Aviation Investigation Report A98A0067

The aircraft, a Pilatus PC-12, serial number 151, was on a scheduled domestic flight from St. John's, Newfoundland, to Goose Bay, Labrador, with the pilot, a company observer, and eight passengers on board. Twenty-three minutes into the flight, the aircraft turned back towards St. John's because of a low oil pressure indication. Eight minutes later, the engine(Pratt & Whitney PT6A-67B) had to be shut down because of a severe vibration. The pilot then turned towards Clarenville Airport, but was unable to reach the airfield. The aircraft was destroyed during the forced landing in a bog one and a half miles from the Clarenville Airport. The pilot, the company observer, and one passenger sustained serious injuries.

The Board determined that the pilot did not follow the prescribed emergency procedure for low oil pressure, and the engine failed before he could land safely. The pilot's decision making was influenced by his belief that the low oil pressure indications were not valid. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined.

1.1 History of the flight

The aircraft, operating as Kelner Airways Flight 151, departed St. John's, Newfoundland, for Goose Bay, Labrador, on an instrument flight rules (IFR)^{Footnote 1} flight at 1655 Newfoundland daylight saving time (NDT)^{Footnote 2} with the pilot, an observer, and eight passengers on board.

As the aircraft approached the planned cruise altitude of 22 000 feet (FL220), the pilot noted an unusually low indication on the engine oil pressure gauge and, just prior to levelling off at FL220, the low oil pressure caution annunciator light activated. Upon levelling off at FL220, approximately 39 nautical miles (nm) from St. John's Airport, the low oil pressure warning annunciator light activated. The pilot advised company maintenance personnel of the low oil pressure indications by message through the company dispatch facility in St. John's. Maintenance advised the pilot, via company dispatch, that he should return to St. John's. The relaying of messages between the pilot and maintenance took about six minutes, and the aircraft was, by then, 71 nm from the St. John's Airport and 40 nm from the Gander Airport. The pilot then requested and received a clearance back to St. John's Airport from Gander Area Control Centre (ACC).

Four minutes after starting the turn back towards St. John's, an engine vibration developed. The aircraft was 44 nm from the Gander Airport and descending through FL200. The pilot declared an emergency with Gander ACC and was cleared direct to the St. John's Airport. The pilot was initially able to decrease the vibration by reducing the power setting; however, about four minutes later, the vibration became so severe that the pilot had to shut down the engine. The aircraft was approximately 49 nm from the St. John's Airport at an approximate altitude of 13 000 feet when the engine was shut down. The pilot reported to Gander ACC that there was a complete engine failure and asked for vectors to the nearest suitable airport. The nearest suitable airport, St. John's, was beyond the glide range of the aircraft at its present altitude. When the pilot advised Gander ACC of this, the controller provided him with vectors to the Clarenville Airport, the only other airport in the area, which was 20 nm back. Clarenville Airport is located approximately 47 nm southeast of Gander.

During the descent toward Clarenville, the pilot requested a report on the local weather in the Clarenville area. Since there is no active weather reporting station in the vicinity of the Clarenville Airport, the Gander ACC requested an estimate of the local weather conditions from the Clarenville detachment of the Royal Canadian Mounted Police (RCMP). The information relayed to the pilot was that the cloud layer was estimated to be above the surrounding hills and the visibility was estimated to be approximately five miles.

Approximately 15 minutes after the engine was shut down, the aircraft broke out of cloud over a wooded area at an estimated altitude of 400 to 500 feet above ground level (agl). The front windscreen was obscured with engine oil on the outside and condensation on the inside; consequently, the pilot side-slipped the aircraft to see out the side window. The airport was not visible, and the pilot elected to force-land in a bog.

The aircraft was force-landed at approximately 1741, with the landing gear and flaps retracted, 1.5 nm southeast of the Clarenville Airport.

1.2 Injuries to persons

	Crew	Passengers	Others	Total
Fatal	-	-	-	-
Serious	1	1	1	3
Minor/None	-	7	-	7
Total	1	8	1	10

1.3 Damage to aircraft

The aircraft was destroyed.

1.4 Other damage

Ground damage was restricted to the impact area of the bog.

1.5 Personnel information

The pilot held an airline transport pilot licence and a valid pilot proficiency check on the PC-12 aircraft. He had a valid medical certificate, signed by a Canadian aviation medical examiner on 28 April 1998. He had also completed all general and specific classroom training required by the Canadian Aviation Regulations (CARs) and the company operations manual to qualify him to act as pilot-in-command on the PC-12 aircraft.

1.6 Aircraft information

1.6.1 General

A review of the aircraft documentation indicates that the aircraft was maintained in accordance with existing regulations and approved procedures. However, in order for an aircraft to be approved for single-engine instrument flight rules (SEIFR) flight, a chip detector system to warn the pilot of excessive ferrous material in the engine lubricating system is required. The design feature of the chip detector installed on this aircraft was such that indications to the cockpit were disabled whenever the landing gear was retracted; therefore, this installation did not meet the requirements of the standard governing the transport of passengers in single-engined aircraft, Commercial Air Service Standard (CASS) 723.22.

The aircraft journey log indicated that the aircraft was dispatched on the accident flight with the following deferred defects:

1. Emergency locator transmitter (ELT) removed.--The ELT was removed prior to this flight for maintenance. CAR 605.39 allows for flight without an ELT for up to 90 days;
2. De-ice system inoperative, aircraft restricted.--The outboard de-icing boot on the left wing had been replaced prior to the flight and, because the cure time on the sealant was 48 hours, the system was unserviceable.
3. Low oil quantity light inoperative.--During an unrelated maintenance action prior to the accident flight, the low oil quantity light was observed to be illuminated. The tank level was checked and found to be full. During subsequent troubleshooting of the system, the light extinguished, and maintenance was unable to determine why it had illuminated. The filler cap and indicator assembly were suspected of having an intermittent fault. As an interim measure while awaiting replacement parts, the aircraft was placarded, and a letter was sent to all flight crew advising them that the system was unserviceable and to visually check the oil level before each flight. The pilot had read the letter, and he checked the oil before departing on the accident flight.

1.6.2 Engine magnetic particle (chip) detector

The chip detector system on board the PC-12 is installed at the six o'clock position in the reduction gearbox (RGB). Only the oil lubricating the RGB and a portion of the lubricating oil from the number three and four engine bearings pass over the chip detector before returning to the scavenge oil pump. None of the lubricating oil from the number one and two engine bearings and none of the oil from the accessory gearbox (AGB) pass over a chip detector before returning to the scavenge oil pump. Oil from these areas goes first through the scavenge oil pump, then through the pressure pump and oil filter, before returning to lubricate the engine components. As a result, metal generated in these areas would be filtered out prior to encountering the chip detector in the RGB.

1.6.3 Electrical system

The SEIFR requirement for electrical power is for two independent power generating sources, either of which is capable of sustaining essential flight instruments and electrical equipment.^{Footnote 3} The PC-12 meets this requirement with a 28-volt direct current system comprised of a main generator, a secondary generator, and a 24-volt battery. The battery provides power for starting the engine and, in the case of engine failure or failure of both generators, it will power essential electrical systems for 20 minutes if the load is reduced below 60 amps or for 30 minutes if the load is reduced below 50 amps.

1.6.4 Windshield heat

The sole means of defogging and anti-icing the two-piece windshield are twin-zone dual electric heating elements. Windshield heat is controlled by two switches (left-hand and right-hand) and two heat levels ("light" and "heavy"), which are to be used as required for defogging and anti-icing. In the event of an engine failure, windshield heat is only available to the pilot's windshield. Data provided by the manufacturer indicate that, in the case of an engine failure, if the pilot's windshield heat is continuously selected on "light" mode, the duration of battery power would be about 24 minutes; if it is continuously selected to the "heavy" mode, the duration of battery power would be about 22.5 minutes. The pilot turned off the windshield heat after the engine failed in order to conserve battery power.

PC-12 pilots have reported that the windshields in this aircraft will frequently fog over when the windshield heat is not selected. The pilot did not re-select windshield heat prior to nearing the Clarenville Airport, and, when the aircraft broke out of the cloud, the windshield was obscured. In this occurrence, however, because of the combination of fog and oil that was obstructing the pilot's vision, re-selecting windshield heat would likely not have had a positive effect.

1.6.5 Oxygen system

The airplane is equipped with an emergency oxygen system for use by the crew and passengers in the event of a loss of pressurization. A fully charged oxygen storage cylinder will supply two crew and nine passengers for ten minutes.

1.6.6 Weight and balance

The weight and centre of gravity were within the prescribed limits.

1.7 Meteorological information

The pilot had received the 1800 UTC hourly weather report for both Gander and St. John's prior to departure. This weather information also included the terminal forecast, winds aloft, significant meteorology reports (SIGMET), and area forecast for Newfoundland and Labrador. After turning back to St. John's, the pilot received the latest St. John's weather.

Area forecast:

At 1800 UTC, a quasi-stationary low pressure system was 90 nm east of St. John's. There was also a north-south upper trough to the west of St. John's, moving westward.

The forecast for the St. John's area indicated a cloud layer at 2 000 to 3 000 feet broken, occasional overcast, with the top of this layer at 8 000 feet. A layer of high, scattered cloud was also forecast with the visibility at greater than 6 statute miles (sm). There would be isolated altocumulus castellanus cloud with the tops at 16 000 feet, giving 2 to 5 sm visibility in light rain showers and mist. Precipitation would become light rain and snow showers after 2400 UTC.

The forecast for the Gander area indicated a cloud layer at 1 000 to 2 000 feet overcast with layers up to 18 000 feet. A layer of high, broken cloud was also forecast with the visibility at 3 sm to greater than 6 sm in light rain and mist. There would be scattered embedded altocumulus castellanus and towering cumulus cloud with the tops at 20 000 feet, giving 1 to 3 sm visibility in rain showers and mist. Precipitation would become occasional light rain and snow after 2400 UTC.

The icing forecast for the area indicated moderate mixed icing in altocumulus castellanus / towering cumulus; otherwise light to moderate rime icing above the freezing level. The freezing level was to be at or near the surface.

The hourly weather report for St. John's Airport at 1800 UTC was:

Surface winds 340 degrees true at 15 knots, visibility 15 sm, cloud layers 700 feet broken / 1 000 feet overcast, temperature 3 degrees Celsius, dewpoint 2 degrees, altimeter 29.46. Remarks: cloud type and coverage was stratus fractus six-eighths and stratocumulus two-eighths.

The hourly weather report in effect at St. John's Airport at the time of the occurrence was the 1900 UTC observation, as follows:

Surface winds 340 degrees true at 14 knots, visibility 15 sm, cloud layer 600 feet overcast, temperature 3 degrees Celsius, dewpoint 2 degrees, altimeter 29.48. Remarks: cloud type and coverage was stratus fractus eight-eighths.

The terminal forecast for St. John's Airport from 1700 to 2000 UTC was:

Surface winds 360 degrees true at 20 knots, visibility 3 sm in light drizzle and mist, cloud layers 600 feet overcast, temporarily more than 6 sm visibility, no significant weather, cloud layer 800 feet overcast.

The hourly weather report for Gander Airport at 1800 UTC was:

Surface winds 340 degrees true at 19 knots, visibility 3 sm in light rain and mist, cloud layers 200 feet broken / 600 feet overcast, temperature 2 degrees Celsius, dewpoint 1 degree, altimeter 29.63, recent moderate rain. Remarks: cloud type and coverage was stratus fractus seven-eighths and stratocumulus one-eighth.

A special weather report issued at 1941 UTC was in effect at Gander Airport at the time of the occurrence, as follows:

Surface winds 350 degrees true at 15 knots, visibility 2 ½ sm in light rain and mist, cloud layer 300 feet overcast, temperature 2 degrees, dewpoint 2 degrees, altimeter 29.63. Remarks: cloud type and coverage was fog two-eighths and stratus fractus six-eighths.

The terminal forecast for Gander Airport from 1600 to 2200 UTC was:

Surface winds 360 degrees true at 20 knots, visibility 3 sm in light rain and mist, cloud layers 300 feet broken / 600 feet overcast.

There was no SIGMET or pilot report (PIREP) in effect for the area at the time of the occurrence.

1.8 Aids to navigation

The pilot was assisted in his navigation by radar vectors and the use of the onboard global positioning system (GPS). There are no ground-based aids to navigation at the Clarenville Airport.

1.9 Communications

Communications were maintained between the aircraft and Gander ACC until just prior to impact with the ground.

1.10 Aerodrome information

Clarenville Airport is certified and operated by the Government of Newfoundland and Labrador. The single runway (08/26) is 3 933 feet long. The airport is suitable for PC-12 aircraft visual flight rules (VFR) operations.

1.11 Flight recorders

The aircraft was not equipped with a flight data recorder or a cockpit voice recorder, nor was either required by regulation.

1.12 Wreckage and impact information

1.12.1 Site examination

The first impact was with the tops of four small spruce trees at the edge of the bog. The angle at which the tops of the trees were broken is consistent with the aircraft being in a 15-degree, left-bank attitude when it struck the trees. The first ground impact was when the left wing tip contacted the bog approximately 63 feet beyond the broken trees and dug a 58-foot-long gouge in the bog on a heading of 270 degrees. The outboard six feet of the left wing was located at the end of the long gouge. The next point of contact with the ground was a large oval-shaped crater 20 feet beyond the end of the gouge. The shape of this crater is consistent with the aircraft fuselage striking the ground at this point. The engine and engine mount separated from the aircraft in the area of the large crater. After the initial fuselage ground contact, the aircraft skipped forward approximately 75 feet while rotating counterclockwise through approximately 180 degrees, before touching the ground again with the trailing edges of first the right wing, then the left wing. This is consistent with impact marks on the trailing edge of the right wing and is probably the initiation point for the remainder of the left wing separating from the aircraft. The aircraft then skipped another 75 feet, still rotating counterclockwise, before coming to rest on a heading of 225 degrees, with the engine underneath the right wing. The left wing, which separated from the aircraft at the root, was wedged in the ground, underneath the tail of the aircraft. Heavy oil streaks were observed along both sides of the fuselage, as well as lighter traces of oil on top of the fuselage. There was oil on the windscreens during flight, which affected the pilot's ability to see outside, but the windscreens broke out of the aircraft during impact, and it was not possible to determine how much oil had been on them.

1.12.2 Engine history

The engine, Pratt & Whitney (P&W) PT6A-67B, serial number PR0003, was installed as original equipment on the aircraft. On 19 September 1997, at 1 825 total engine hours, the engine was removed from service and sent to P&W for examination and repair due to regular findings of carbon in the oil filter and discolouration of the oil. After repair, the engine was reinstalled in the aircraft on 09 March 1998. On 04 May 1998, at 2 387 total hours, the compressor was borescoped in response to an unconfirmed change in the gas producer run-down time; no defects were found. The starter-generator garlock seal and oil pressurizing valve were replaced at this time due to oil consumption reported at two quarts in 12 hours of engine operation. On 05 May 1998, at 2 400 total hours, the fuel control unit and high-pressure fuel pump were replaced due to slow starting. On 09 May 1998, the starter-generator garlock seal was again replaced due to continued high oil consumption; there were no further reports of high oil consumption. Analysis of oil samples taken on 12 May 1998 did not indicate engine deterioration.

A review of the journey log sheets back to when the occurrence engine was re-installed in the aircraft showed a consistent variance for recorded oil pressure entries from one pilot to the next. The range was from 110 to 125; however, the recording for each individual pilot was always consistent. The pattern in which these oil pressure variations appear suggests that they were due to the manner in which the oil pressure was being read and recorded by each pilot, rather than being actual variations in oil pressure.

1.12.3 Engine teardown and examination

The engine was shipped to the P&W facility in Longueuil, Quebec, where a teardown examination was conducted under the supervision of a TSB investigator. It was determined that the engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly in the RGB. There was no service history of a similar failure and, despite extensive examination and testing on the engine and related systems and components, no cause for the interruption in oil flow to the first-stage planet gear assembly could be found. Other noteworthy findings of the teardown examination were that no other areas in the engine had signs of oil supply starvation, including the second-stage planet bearings, and that the power turbine had separated from the reduction gear drive (as a result of the oil flow interruption), shedding its blades from the resultant overspeed condition. (The blades were contained within the engine casing.)

1.13 Medical information

There were no indications of pre-existing medical conditions that would have adversely affected the pilot's performance.

1.14 Fire

There were no signs of pre- or post-impact fire.

1.15 Survival aspects

The passenger cabin remained intact, and the main cabin door, the cargo door, and the over-wing exit were all operable. The forward passenger seat on the right-hand side became detached from the seat rails during the accident sequence. Neither the seat rails nor the seat-to-rail attachment points exhibited any signs of damage, and the locking mechanism functioned as designed; this suggests that the seat may not have been locked in place.

The pilot and company observer were trapped in their seats by the rearward displacement of the instrument panel and the upward displacement of the cockpit floor during impact. One of the passengers took charge of getting the other passengers out and away from the aircraft and of providing first aid care to the pilot and the observer. He then collected some fuel that was spilling from a ruptured fuel line and started a fire to keep the passengers warm.

Upon being notified of the impending crash, the RCMP activated the local ground search-and-rescue team and chartered a helicopter from a local operator. An air search was conducted in the general area of the accident before a signal flare was seen. The accident site was located at 1845, approximately one hour after the accident had occurred. A search-and-rescue Labrador helicopter arrived at the scene at 1900, and all the occupants were evacuated from the scene by 2045.

This was the aircraft's first flight since the ELT had been removed for maintenance. The general location of the aircraft was known, the crash site was in a large open bog, one of the passengers was able to fire a flare, and the ceiling and visibility allowed a visual air search. Therefore, the absence of an ELT did not have a detrimental effect on locating the aircraft. However, the remoteness of the flight's planned route supports the importance of an ELT.

1.16 Tests and research

No tests or research were conducted.

1.17 Organizational and management information

At the time of the occurrence, the company operated two aircraft, a Beech 1900 and the Pilatus PC-12. The Beech 1900 was used primarily for cargo operations and occasionally for passenger-carrying charter flights. The primary use of the PC-12 was cargo operations; it was also used for scheduled passenger flights which consisted of a once-daily Goose Bay-St. John's-Goose Bay flight, six days a week. The PC-12 aircraft was changed from passenger configuration to cargo configuration and vice versa during the station stops in Goose Bay, which were approximately 30 minutes in duration. The company observer usually installed the seats.

1.18 Additional information

1.18.1 SEIFR flight

Prior to adopting a policy on the carrying of passengers on SEIFR flights, Transport Canada (TC) conducted a study on SEIFR and published a position paper in December 1993. The paper concluded that the proven reliability of modern turbine engines installed in modern, factory-built, turbine-powered airframes with modern avionics made SEIFR feasible and that the risks inherent in such a policy were manageable. The results of the study were submitted to TC's System Safety Directorate for an independent operational safety review. The Directorate, after studying all aspects of the policy and discussing it with other technical experts, concluded that the risks were indeed manageable. Finally, the proposed policy was subjected to consultation with interested segments of the Canadian aviation industry and, after no dissenting opinions were received, CAR 703.22 and CASS 723.22, the regulation and standard governing the transport of passengers in single-engined aircraft, came into effect.

Included in the proposed SEIFR policy was a condition in the required equipment list (REL) for a maintenance system capable of automatically monitoring and recording those parameters critical to engine performance and condition. However, this condition did not form part of the REL outlined in CASS 723.22. The proposed SEIFR regulations for Australia and the Joint Aviation Requirements for Europe do list an automatic trend monitoring system as a condition in the proposed REL. Although the United States Federal Aviation Regulations (FARs) governing SEIFR operations do not call for an automatic trend monitoring system, they do require that the operator's maintenance inspection program include either the manufacturer's recommended trend monitoring program or a Federal Aviation Administration (FAA)-approved trend monitoring program. Canadian regulations do not require a SEIFR operator to incorporate engine trend monitoring in his or her maintenance program. Standard Operating Procedures (SOPs) are a regulatory requirement for commercial operations where the aircraft must be operated by two or more pilots; however, SOPs are not required for commercial single-pilot operations. The operator in this occurrence did not have SOPs pertaining to the operation of the Pilatus aircraft.

1.18.2 Training requirements for SEIFR

To act as pilot-in-command on aircraft approved for SEIFR flight, pilots are required to have training in an approved synthetic training device (simulator). There is now an approved PC-12 simulator available for training; however, when the PC-12 was first certified for SEIFR flight, there was not. Consequently, TC issued a waiver allowing SEIFR operations in this aircraft, provided the pilots had training on the Cessna 208 simulator. The pilot had completed the required simulator training in the Cessna 208 simulator.

1.18.3 Pilot decision-making training

There is no regulatory requirement for SEIFR operations pilots to have received pilot decision-making (PDM) training. However, this appears inconsistent in that the standard for reduced VFR limits, CASS 723.28 VFR Flight Minima--Uncontrolled Airspace, requires pilots to have PDM training. The occurrence pilot had not attended a course in PDM.

TC-recognized PDM courses must include the following topics:

1. The Decision Making Process including modules on psychological factors, levels of performance, and "error trap" phenomena (unsafe actions taken as a result of wrongful assumptions, unsafe conditions or practices).
2. Human Error Countermeasures highlighted by relevant case studies of past accidents.

1.18.4 Emergency procedures

Section 3.6, Engine Emergencies, of the pilot operating handbook (POH) describes the procedures to be followed for low oil pressure indications:

• Indications: EIS caution oil blinking 40/min. (After 20 sec, EIS warning oil blinking 80/min). Oil Px 60 to 90 PSI
  1. Ngcheck above 72%
  2. TorqueReduce to below 24 PSI
  3. AircraftLand as soon as practical.
• Indications: EIS caution oil blinks 40/min and/or EIS warning oil blinks 80/min. Oil Px below 60 PSI or above 135 PSI.
  4. AircraftLand as soon as possible using minimum torque.

If possible always retain glide capability to the selected landing area in case of total engine failure.

The POH does not define the terms "Land as soon as practical" and "Land as soon as possible;" however, these terms are generally accepted to mean the following:

Land as soon as practical--Landing airport and duration of flight are at the discretion of the pilot. Extended flight beyond the nearest suitable airport is not recommended.

Land as soon as possible--Land without delay at nearest airport where a safe approach and landing is reasonably assured.

1.18.5 Previous low oil pressure indications

A few months prior to this occurrence, during the time when a loaner engine had been installed in the aircraft, the pilot reported that he had experienced, on a couple of occasions, the oil pressure dropping into the lower part of the green band during climb and then returning to normal after levelling off. The pilot reported that he thought that the same thing was recurring on the accident flight and that the unserviceable low oil quantity annunciating system was also related to the low oil pressure indications he was experiencing.

1.18.6 Aircraft glide performance calculations

Calculations determined that if the pilot, at the time engine vibrations occurred, had immediately turned back to Gander and maintained 22 000 feet, he could have reached the airport. It was also determined that if he had remained at 22 000 feet until the engine was eventually shut down, he could have reached St. John's.

The PC-12 maximum operating altitude is 30 000 feet and, for a single-pilot operation with passengers, 25 000 feet. For the purposes of discussing battery and oxygen system requirements, calculations determined that at the optimum glide speed, the aircraft would descend from 30 000 feet to sea level in 32.5 minutes, and the time from 25 000 feet to 13 000 feet would be 11.5 minutes.

1.18.7 Regulatory requirement for de-icing equipment

CAR 605.30 requires that the pilot-in-command determine that the aircraft is adequately equipped to operate in icing conditions if icing conditions are reported or forecast. Icing conditions were forecast for the route of flight.

2.1 Engine failure

The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined. The chip detector would have increased the probability of giving the pilot advance warning of the impending engine failure and might have influenced his decision making had it been operational in flight.

2.2 Engine chip detector

The chip detector system, as installed, is not able to warn the pilot of ferrous material generated by all the engine components. Installation of a second chip detector, in the location of the AGB drain plug, would allow for the monitoring of all the unfiltered oil, and would also indicate the presence of ferrous particles if tied into the existing chip indicating system. The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles. The engine manufacturer has advised that this chip detecting configuration also exists on the other aircraft types equipped with the PT-6 engine.

2.3 Pilot decision making

The first indication of a problem was a lower-than-normal oil pressure gauge reading, followed quickly by a "low oil pressure" flashing caution light, and then a flashing warning light. These progressive indications were designed to alert the pilot to the worsening situation and trigger the required action called for in the POH, i.e. "Land as soon as possible." The onset of engine vibrations was a further indication to the pilot that there was an actual problem.

The pilot believed that what he was experiencing was an indication problem and, consequently, he did not follow the direction of "Land as soon as possible" called for in the POH. The aircraft was 39 nm from the St. John's Airport when the low oil pressure warning light illuminated and, based on the time the engine remained operational after this, a landing under engine power could probably have been carried out in St. John's. The aircraft was 44 nm from Gander at the onset of engine vibrations and probably could have reached that airport if a decision had been made to divert there at that time. Another indication that, to the pilot, it was only an indication problem was his decision to start descending as soon as he commenced the turn back to St. John's. The POH states that, if possible, always retain glide capability to the selected landing area in case of total engine failure. Calculations based on the aircraft performance figure charts indicate that, had the pilot maintained 22 000 feet up to the time the engine failed, the aircraft would have been able to glide to the St. John's Airport.

There were a number of factors that influenced the pilot's decision to return to St. John's. First, he reportedly had previous experiences of the oil pressure diminishing during the climb and then returning to normal; he was expecting this to happen again. He also thought that the low oil pressure indication was related to an unserviceable low oil quantity annunciating system. Further, the weather in Gander, although not below limits, was not as good as the St. John's weather. St. John's was a maintenance base, and the suspected indicating problem could be quickly rectified and the flight could continue; whereas if he diverted to Gander, the aircraft would be grounded. Lastly, the pilot was advised by maintenance, via dispatch, to return to St. John's.

The pilot encountered and failed to recognize an "error trap" (unsafe actions taken as a result of wrongful assumptions). Error traps are covered in TC-recognized pilot decision-making (PDM) courses. The intent of the PDM course is to reduce risks associated with flight by providing pilots with better decision-making skills. The pilot, who had not had PDM training, did not recognize the error trap, and the subsequent delay in the decision making reduced his options when engine shutdown became inevitable.

Ineffective PDM in small air carrier operations has been a matter of concern to the TSB for some time. In 1995, after a spate of occurrences that were linked to ineffective PDM, the Board recommended that:

The intent of the recommendation was to communicate the requirement for all aircrew involved in commercial aviation to have the tools and skills needed to reduce the likelihood of inappropriate decisions in the day-to-day commercial flying environment. TC responded to the recommendation by requiring formal CRM and PDM training only for pilots employed by the large commercial air operators (CAR 705 operations). These pilots only receive PDM training during their initial training; there is no requirement for formal recurrent PDM training.

SOPs can also help to improve PDM in complex environments. SOPs can be considered to be decisions, made in advance, that tell a pilot how to safely proceed in an expeditious manner. SOPs help to streamline decision making and are a regulatory requirement for commercial operations where the aircraft must be flown by two or more pilots; however, they are not a requirement for commercial single-pilot operations.

The pilot received his simulator training on the Cessna 208, an aircraft type substantially different from the PC-12. The Cessna 208 is not pressurized, whereas the PC-12 is. Overall, the PC-12 is of a more sophisticated concept and design. An engine failure scenario in the Cessna 208 would not have to take into account high altitude considerations such as passenger welfare, strong upper winds, and temperature change. Provided that complex situations such as impending and eventual engine failure at altitude were emphasized, the provision of PC-12 simulator training would have increased the probability of the pilot making effective decisions in the circumstances of the progressive indications of failure.

2.4 Aircraft systems

The aircraft battery can provide electrical power for approximately 30 minutes if the electrical load is reduced to below 50 amps. If windshield heat is selected to the "light" setting only, battery power duration is reduced to about 24 minutes. If the aircraft is set up for optimum glide rate, it would take 32.5 minutes to descend to sea level from an altitude of 30 000 feet. In the scenario described above, if windshield heat were selected to the "light" setting, battery power would have been exhausted 8.5 minutes before the aircraft reached the ground. Use of additional equipment during descent, such as windshield heat, landing lights, or attempts at engine restart, would place further demands on the battery's limited supply. In this occurrence, the aircraft stayed airborne for approximately 15 minutes after the engine failed. Therefore, it is probable that the battery would still have been able to power the essential instruments even if windshield heat remained selected "on."

Notwithstanding, the CARs do not require that SEIFR aircraft have a sufficient emergency electrical supply to power necessary electrical systems throughout the entirety of an engine-out let-down from the aircraft's maximum operating level at an optimal glide speed and configuration. Other rule-making authorities have recognized that standard battery supplies are inadequate for emergency SEIFR purposes. This is reflected in the Australian SEIFR requirement for emergency electrical supply, and a similar requirement is proposed in the European Joint Aviation Requirements--Operations (JAR-OPS) SEIFR draft regulations.

The oxygen system is designed to provide oxygen to the crew and passengers for ten minutes. From 25 000 feet (the maximum altitude for passenger carriage in single-pilot IFR operations) it would take 11.5 minutes to descend to 13 000 feet at the optimum glide rate. The oxygen would be depleted 1.5 minutes prior to reaching 13 000 feet. The CARs do not require that pressurized SEIFR aircraft have sufficient supplemental oxygen to allow for an optimal glide profile during an engine-out let-down from the aircraft's maximum operating level until a cabin altitude of 13 000 feet is attained.

Since the introduction of the Canadian SEIFR authority in 1993, significant advances have been made in aircraft equipment technologies. GPS satellite navigation in commercial navigation is now common, and automatic engine health and usage monitoring systems (HUMS) and advanced onboard oil debris monitoring systems that can detect non-ferrous oil debris particles are more available. The Australian regulatory authority introduced SEIFR rules, after Canada had done so, and incorporated some of these newer systems into its SEIFR rule. The Australians also require that electrical equipment such as landing lights and radar/radio altimeters be capable of being powered by the aeroplane's emergency electrical supply system (battery). The landing lights and radio altimeter on the accident Pilatus were capable of being powered by the battery; however, this was not a requirement of the Canadian rule.

2.5 De-icing equipment

Weather information provided to the pilot showed that icing was forecast along the route of flight. CARs require that the aircraft's de-icing equipment be serviceable prior to departure; however, the aircraft departed with an inoperative wing de-icing system.

Had the pneumatic de-icing boots been serviceable for the flight, they would have been rendered inoperative after engine shutdown; consequently, the pilot would have been unable to clear ice from critical surfaces during an engine-out let-down through icing conditions. Even small amounts of ice on critical surfaces can have an adverse effect on aircraft handling characteristics, gliding performance, and stall speed. The pilot would need to be aware of this and allow for the adverse effects during the let-down and landing phase.

1. The pilot's records indicated that he was certified, trained, and qualified for the flight in accordance with existing regulations.
2. The maintenance records indicate that the aircraft was maintained in accordance with existing regulations.
3. The weight and centre of gravity were within the prescribed limits.
4. The aircraft did not meet the approval requirements for SEIFR flight because the engine chip detector was not operational during flight.
5. The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles.
6. The pilot stated that he had experienced unusual engine oil pressure indications on the occurrence aircraft in the past.
7. The pilot was aware that the low oil quantity annunciating system was unserviceable prior to the occurrence flight.
8. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined. There is no history of a similar type failure.
9. The indications of low oil pressure were genuine, but were not considered valid by the pilot; this was an error trap (unsafe actions taken as a result of wrongful assumptions, unsafe conditions or practices) that the pilot did not recognize. Thus, he did not follow the "Land as soon as possible" instruction called for in the Emergencies section of the POH.
10. The terms "Land as soon as possible" and "Land as soon as practical" are not defined in the POH.
11. Contrary to the recommended procedure of retaining glide capability, the pilot commenced a descent as soon as the aircraft turned back towards St. John's.
12. The aircraft departed into a region where icing had been forecast with a wing de-icing system that was inoperative.
13. There are no means to clear ice from critical wing surfaces on the PC-12 once the engine has been shut down; pilots would need to compensate for the adverse effects of ice during the let-down and landing.
14. The ELT had been removed prior to the flight for maintenance; CAR 605.39 allows for flight without an ELT for up to 90 days.
15. The CARs do not require pilots involved in SEIFR to have received pilot decision-making training.
16. The CARs that govern SEIFR do not list as part of the REL a system capable of monitoring and recording those parameters critical to engine performance and condition.
17. The CARs do not require that pressurized SEIFR aircraft have sufficient supplemental oxygen to allow for an optimal glide profile during an engine-out let-down from the aircraft's maximum operating level until a cabin altitude of 13 000 feet is attained.
18. The CARs do not require that SEIFR aircraft have a sufficient emergency electrical supply to power necessary electrical systems throughout the entirety of an engine-out let-down from the aircraft's maximum operating level at an optimal glide speed and configuration.
19. The equipment standard for SEIFR in the CARs is not as stringent as that of other regulatory aviation authorities, such as the Australian regulatory authority.

3.1 Causes and contributing factors

The pilot did not follow the prescribed emergency procedure for low oil pressure, and the engine failed before he could land safely. The pilot's decision making was influenced by his belief that the low oil pressure indications were not valid. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined.

4.1 Action taken

4.1.1 Chip detector operability

As the chip detector was rendered inoperable when the landing gear was retracted, the aircraft did not meet the approval requirements for SEIFR flight, which requires a chip detector system to warn the pilot of excessive ferrous material in the engine lubricating system. When apprised of the situation, TC, on 15 July 1998, sent a letter to all TC regional managers for redistribution to all operators of Canadian-registered PC-12 aircraft advising them that they had 90 days to modify their aircraft to make the chip detector functional in all regimes of flight.

4.1.2 ELT availability

There is a proposed CAR amendment which will allow CAR 703 air taxi operations for up to thirty days without an ELT on board. For private owners, or operators who have a low aircraft utilization rate and low overall risk, 30 days may be an appropriate period of time to allow flight without an ELT; however, for commercial operators with a high utilization rate, or for those who are performing operations that involve greater risk, 30 days may represent an unacceptable period of operation for flight without an ELT. Therefore, the TSB forwarded a Safety Advisory letter to TC which suggested that TC consider a further reduction or elimination of the 30-day allowance for commercial operators.

There is also a Notice of Proposed Amendment to reduce the allowable time period for flight without an operable ELT for aircraft operated under CAR 705 and CAR 704.

4.1.3 Emergency procedures terminologies

Some aircraft manufacturers define the terms "possible" and "practical", and employ only these defined terms. Similarly, TC, in its Extended Range Twin-Engine Operations (ETOPS) Manual, defines "suitable" and "adequate" airports. This reduces subjectivity and allows all involved (manufacturers, pilots, dispatchers, and maintenance personnel) to accurately and similarly gauge the degree of urgency related to an airborne emergency. Consistent interpretation of terminology related to emergency procedures is necessary to ensure an appropriate response. Consequently, the TSB, on 18 June 1998, forwarded a Safety Advisory letter to TC to suggest that TC consider a means to standardize these terms throughout the aviation industry.

TC responded to the Safety Advisory letter by issuing, on 21 October 1999, Commercial and Business Aviation Advisory Circular (CBAAC 0163), which deals with "standardisation of terminology related to aircraft emergency procedures." TC has also asked Pilatus Aircraft to review the PC-12 POH with regard to this subject and has recommended that the POH include comprehensive definitions of the terms that are used.

4.2 Action required

4.2.1 Oxygen system requirements

The requirement for pressurized aircraft to carry a supplemental oxygen supply is set out in CAR 605.31. The CAR requires a ten-minute minimum supply of oxygen for passengers and crew, or an amount sufficient to allow an emergency descent to below 13 000 feet, whichever is greater. The standard oxygen system on board the Pilatus PC-12 meets the requirements set out in these CARs (ten minutes). The SEIFR rule does not stipulate any additional oxygen equipment requirements.

According to the POH, the standard PC-12 oxygen system is "for use by crew and passengers in the event of contaminated air being introduced into the cabin or a loss of pressurization with a rapid descent to lower altitudes." The system "will supply two crew and nine passengers for a minimum of 10 minutes in which time a descent from 30 000 feet to 10 000 feet is performed." A rapid descent is the best course of action for air contamination or depressurization while under power; however, if the aircraft loses pressurization due to engine failure, a rapid descent would compromise the aircraft's glide profile and lessen the chances of reaching a suitable aerodrome.

Maintaining the aircraft's optimal glide profile is a fundamental aspect of coping with a total power loss. But, in a high-altitude engine failure scenario, the need to maintain optimal glide speed is at odds with the requirement to descend rapidly to below 13 000 feet due to depressurization and limited supplemental oxygen reserves. The PC-12 POH states that at the PC-12's optimum engine-out glide configuration, it would take 16 minutes to descend from 30 000 feet (the maximum altitude for PC-12 dual-pilot operations) to 13 000 feet. In a descent from 30 000 feet, supplemental oxygen would have been depleted six minutes prior to reaching 13 000 feet; from 25 000 feet (the maximum altitude for single-pilot operations), it would take about 11.5 minutes for the descent. Although the PC-12 meets CAR requirements for oxygen equipment, the standard oxygen supply carried is insufficient to allow engine-out let-down using the optimal glide profile while at the same time maintaining oxygen reserves.

The oxygen equipment and supply regulation predates SEIFR operations and has not been amended since the implementation of the SEIFR policy. The rule does not reflect the requirement for single-engine aircraft to maintain an optimal glide profile throughout the entirety of an engine-out descent. Other regulatory authorities have recognized the need for a specific oxygen equipment rule for SEIFR operations. The Australian Civil Aviation Safety Authority (CASA) SEIFR rule requires that pressurized SEIFR aeroplanes be equipped with "sufficient additional oxygen for all occupants to allow the descent from cruising level following engine failure to be made at the best range gliding speed and in the best gliding configuration, assuming the maximum cabin leak rate, until a cabin altitude of 13 000 feet is reached." European JAR-OPS SEIFR draft regulations propose the same oxygen rule.

Although oxygen supply was not a factor in this occurrence, it has been demonstrated that pressurized SEIFR aircraft operating in Canada may have insufficient oxygen reserves to allow for an optimal engine-out descent from maximum operating level. Therefore, the Board recommends that:

4.2.2 Electrical system requirements

The SEIFR requirement for electrical power is for two independent power generating sources, either of which is capable of sustaining essential flight instruments and electrical equipment. The PC-12 meets this requirement with two generators. According to the PC-12 POH, the battery provides power for engine starting, and can also provide power to essential electrical systems for 20 minutes in the event of a dual generator or engine failure if the electrical load is less than 60 amps. If the load is reduced to below 50 amps, the battery should last for 30 minutes. Maintaining optimal glide performance after an engine failure is fundamental and, during the glide, the aircraft battery is the sole source of electrical power. Instrument meteorological conditions may exist during the descent, and, therefore, it is crucial that the battery be capable of powering the flight instruments until landing.

At the PC-12's optimal glide speed and configuration, it would take about 32 minutes to descend from 30 000 feet to sea level; a glide from 25 000 feet would take about 28 minutes. The typical electrical load from essential equipment on the PC-12 is about 50 amps, and according to the aircraft manufacturer, a 70%-capacity battery with a rated battery power of 40 amp hours can supply this load for 31 minutes. Powering only the essential instruments and lights, battery power might be nearly or completely spent prior to touchdown. It may also be necessary to power other electrical systems, further reducing battery life. An attempted engine re-light or the use of a landing light at night would both place a large draw on a battery. Electric windshield heat may also be required. With the pilot windshield heat continuously on light mode, the estimated battery life is 24 minutes; on heavy mode, the estimated life is only 22.5 minutes, which is below the optimal gliding time from the maximum operating altitude.

Other rule-making authorities have recognized that standard battery supplies are inadequate for emergency SEIFR purposes. The Australian SEIFR requirement for emergency electrical supply is for a system of:

sufficient capacity and duration that is capable of providing power following the failure of all generated power, for those loads essential for--

1. one attempt at engine restart; and
2. descent from maximum operating altitude to be made at the best range gliding speed and in the best gliding configuration, or for a minimum of one hour, whichever is greater; and
3. continued safe landing; and
4. if appropriate, the extension of landing gear and flaps.

European JAR-OPS SEIFR draft regulations have proposed a similar requirement.

The standard emergency power supply (battery) on SEIFR aircraft may be insufficient to power essential aircraft electrical systems throughout an engine-out descent from maximum operating altitudes at the optimal glide configuration and speed, and there is no CAR requirement that such a system be required. Therefore, the Board recommends that:

4.2.3 Engine chip detector requirements

The SEIFR equipment standard requires a chip detector system to warn the pilot of excessive ferrous material in the engine lubrication system^{Footnote 4}. The chip detector on the accident PC-12 was designed to be disabled in flight and did not meet the intent of the equipment standard. TC has since advised operators of the PC-12 to install an engine chip detector that functions in all regimes of flight.

The chip detector system on board the PC-12 is installed at the six o'clock position in the RGB. Only the oil lubricating the RGB and a portion of the lubricating oil from the number three and four engine bearings pass over the chip detector before returning to the scavenge oil pump. None of the lubricating oil from the number one and two engine bearings and none of the oil from the AGB pass over a chip detector before returning to the scavenge oil pump. Oil from these areas goes first through the scavenge oil pump, then through the pressure pump and oil filter, before returning to lubricate the engine components. Therefore, metal generated in these areas would be filtered out prior to encountering the chip detector in the RGB. The chip detector system, as installed, is still not able to warn the pilot of ferrous material generated by all the engine components. Installation of a second chip detector, in the location of the AGB drain plug, would allow for the monitoring of all the unfiltered oil, and could also indicate the presence of ferrous particles if tied into the existing chip indicating system. The engine manufacturer has advised that this chip detecting configuration also exists on other aircraft types equipped with the PT-6 engine.

The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles, and other aircraft types using the PT-6 may be similarly configured. Therefore, the Board recommends that:

4.2.4 Engine trend monitoring requirements

Prior to the implementation of the Canadian SEIFR regulation, TC staff produced a position paper which proposed means of managing the associated risk. One of the proposals was for an engine performance monitoring system capable of monitoring engine parameters and comparing actual engine performance against the ideal. This system would provide operators with early indications of engine damage and deterioration. The final SEIFR rule, however, did not include a requirement for such a system.

The Australian CASA has included a requirement for automatic engine performance and condition monitoring, and the draft European policy has adopted this requirement. The FAA requires an inspection program that incorporates either the manufacturer's recommended engine trend monitoring program, which includes an oil analysis, if appropriate, or an FAA-approved engine trend monitoring program that includes an oil analysis at defined intervals.

TC initially proposed an engine monitoring system, and other regulating authorities have recognized the value of these systems and have included the requirement. These systems can provide early warning of engine deterioration and of the necessity to conduct an early removal and overhaul of the engine. Therefore, the Board recommends that:

4.2.5 Additional equipment requirements

Since the introduction of the Canadian SEIFR authority in 1993, significant advances have been made in aircraft equipment technologies. GPS satellite navigation in commercial navigation is now common, and automatic engine HUMS and advanced onboard oil debris monitoring systems that can detect non-ferrous oil debris particles are more available. The Australian regulatory authority has incorporated some of these newer systems into its SEIFR rule. The Australians have also required that electrical equipment such as landing lights and radar/radio altimeters be capable of being powered by the aeroplane's emergency electrical supply system (battery). There are several other equipment requirements listed in the Australian rule that are not part of the Canadian rule, but which are worthy of consideration. These items include:

• passenger seats that have been dynamically tested to meet the standards of at least FAR 23 amendment 36; and
• an approved shoulder harness or a safety belt with a diagonal shoulder strap for each passenger seat; and
• airborne weather radar equipment; and
• a HUMS; and
• an engine fire warning system.

These items would help either to prevent a loss of engine power or to lessen the adverse consequences of an engine-out occurrence.

The 1993 Canadian SEIFR policy was ground-breaking and has led the way for other regulatory agencies to introduce SEIFR. However, it appears that the subsequent rule-making activity by these other aviation authorities is resulting in SEIFR equipment requirements that are more stringent than the Canadian rule. New aircraft equipment technologies and changes to how old equipment is fitted on SEIFR aircraft could serve to lessen the occurrence or consequence of a SEIFR engine failure. Therefore, the Board recommends that:

4.2.5 Additional equipment requirements

Since the introduction of the Canadian SEIFR authority in 1993, significant advances have been made in aircraft equipment technologies. GPS satellite navigation in commercial navigation is now common, and automatic engine HUMS and advanced onboard oil debris monitoring systems that can detect non-ferrous oil debris particles are more available. The Australian regulatory authority has incorporated some of these newer systems into its SEIFR rule. The Australians have also required that electrical equipment such as landing lights and radar/radio altimeters be capable of being powered by the aeroplane's emergency electrical supply system (battery). There are several other equipment requirements listed in the Australian rule that are not part of the Canadian rule, but which are worthy of consideration. These items include:

4.2.6 Pilot decision making

In this occurrence, the pilot misdiagnosed the oil pressure indication. He therefore did not see the need to "land as soon as possible", and the engine failed before he could land safely. The pilot's decision making was influenced by his mistaken belief that the low oil pressure indications were not valid. The pilot encountered and failed to recognize an "error trap". The TSB has previously issued a recommendation (A95-11) on CRM and decision-making training for all operators and aircrew involved in commercial aviation. Ineffective PDM in small air carrier operations is still a matter of concern to the TSB. No specific decision-making course is required for SEIFR qualification, yet this training is required to receive operating qualifications in less complex environments, such as for flights in reduced VFR limits.

The only regulatory requirement for commercial pilots to undergo formalized PDM training is the CASS requirement for pilots operating in reduced visibilities. According to TC's Safety in Air Taxi Operations (SATOPS) report, "The association of the one-time PDM course with operations in reduced visibilities is not considered to be appropriate especially with the changing information on human factors and decision making." The SATOPS report also states that "The 'standard' course that is available contains out-of-date information and does not meet the needs of the industry."

TC developed the Pilot Decision-Making Course in the 1980s. Theories and models of human behaviour and pilot decision making have changed since then, but the current curricula have not been modified to reflect these changes. The value of PDM training has been generally recognized throughout the aviation industry. According to TC's SATOPS report, "Pilots and operators believe that PDM training can be very beneficial and practical for day-to-day operations. Some even believe that the course should be mandatory for pilots and management."

Simulator training that emphasizes decision making in complex environments is a very effective means of honing PDM skills.

The accident pilot did not have formal PDM training, company SOPs, or PC-12 simulator training to help him formulate his decision. Without a systemic approach to improving PDM, accidents resulting from ineffective decisions in complex situations will continue to affect commercial operations. The Board believes that improved formal PDM training is a necessity for all commercial pilots. The Board also believes that SOPs and an increased emphasis on appropriate decision making throughout pilot training and during all of a pilot's flying-related activities will serve to reduce the occurrence of PDM-related accidents. Therefore, the Board recommends that:

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 04 February 2000. It was officially released on 24 March 2000.

Appendix A - List of supporting reports

The following TSB Engineering Branch Reports were completed:

• LP 87/98 - Engine Components Analysis
• LP 115/98 - TAT Oil Cooler Analysis

These reports are available from the Transportation Safety Board of Canada upon request.

Appendix B - Glossary

ACC

Area Control Centre

AGB

accessory gearbox

agl

above ground level

ATPL

airline transport pilot licence

CARs

Canadian Aviation Regulations

CASA

Civil Aviation Safety Authority

CASS

Commercial Air Service Standard

CBAAC

Commercial and Business Aviation Advisory Circular

CRM

crew resource management

ELT

emergency locator transmitter

EIS

engine instrument system

ETOPS

extended range twin-engine operations

FAA

Federal Aviation Administration

FARs

Federal Aviation Regulations

FL

flight level

GPS

global positioning system

HUMS

health and usage monitoring system

IFR

instrument flight rules

JAR-OPS

Joint Aviation Requirements--Operations

lb

pound(s)

min

minute

NDT

Newfoundland daylight saving time

Ng

gas generator speed

nm

nautical miles

PDM

pilot decision making

PIREP

pilot report

POH

pilot operating handbook

PSI

pounds per square inch

P & W

Pratt & Whitney

Px

pressure

RCMP

Royal Canadian Mounted Police

RGB

reduction gearbox

REL

required equipment list

SATOPS

safety in air taxi operations

SE

southeast

sec

second

SEIFR

single-engine instrument flight rules

SIGMET

significant meteorology reports

sm

statute miles

SOPs

standard operating procedures

TC

Transport Canada

TSB

Transportation Safety Board of Canada

UTC

coordinated universal time

VFR

visual flight rules