatory and cargo areas following the Air Canada accident near Cincinnati, Ohio, and the ValuJet accident in Florida.

4. Each Civil Aviation Authority establishes its own requirements pertaining to in-flight firefighting. Since the MD-11 was certified in the United States, the Federal Aviation Regulations (FARs) are referenced in this document.

5. See FARs 25.854, 25.855, 25.858, 25.1181, 25.1195, 25.1197, 25.1199, 25.1201, 25.1203, 121.308.

6. See FAR 25.851(a).

7. For the purposes of this discussion, the attic is defined as that area between the crown of the aircraft and the drop-down ceiling.

8. See National Transportation Safety Board report DCA83AA028 concerning the 02 June 1983 accident involving an Air Canada DC-9 near Cincinnati, Ohio.

9. Development and Growth of Inaccessible Aircraft Fires Under Inflight Airflow Conditions (DOT/FAA/CT-91/2, dated February 1991).

10. See FARs 25.853, 25.855, and Part I of Appendix F of Part 25.

11. See NPRMs A99-NM-161-AD and A99-NM-162-AD.

12. FAA Aging Transport Non-Structural Systems Plan, dated July 1998.

13. Smoke in the Cockpit Among Airline Aircraft, FAA Report, 12 October 1998.

14. Boeing Flight Operations Bulletin MD-11-99-04.

15. See FAR 25.851(a).

16. See Canadian Aviation Regulations (CAR) Standards section 725.124; Federal Aviation Regulations section 135.331; Joint Aviation Requirements (JAR) 1.965; and International Civil Aviation Organization (ICAO) Annex No. 6, article 9.3.1.

Should you require further information, please contact Aviation Safety Analysis at asi-rsa@tc.gc.ca