Aviation Investigation Report A05H0002

The Air France Airbus A340-313 aircraft (registration F-GLZQ, serial number 0289) departed Paris, France, at 1153 Coordinated Universal Time (UTC) as Air France Flight 358 on a scheduled flight to Toronto, Ontario, with 297 passengers and 12 crew members on board. Before departure, the flight crew members obtained their arrival weather forecast, which included the possibility of thunderstorms. While approaching Toronto, the flight crew members were advised of weather-related delays. On final approach, they were advised that the crew of an aircraft landing ahead of them had reported poor braking action, and Air France Flight 358s aircraft weather radar was displaying heavy precipitation encroaching on the runway from the northwest. At about 200 feet above the runway threshold, while on the instrument landing system approach to Runway 24L with autopilot and autothrust disconnected, the aircraft deviated above the glideslope and the groundspeed began to increase. The aircraft crossed the runway threshold about 40 feet above the glideslope.

During the flare, the aircraft travelled through an area of heavy rain, and visual contact with the runway environment was significantly reduced. There were numerous lightning strikes occurring, particularly at the far end of the runway. The aircraft touched down about 3800 feet down the runway, reverse thrust was selected about 12.8 seconds after landing, and full reverse was selected 16.4 seconds after touchdown. The aircraft was not able to stop on the 9000-foot runway and departed the far end at a groundspeed of about 80 knots. The aircraft stopped in a ravine at 2002 UTC (1602 eastern daylight time) and caught fire. All passengers and crew members were able to evacuate the aircraft before the fire reached the escape routes. A total of 2 crew members and 10 passengers were seriously injured during the crash and the ensuing evacuation.

1.1 History of the Flight

1.1.1 Departure

The Air France Airbus A340-313 aircraft (registration F-GLZQ, serial number 0289) departed Runway 09L at Paris-Foissy-Charles-de-Gaulle International Airport (LFPG),^{Footnote 1} France, at 1153 Coordinated Universal Time (UTC)^{Footnote 2} as Air France Flight 358 (AFR358) on a scheduled flight to the Toronto/Lester B. Pearson International Airport (CYYZ), Ontario, with 297 passengers and 12 crew members on board. Among their other pre-flight activities, the flight crew members obtained the weather forecast for their arrival, which included the possibility of thunderstorms. In anticipation of potential weather-related delays on arrival, an additional 3 metric tonnes (3000 kg) of fuel was uploaded to allow for an extra 23 minutes of holding time at Toronto.

The ground taxi and take-off were uneventful. The captain was designated as the pilot flying (PF) for the take-off and the first half of the flight. The first officer was the PF for the second half of the flight, including the approach and landing in CYYZ. The PF/PNF (pilot not flying) duties were exchanged to allow the captain to log a take-off on this flight. This exchange of duties occurred at 1617, and the crew switched from autopilot 1 to autopilot 2.

1.1.2 En Route

The flight plan for the ocean crossing was filed as follows: Track Bravo - Flight Level 350 (FL 350) at ocean entry waypoint. Climb to FL 360 at 40° west (W) longitude and climb to FL 370 at 60°W. Before reaching the oceanic track system entry point, the aircraft received a clearance for track Alpha, one track north of the flight-planned track. The flight crew members received a new operational flight plan (OFP) via the aircraft communications addressing and reporting system (ACARS) from their company to reflect the track change. The flight followed this track with the restriction to not climb above FL 350 during the Atlantic crossing. The aircraft was eventually cleared to FL 360 at 1716, the highest altitude the aircraft reached on the flight.

At 1351, the flight crew members received requested weather information through the ACARS for potential emergency airports along their ocean-exit track over northeastern Canada.

At 1444, the flight crew members requested, via the ACARS, the aviation routine weather report (METAR) and aerodrome forecast (TAF) for their destination (CYYZ), and their alternate, Niagara Falls International Airport (KIAG), New York, United States. The 1400 METAR information was delivered to the aircraft, but a "TAF NIL" message was received instead of the requested TAF. This occurred because they had requested "TAF Short" even though both airports had only "TAF Long" available (see Section 1.6.17, Aircraft Communications Addressing and Reporting System). The 1400 METAR information for CYYZ and KIAG was unremarkable. There was no reported thunderstorm activity at either airport. At 1608, the flight crew received the 1600 automated terminal information service (ATIS) report for CYYZ indicating good ceiling and visibility with light winds. At 1617, the crew exchanged PF and PNF duties, corresponding to a change from autopilot 1 to autopilot 2. From this point forward, the first officer was the PF.

At 1750, AFR358 sent a message to Air France operations in CYYZ indicating an estimated time of arrival (ETA) of 1939. At 1753, AFR358 received a reply with information about the parking gate. The message did not indicate that there was a red alert^{Footnote 3} in effect at CYYZ because it was not part of the station manager's procedures or requirements to inform the crew of red alerts. The crew was familiar with the red alert procedure, and there was information with respect to this procedure on the Air France approach charts.

At 1849, the flight crew members received requested METAR weather for KIAG, Ottawa/Macdonald-Cartier International Airport (CYOW), Ontario, their en route alternate, and Cleveland-Hopkins International Airport (KCLE), Ohio, United States. Thunderstorms were reported to the northwest of KIAG, moving southeast. There was no thunderstorm activity reported at either KCLE or CYOW. Again, they did not receive TAF information because of a "TAF Short" request. At this point, the estimated fuel remaining was approximately 12.2 tonnes. Fuel calculations by the crew indicated that there would be 8.7 tonnes remaining on arrival. With CYOW as a possible alternate, the crew calculated that 7.3 tonnes would be required to divert to CYOW, leaving 14 minutes of holding fuel at Toronto.

At 1903, the flight crew made initial contact with the Toronto Area Control Centre (ACC) - the Killaloe air traffic control (ATC) sector - and inquired about the CYYZ weather. The controller indicated that the flight crew would be kept informed about the weather.

At 1904, a message was sent to Air France operations in CYYZ indicating that, if a diversion was necessary, AFR358 would be going to CYOW. AFR358 did not inform ATC that they required a change in their alternate, nor were they required to do so at that time.

At 1913, a discussion between the flight crew and ATC on information regarding the movement of the active weather took place.

At 1915, AFR358 was given instructions to reduce to minimum speed due to landing delays at CYYZ. AFR358 requested and received vectors to avoid weather.

At 1917, the flight crew members received their requested METAR weather for CYYZ, which included information about thunderstorms and heavy rain.

1.1.3 Descent and Approach

At 1919, the crew briefed the windshear procedure. In the event windshear was encountered, the crew planned to conduct a missed approach.

At 1922, AFR358 was advised that traffic was starting to move into CYYZ and to expect further clearance at 1950. Considering the fuel status of AFR358, delaying to that time would be close to the maximum holding time. While on the heading of 040°, away from the airport, AFR358 reminded the controller twice that they were still headed away from the airport.

At 1928, AFR358 was cleared for a Simcoe 2 arrival procedure to Toronto. The fuel remaining was 9.3 tonnes; the aircraft was 137 nautical miles (nm) from destination.

At 1930, the crew reviewed the company's policy/procedure for when to declare minimum fuel. (See Section 1.17.5, Flight Planning, for a description of this procedure related to the occurrence flight.)

At 1933, the ATIS information broadcast indicated that CYYZ had reduced visibility in thunderstorms and heavy rain, and rapidly changing weather conditions; Runway 24L was the expected runway. Also, AFR358 received METARs via the ACARS for KCLE, CYOW, and KIAG. The decision was then made to use CYOW as the alternate, with six minutes of holding fuel available at Toronto.

Between 1936 and 1940, a briefing was conducted for the instrument landing system (ILS) approach to Runway 24L. The briefing did not include runway length or missed approach procedure. No runway distance calculations for a wet or contaminated runway were a part of this briefing.

At 1940, AFR358 requested an update on the CYYZ weather and were advised that aircraft were now able to go into CYYZ, but there was no prediction on the traffic flow situation. The flight crew requested to be kept advised of ongoing conditions, additional delays, and any worsening of the weather. At 1947, the chief purser was informed that, in the event that there was a diversion, the new destination would be CYOW. During that period, some aircraft on the same radio frequency were advising ATC that they were proceeding to alternate airports.

At 1949, AFR358 requested and received a deviation around weather on the approach. The CYYZ control tower frequency was on in the cockpit at this time and other aircraft were landing.

At 1953, the number one aircraft on approach (AFR358 was number three) was asked by ATC about their likelihood of being able to land. The reply was that the weather was to the north and looking pretty bad. It is not known if the flight crew of AFR358 heard that transmission. The two aircraft ahead of AFR358 landed successfully.

At 1953, the approach checklist was completed. Approach mode was selected, followed by flap one. The system page was manually selected from "Cruise" to "Circuit Breaker." A logo light fault was indicated on and cleared from the electronic crew alerting and monitoring (ECAM). The aircraft was established on the localizer at approximately 16 nm from the threshold.

During the initial descent, Flap 2 was selected and the landing gear was extended. The autopilot was disengaged followed by speedbrake retraction while descending through 4000 feet above sea level (asl). Flap 3 then flap full was selected, and, as the aircraft converged onto the glideslope through 3000 feet asl, the autopilot was re-engaged. The glideslope was intercepted approximately 8.7 nm from the threshold, with the aircraft stabilized and in landing configuration.

At 1958, AFR358 was at the approach speed on final approach. The previous aircraft had reported that braking action was poor; the tower wind instruments were not functioning because they were knocked off line during thunderstorm activity; the last wind available in the tower was 230° at 7 knots; and there was lightning all around the airport. The autobrake mode was reconfigured from autobrake low to autobrake medium, and callout commands for a go-around were reviewed.

At 1958, the crew wanted to complete the pre-landing checklist, but noted that the landing memo on the ECAM, which is part of the checklist, was not yet displayed. Although the ECAM items may be verified by the crew without having the checklist displayed, the crew delayed the pre-landing checklist. The challenge and response checklist had not been completed before landing although all the items in the checklist had been actioned as part of the normal cockpit flow. A Regional Jet landing ahead of AFR358 reported the wind as 290° at 15 to 20 knots, and that the braking action was poor until the aircraft was slowed below 60 knots.

Weather conditions during the remainder of the approach ranged from visual meteorological conditions (VMC) to instrument meteorological conditions (IMC) with flight in very dark clouds, turbulence, and heavy rain. AFR358 had visual contact with the ground when the aircraft was 2 to 3 nm from the runway. At an altitude between 1000 and 1500 feet above ground level (agl), about half of the runway was visible and at times part or all of the ramp area was clearly visible. The runway was covered with water, producing a shiny, glass-like surface. There was lightning on both sides and at the far end of the runway. The aircraft's weather radar showed heavy precipitation, with a red area encroaching on the runway from the northwest and another south of the runway. The flight crew obtained wind speed and direction from the aircraft's navigation display (ND), which indicated that there was a 70° to 90° crosswind from the right at 15 to 20 knots. The windshield wipers were turned on to SLOW at 4 nm from the runway and stayed on for the remainder of the flight.

The autopilot and autothrust were engaged while on the approach. While in automatic flight, the aircraft was stabilized on the localizer and glideslope, and was flying at the targeted speed of 140 knots. At 2001:18, as the aircraft passed through 323 feet agl, the PF disconnected the autopilot and two seconds later disengaged autothrust. The PF then increased engine thrust from about 42 per cent N1 (engine compressor speed) to about 82 per cent N1 because he sensed that the airspeed was decreasing and the aircraft was sinking. The flight data recorder (FDR) shows a small decrease in airspeed at that time. The aircraft then began to deviate above the glideslope. At about the same time, the wind direction shifted, changing from a 90° crosswind component to an increasing tailwind component of up to 10 knots.

1.1.4 Landing

The aircraft crossed the runway threshold about 40 feet above the glideslope. There were no callouts to indicate deviations from desired aircraft performance or trajectory. The aircraft entered an area of heavy rain, there were numerous lightning strikes occurring, and visual contact with the runway environment was severely reduced.

The PF began the flare when the aircraft was about 40 feet above the runway. From this point to touchdown, there were numerous and sometimes significant pitch inputs made on the PF side stick, and the aircraft levelled off at approximately 25 feet for a period of 2½ seconds. During this time, there were also regular and sometimes large inputs in roll on the PF side stick. Combined, these inputs would indicate that significant workload and attention were required on the part of the PF to control the aircraft. The crew began a progressive reduction in thrust from a 76 per cent N1 when the aircraft was at 50 feet, with the throttle levers reaching the idle position when the aircraft was about 20 feet above the runway.

The aircraft touched down at 2001:53, approximately 3800 feet down the 9000-foot runway. On touchdown, the right main landing gear was slightly left of the runway centreline, and the aircraft was crabbed about six degrees to the right. The spoilers deployed automatically, as designed, after the main wheels contacted the runway. The flight crew immediately applied maximum manual braking and attempted to align the aircraft with the centreline. Idle reverse was selected 12.8 seconds after main gear touchdown, and full reverse was selected 16.4 seconds after main gear touchdown. Standard callouts to indicate spoiler and reverser deployment were not made by the PNF. The aircraft was not able to stop on the remaining runway. It departed the end of the runway at a groundspeed of approximately 80 knots and came to rest in a ravine. The aircraft left the runway at 2002:19.

As the flight landed, three or four bright orange flashes were observed from the control tower through the heavy rain. The tower supervisor was immediately advised and the crash alarm was triggered. The "1 Alpha" system alerts the emergency response agencies on and off the airport that an on-airport crash has occurred, and it initiates the complete mobilization of all available fire and rescue services.

The cabin crew ordered an evacuation within seconds of the aircraft stopping because fire was observed out the left side of the aircraft, and smoke was entering the cabin. There was no electrical power available on AFR358 and the radios would not operate in order to call the tower. After exiting his seat with difficulty, the first officer got a flashlight and went to the rear of the aircraft with the chief purser and one of the cabin attendants, checking to see if there was anyone left in the cabin or any of the lavatories. They returned to the front of the aircraft via the opposite aisle, confirming that the cabin was completely evacuated before they left the aircraft via the L1 door, from which they had to jump because the slide was only partially deployed. The first officer was the last person to exit the aircraft.

The captain also attempted to check the aircraft for passengers before exiting but was forced to turn back due to smoke as the first officer and the two others were finishing their search for remaining passengers on board. He left the aircraft via the R1 door, and had a difficult time exiting the aircraft because he had sustained back injuries.

All passengers and crew members were able to evacuate before the post-crash fire consumed most of the aircraft's fuselage. The accident happened at 2002 (1602 local time) during the hours of daylight and at a geographic location of latitude 43°39′20″ N, longitude 79°37′27″ W.

1.2 Injuries to Persons

	Crew	Passengers	Others	Total
Fatal	-	-	-	-
Serious	2	10	-	12
Minor/None	10	287	-	297
Total	12	297	-	309

Thirty-three persons were taken to the hospital by ambulance. Of those, 21 were treated for minor injuries and released, and 12 (2 crew members and 10 passengers) were admitted with serious injuries. Nine persons received serious injuries as a result of the impact, and three persons received serious injuries during the evacuation. The two crew members who had suffered serious impact injuries were able to perform their emergency duties effectively. Passengers who incurred impact injuries were ambulatory during the evacuation. One of the cabin crew, seated in the same general area as the crew and passengers who incurred serious impact injuries, was not injured. This cabin crew's seat was aft-facing; the other seats were forward-facing.

1.3 Damage to the Aircraft

The aircraft was substantially damaged during the overrun, and was subsequently destroyed by the post-crash fire.

1.4 Other Damage

During the accident, there was no damage to the runway or blast pad at the exit end. Two runway end lights were destroyed as well as the last five bars of the Runway 06R approach lights (closest to the runway) (see Section 1.12, Wreckage and Impact Information).

1.5 Personnel Information

	Captain	First Officer
Pilot Licence	Airline Transport	Airline Transport
Medical Expiry Date	31 January 2006	31 August 2005
Total Flying Hours	15 411	4834
Hours on Type	1788	2502
Hours Last 90 days	100	173
Hours on Type Last 90 Days	100	173
Hours on Duty Prior to Occurrence	10.5	10.5
Hours off Duty Prior to Work Period	12 days	12.5 hours

1.5.1 Captain Information

The captain flew his first solo in a glider on 01 December 1963. He joined the military service while waiting for a civilian job in aviation. In August 1973, the captain joined the French commuter airline Touraine Air Transport (TAT). Later, he joined Air Inter where he flew the Airbus A300. The captain became an Air France employee when Air Inter was merged with Air France in 1997.

When the captain joined Air France, he flew the Airbus A319, A320, and A321. With Air France, he was initially a captain and an instructor on the Airbus A320. He later applied for the long-haul service on the Airbus A340 and was accepted. Later, he was asked to become an instructor, but declined the offer because he wanted to learn more about the aircraft and the long-haul service first. He obtained his Airbus A340 rating in 2001.

The captain was considered a good and loyal employee, and there were no issues with his ability as a pilot or instructor. He had a good reputation for being easy to fly with and had a positive working relationship with cabin crew members. His priority in dealing with the aircraft crew was to have open communications and a relaxed, professional environment. He considers the training that he received and the training at Air France, in general, to be first rate.

The captain completed his last aviation medical exam on 07 July 2005 and held a Class 1 medical certificate, valid until 31 January 2006 and with the restriction that corrective lenses must be worn in flight. He completed his last line check on 08 October 2004. He completed his last pilot proficiency check on 19 April 2005, and had completed six take-offs and five landings on the Airbus A340 in the previous 90 days. The captain was qualified and certified in accordance with both company and regulatory requirements. The captain was working on a reduced flight schedule (see Section 1.13, Medical Information, for further details).

The captain's previous flight segment was on 18-19 July 2005, 12 days before the occurrence flight. On 18 July 2005, he was assigned as captain on AFR018 from LFPG to Newark International Airport (KEWR), New Jersey, United States. On that flight, AFR018 diverted to the Boston-Logan International Airport (KBOS), Massachusetts, United States, due to weather-related delays in KEWR. After a one-hour delay on the ground in KBOS, the aircraft departed for an uneventful flight to KEWR. On 19 July 2005, the captain flew the return flight to LFPG.

The captain relaxed and did nothing physically tiring during the weekend before the accident flight. He had a good sleep pattern and no problem with fatigue. On the day of the occurrence flight, the captain awoke at about 0630 local time. He lives in the south of France and took the train to LFPG, about a 2½-hour trip. The captain arrived at flight preparation about 2½ hours before the scheduled departure time.

About two hours before departure, he met with the first officer, whom he knew. He recognized the first officer from a previous simulator session, and expected that this would be a good flight. The captain did not know anyone from the assigned cabin crew, but struck up a good relationship immediately with the chief purser. Everyone seemed to be in a good mood, and the captain was pleased with the good communications among the crew.

1.5.2 First Officer Information

In March 1985, the first officer was hired by Air France as a cabin crew member. In 1986 and 1987, he attended a flight training school in the United States, following which he continued to gain pilot expertise in France by flying single-engine aircraft and studying flight theory in preparation for the Air France pilot selection process. He accumulated 800 flight hours and 100 simulator hours.

The first officer started pilot training with Air France in January 1991, but the training was cancelled at the end of February 1992 due to the Gulf War. He returned as a cabin crew member and was promoted to chief purser in 1995. He held this position for 1½ years. In 1996, the Air France pilot training program was restarted, and the first officer completed his multi-engine rating. He began working as a pilot with Air France on 01 April 1997. He flew as a first officer on the Airbus A319/A320/A321 series for a period of 3½ years and received his type rating on the Airbus A340 on 11 September 2001. He flew that aircraft type in long-haul operations as a first officer up until the accident flight.

The first officer was considered by Air France to be a solid and competent pilot, who had no problems on the line or during training. He had a good reputation with management and training pilots. Although he had not flown previously with the occurrence captain, they had met during a simulator session on 18 August 2000 when both pilots were working on the Airbus A320 fleet. On that occasion, the occurrence captain was acting as a check pilot, and the first officer was participating in a check flight in the simulator with another captain. This check flight was unsuccessful for both crew members due to a performance issue with the captain being tested. In accordance with Air France policy, the first officer received an additional training session and passed a check flight in the simulator on 20 August 2000 with a different check pilot. The first officer considered his training to be first rate, and the operating environment at Air France to be very professional and supportive.

The first officer completed his last aviation medical on 08 February 2005 and held a valid Class 1 medical certificate. He completed his last line check on 24 October 2004 and his last pilot proficiency check on 07 February 2005. Before the accident flight, he had conducted 8 take-offs and 6 landings on the Airbus A340 in the previous 90 days. In this period, he had also completed 2 take-offs and 2 landings in the Airbus A340 simulator. The first officer was qualified and certified in accordance with both company and regulatory requirements.

Before the occurrence flight, the first officer's previous flight as a crew member had been from LFPG to Atlanta, Georgia, United States, and return between 26 and 28 July 2005. Before the Atlanta flight, he had been on a three-week vacation. On the day before the occurrence, the first officer participated in a training session (as a first officer) for another Air France pilot who was undergoing captain's training.

The simulator session finished at about 2245 local time, and the first officer was home by about 2330. Although he could not fall asleep right away, he eventually slept well. He awoke at 0845 and felt well rested when he arrived at LFPG the next morning at about 1115 local time. He had had 12½ hours of off-duty time.

1.5.3 Cabin Crew Information

Cabin Crew Position	Cabin Crew Experience at Air France
L1 (Chief Purser - Minimum Crew)	20 years
L2 (Forward Purser - Minimum Crew)	18 years
L3 (Minimum Crew)	8 years
L4 (Aft Purser - Minimum Crew)	13 years
R1 (Supplemental Crew)	5 years
R2 (Supplemental Crew)	10 years
R3 (Minimum Crew)	10 years
R4 (Minimum Crew)	5 years
Cabin Crew Seat 9 (Additional Crew)	5 weeks
Cabin Crew Seat 10 (Supplemental Crew)	4 years

There were 10 cabin crew on board; nine cabin crew plus one additional crew member, a crew member not yet qualified. In accordance with French regulatory requirements, all of the occurrence cabin crew were certified and qualified for their assigned duties.

Section JAR-OPS 1.990 of the European Joint Aviation Requirements (JARs) calls for "one cabin crew member for every 50, or fraction of 50, passenger seats installed on the same deck of the aeroplane." Cabin crew comprising the minimum crew must be qualified on the type of aircraft being operated. The minimum crew for AFR358 was six.

Cabin crew designated as members of the minimum crew were assigned to cabin crew stations L1 (chief purser), L2 (purser), L3, L4 (purser), R3 and R4, in accordance with company operating procedures. These cabin crew members were responsible for the safety of passengers. Cabin crew carried in addition to the required minimum crew are called supplemental crew and need not be qualified on the type of aircraft being operated.

There were three supplemental cabin crew members on the occurrence flight. They were assigned to cabin crew stations R1, R2, and cabin crew seat 10, located in the aft cabin between galleys 6 and 7. Supplemental cabin crew may perform duties related to passenger safety during normal operations and during emergency situations if directed to do so by a member of the minimum crew.

The additional cabin crew was on board for passenger service purposes only. She began working at Air France on 30 June 2005 and had completed four flights before the accident flight, her second flight on an Airbus A340. The additional crew member was assigned cabin crew seat 9, located adjacent to cabin crew seat 10. Under normal operating conditions, additional crew members cannot be assigned passenger safety-related duties. However, in an emergency situation, they may perform such duties if directed to do so by a member of the minimum crew (as may any other able-bodied passenger).

1.6 Aircraft Information

Manufacturer	Airbus
Type and Model	A340-313
Year of Manufacture	1999
Serial Number	0289
Certificate of Airworthiness	Issued 07 September 1999
Total Airframe Time	28 426 hours
Engine Type (number of)	CFM International 56-5C4 (4)
Maximum Allowable Take-off Weight	271 000 kg
Recommended Fuel Type(s)	Jet A, Jet A1
Fuel Type Used	Jet A1

1.6.1 General Information

The Airbus A340-313 is a wide-body (twin aisles), passenger, transport aircraft. The main deck was divided into three distinct areas: the flight deck, the flight crew rest area, and the passenger cabin. A rest area for cabin crew was located in the belly of the aircraft.

The flight deck accommodates two pilots, plus seats for two other occupants. The flight crew rest area, an enclosed compartment, is on the right side of the forward cabin, immediately aft of the flight deck. It contains two sleeping berths that can be converted to seats certified for take-off and landing. The compartment door is adjacent to the aisle leading to the flight deck and opens inward.

The aircraft passenger cabin was configured to accommodate 291 passenger seats. Passenger seats were placed 6 abreast in business class (forward cabin) and 8 abreast in economy (mid/aft cabin). There were 30 seats in business class (rows 1 to 6), 140 in the first section of economy (rows 14 to 31), and 121 in the second section of economy (rows 32 to 48). Overhead stowage compartments ran along the cabin sidewalls throughout the cabin seating area. Additional stowage compartments were fitted down the centre of the cabin, suspended from the ceiling. The stowage compartments were rated for 50 kg (110 pounds). Stowage compartment doors were designed to latch in the closed and open positions.

The aircraft has six cabin doors, three on the left side (L1, L2 and L4) and three on the right side (R1, R2, and R4), and two emergency exit doors (L3 and R3). The cabin doors are used as entrance and exit doors for the passengers and the crew. The aircraft cabin was equipped with eight cabin crew stations, one adjacent to each of the cabin doors/emergency exits. The cabin crew station at the L1 door included two cabin crew seats. From a seated position, cabin crews could reach certain emergency equipment, including the communication handset for the cabin interphone system and the public address (PA) system. Two additional cabin crew seats were located in the aft galley.

1.6.2 Aircraft Weight and Balance

The FDR recorded value for the fuel weight at the time of landing was approximately 7500 kg and the zero fuel weight of the aircraft was 177 500 kg; therefore, the aircraft weight at the time of the landing was 185 000 kg. This landing weight value was verified by Airbus by studying the aerodynamic performance of the aircraft while on approach. The maximum landing weight is 190 000 kg, and the maximum zero fuel weight is 178 000 kg. The FDR recorded value for the aircraft centre of gravity at the time of the accident was 29.8 per cent MAC (mean aerodynamic chord), which is about mid-range of the allowable limits.

1.6.3 Landing Speeds

For a landing weight of 185 tonnes and flaps full, the certified runway threshold crossing speed (VREF) is 135 KIAS (knots indicated airspeed) and the approach speed (VAPP or target speed) is 140 KIAS.

1.6.4 Landing Distance Calculations

The information in the following three tables is derived from the Air France operations manual (manuel d'exploitation or MANEX).^{Footnote 4} The calculated landing distance for a runway that is covered with less than 3 mm of water (wet runway), using the airport elevation for CYYZ, using autobrakes "low," and assuming no wind, full flaps, and without the use of thrust reversers, is 2196 m (7203 feet).

Autobrake Setting	Dry	Wet
Low	2185 m (7167 feet)	2196 m (7203 feet)
Medium	1652 m (5419 feet)	1777 m (5829 feet)

Derived from MANEX Chart TU04.01.64. 14A340-313 Full Flaps Landing Distance for Toronto (CYYZ) Pressure Altitude 500Feetasl - NoWind- VREF+5

MANEX Chart TU 04.01.64. 14 calls for a 21 per cent increase in the landing distance with a 10-knot tailwind. The table below contains the landing-distance values with the 10-knot tailwind correction applied. With a 10-knot tailwind, a wet runway, autobrakes "low," and without the use of thrust reversers, the calculated landing distance is 2657 m (8715 feet).

Autobrake Setting	Dry	Wet
Low	2644 m (8672 feet)	2657 m (8715 feet)
Medium	1999 m (6557 feet)	2150 m (7053 feet)

Derived from MANEX Chart TU 04.01.64. 14 A340-313 Full Flaps Landing Distance for Toronto (CYYZ) Pressure Altitude 500 Feet asl - 10-Knot Tailwind - V REF + 5

The calculated landing distance^{Footnote 5} for Runway 24L at CYYZ for the conditions at the time of landing, assuming ¼-inch (approximately 6 to 7 mm) of water on the runway (contaminated), using manual braking, is summarized in the table below.

Wind	No Reversers	Using Four Reversers
0	2670 m (8780 feet)	2403 m (7883 feet)
5-knot tailwind	3071 m (10 075 feet)	2764 m (9068 feet)
10-knot tailwind	3471 m (11 388 feet)	3124 m (10 249 feet)

Derived from MANEX Chart TU04.02.50. 13A340-313 Full Flaps Landing Distance for Toronto (CYYZ) Pressure Altitude 500Feetasl, Manual Braking

The Airbus flight crew training manual (FCTM) states that passing over the runway threshold at 100 feet altitude rather than 50 feet will increase the total landing distance by approximately 950 feet (300 m).

1.6.5 Stopping Performance

Airbus was asked to provide information regarding normal thrust reverser deployment times and calculations of stopping distance for the Airbus A340-313 for a combination of actual and expected performance variables. The Airbus A340-313 aircraft flight manual (AFM) uses 5.1 seconds between main landing gear touchdown and thrust reverser selection, and 1 second for the thrust reversers to deploy when calculating stopping distance.

Using the environmental conditions for Runway 24L at the time of landing and the actual aircraft configuration of AFR358, stopping distances were calculated using the recorded FDR information. For the actual touchdown speed of 143 KIAS, with a 10-knot tailwind and the actual deployment of thrust reverser time of 16.4 seconds, the aircraft would have stopped in 6674 feet (2034 m) after touchdown. With full reverse thrust selected after touchdown in accordance with the AFM, the aircraft would have used 5938 feet (1809 m) of runway. With full reverse thrust selected after touchdown in accordance with the AFM and the aircraft touching down at the recommended speed, the aircraft would have used 5574 feet (1699 m) of runway. As noted in Section 1.1.4, the touchdown point was 3800 feet down the 9000-foot runway.

1.6.6 Aircraft Seats and Restraint Systems

The cockpit seats were certified to JAR 25.561. A review of the cockpit seat design documents indicated that these seats exceeded the minimum requirements of JAR 25.561. Both cockpit seats and the third occupant seat were column-mounted. The fourth occupant seat was a folding seat, attached to the rear partitioning wall on the right side of the flight deck. All of the seats in the flight deck were equipped with a four-point restraint harness.

The passenger and cabin crew seats were certified to JAR 25.561 (described as 9 g horizontally) and JAR 25.562 (described as 16 g horizontally). Passenger seats were equipped with a lap belt. The cabin crew seats and the seats in the flight crew rest area were equipped with three-point restraint harnesses. In accordance with JAR-OPS 1.730 (Subpart K), supplemental loop belts were provided for infants.

The certification basis for the accident aircraft was JAR 25, Change 13, effective on 05 October 1989. The Transport Canada (TC) Type Certificate Data Sheet identifies the certification basis for the Airbus A340-300 series as Airworthiness Manual, Chapter 525, Change 1, dated January 1987 (this is equivalent to JAR 25, Change 12), plus additional requirements with which Airbus elected to comply. The latter included JAR 25, Change 13, which introduced the Emergency Landing - Dynamic Conditions, Section 25.562, applicable to passenger seats.

TC has indicated that the current Canadian Aviation Regulations (CARs) require all aircraft seats to meet the requirements of Section 525.562, Emergency Landing - Dynamic Conditions. The European Aviation Safety Agency (EASA) certification standards (CS) require passenger seats to meet the requirements of CS 25.562. Even though Section 525.562 of the CARs is not harmonized with EASA's CS 25.562, the requirements of Section 525.562 of the CARs are presently applicable to all new applications for operation into Canada. At the present time, there is no movement to harmonize EASA's CS 25.562 with Section 525.562 of the CARs.

1.6.7 Emergency Exits

There were eight doors in the passenger cabin (see Section 1.6.1) that could be used as emergency exits. The six cabin doors (L1, L2, L4, R1, R2, and R4) are a Type A emergency exit and the two emergency exit doors (L3 and R3) are a Type I emergency exit. Type A and Type I doors were similar in construction and operation. Both were designed to be opened either from the interior or the exterior. The doors have a very slight, inward initial-opening movement and then open upward, outward, and forward. In the Airbus cabin crew operating manual, instructions for opening the doors from the interior state that, to open the door during NORMAL OPERATIONS, one must "Lift the door control handle fully up," which disengages two latches on the top of the door, thereby unlocking it.

Each door was equipped with a damper actuator system (door assist) comprising a damper and an emergency operation cylinder. The damper limits the travel of the door during normal operations, especially in windy conditions. During emergency operations, it acts as an actuator for automatic door opening. The damper and emergency operation cylinder are operated by compressed nitrogen stored in a cylinder equipped with a pressure gauge (commonly referred to as door pressure). The compressed nitrogen is released by an actuating device controlled by the slide arming lever. When the slide arming lever is in the ARMED position, as it is during landing, and the door operating handle is raised approximately 90°, the door assist engages and opens the door automatically. Each emergency exit door contained an observation window with a prismatic lens.

1.6.8 Evacuation Escape Devices

The aircraft was equipped with eight evacuation escape devices to facilitate rapid occupant egress in the event of an emergency: two single-lane slides at emergency exit doors L3 and R3, and six dual-lane slide/rafts^{Footnote 6} at emergency exit doors L1, L2, L4, R1, R2, and R4. The slides on the occurrence aircraft were stowed in containers attached to the lower portion of each cabin door and were manufactured by Goodrich Corporation.

The deployment and inflation of the units are automatically initiated when the door is opened in the ARMED mode. As the door begins to open, two release pin lanyards detach the slide pack from the door and the outward movement of the door pulls the slide out of the aircraft; as the pack rolls out, the slide falls below the door sill and a firing lanyard activates. Primary gas is supplied to the slide and it begins to inflate. In the event that inflation does not start automatically, each slide is equipped with a red manual inflation handle. An intermediate tie device restrains the slide to approximately one-third of its extended length, to prevent it from inflating underneath the fuselage. When the slide becomes sufficiently pressurized, the intermediate tie releases and the slide is projected outward and downward to contact the ground. According to certification standards, the complete deployment sequence, from the door opening until the full inflation of the slide, is required to be within 16 seconds. However, the typical door opening/slide inflation time on the Airbus A340 is 8 seconds. There is no indication that the applicable certification standards were not met in this occurrence, except for the problem encountered with the L2 door.

1.6.9 Evacuation Alert System

Although not required by regulation, the aircraft was equipped with an evacuation alert system. An overhead panel in the flight deck contained:

• an EVAC ON pushbutton, which, when pressed, activates red EVAC flashing lights in the flight deck and the cabin, and horns in the cabin at each door, signalling cabin crew to commence evacuating passengers;
• a HORN OFF pushbutton, which, when pressed, silences the horn; and
• a toggle switch with two positions: CAPT and CAPT & PURSER. When the toggle switch is in the CAPT position, the alert may be activated from the flight deck only. When the toggle switch is in the CAPT & PURSER position, the alert may be activated from either the flight deck or the cabin.

The flight attendant panel (FAP) located in the forward cabin included an EVAC/CMD pushbutton. When the pushbutton is depressed, red EVAC flashing lights are activated in the flight deck, signalling a request from the cabin for an evacuation. Emergency power for the evacuation alert system is provided by emergency batteries located in the avionics bay.

1.6.10 Cabin Emergency Lighting

The aircraft is equipped with an emergency lighting system that can be manually controlled from the flight deck and the FAP. The EMER EXIT LT toggle switch in the flight deck has three positions: ON - emergency lights, the EXIT signs, and the floor escape path marking illuminates; OFF; and ARM - the cabin emergency lighting automatically illuminates if the aircraft normal electrical power fails or if the EVAC ON pushbutton is activated.

The EMER EXIT LT switch is normally in the armed position and it has a mechanical latch that protects against operation of the switch from the ARM or ON position. The FAP has an EMER pushbutton that, when pressed, illuminates the emergency lights, the EXIT signs and the floor escape path marking system. The EMER pushbutton has a protective cover to prevent accidental operation. The emergency lighting system components include eight EXIT lights, one located over each EXIT doorframe, nine EXIT signs located in the exit areas ceiling, 25 emergency ceiling lights over the aisles; and a floor escape path marking system. This system includes EXIT markers and low-intensity lights located close to each exit at floor level and below passenger seats and electroluminescent light strips that illuminate cabin aisles.

Eight emergency power supply units (EPSUs), installed in the ceiling at each exit area, energize all the EXIT light signs and the floor proximity lights. In addition, the aircraft escape slides are equipped with an integral lighting system. The slide lights automatically illuminate when the slide deploys. Slide lights are powered by the EPSUs.

1.6.11 Public Adress System

In accordance with JAR-OPS 1.695 (Subpart K), the aircraft is equipped with a PA system. The system was certified as per the requirements of the United Kingdom (UK) Civil Aviation Authority (CAA) Specification 15. In the event of aircraft electrical power failure to the PA system, emergency power for the PA system is supplied by two batteries located in the avionics bay.

1.6.12 Emergency Equipment

The cabin was equipped with portable emergency equipment in accordance with the applicable regulatory requirements. A description of this equipment and its location throughout the aircraft can be found in the diagram at Appendix D.

1.6.13 Automatic Flight System

The Airbus A340 is equipped with a flight management and guidance system (FMGS) that assists the crew with navigation, flight planning, and flight guidance in all modes of flight, including autoland. The pilots can interface with the system through the following two means:

• Via one of three multi-function control and display units (MCDUs) on the pedestal between the two pilots; the pilot uses this interface to input pre-planned route information that the FMGS uses to produce vertical, lateral, and speed profiles that the aircraft will fly. When the aircraft is being flown on these profiles, it is in managed mode; or
• Via the flight control unit (FCU) located in the centre of the glare shield between the two pilots. Pilots enter speed, heading, altitude, or vertical speed targets in the FCU. When engaged, the values entered into the FCU take priority, and the aircraft is said to be operated in selected mode.

To switch from managed to selected mode, the pilot will enter a desired target value in the appropriate window and pull the selector knob out. To return to managed mode, the pilot will push the selector knob in. Flight guidance is provided by the system through the autopilot, autothrust, and flight directors. Information is provided to the pilots from the FMGS through the two displays of the electronic flight information system (EFIS), the primary flight display (PFD), and the navigation display (ND). The mode of presentation of information is controllable through either of the EFIS control panels located on the left and right side of the glare shield. The flight mode annunciator (FMA), located on the top of both PFDs, indicates the status of the autoflight system.

During an ILS approach, the autopilot and/or flight director modes employed are G/S* (glideslope capture) and G/S (glideslope track) for vertical guidance and LOC* (localizer capture) and LOC (localizer track) for horizontal guidance.

The pilot engages these modes by selecting the APPR (approach) pushbutton on the FCU. Once this button is selected, the modes are engaged in sequence, provided all the conditions for mode engagement are met. Air France's procedure for engaging the APPR mode calls for the pilot to engage the LOC mode and evaluate G/S* before engaging the APPR mode to avoid the potential for a false G/S*.

In managed speed mode, the target indicated airspeed is variable during the approach. It is calculated by the FMGS using the "groundspeed mini" function, and is displayed on the PFD in magenta. "Groundspeed mini" is calculated by the FMGS to identify the minimum energy level the aircraft will have at touchdown (based on desired landing speed and reported tower wind, which is entered by the flight crew). The target indicated airspeed is continuously recalculated during the approach to keep the aircraft's speed at or above groundspeed mini. Groundspeed mini is not displayed to the crew; only the targeted indicated airspeed is shown on the PFD.

When autothrust is engaged in managed speed, it will maintain the target indicated airspeed. When autothrust is disengaged, the crew will maintain this target speed manually. Go-around mode is engaged by advancing at least one thrust lever to the take-off and go-around (TOGA) detent. Go-around mode combines the speed reference system (SRS) for vertical guidance and the GA TRK (go-around track) mode for lateral guidance.

The minimum height for autopilot disconnect during a Category I approach is 160 feet agl. The autopilot may be left engaged at heights lower than 160 feet on approach provided precautions specified in the flight crew operations manual (FCOM) for the Airbus A340-313 for conducting autoland on Category I approaches have been followed. Where these criteria have been met, but the crew elects to perform an automatic approach without autoland, Section 3.01.22 of the FCOM requires that the autopilot must be disengaged not later than at 80 feet agl.

There is no specific direction from Air France as to when to disconnect the autopilot while conducting a Category I approach. Air France pilots who were consulted during the investigation indicated that they prefer to disconnect the autopilot well above the decision height altitude on the approach to get a feel for the aircraft. Airbus makes no recommendation about when to disconnect the autopilot on approach, and although various pilots and operators have been canvassed to see if there is an overall preference, the responses showed no consistency. The Airbus operators canvassed during this investigation expressed a lot of confidence in the autoflight system and expected their pilots to leave the autopilot engaged as long as possible.

The standard method of disconnecting autothrust at landing is to move the thrust levers to the idle detent. In other flight phases, the standard method of disconnecting autothrust is to press the disconnect button on the thrust levers. When this method of disconnect is used, the thrust setting will change to match the current throttle lever setting. Therefore, the pilot should move the thrust lever to correspond to the current thrust setting (indicated by a white circle on the engine display) before pressing the disconnect button.

Airbus recommends that autothrust be used during approach and landing. However, if the pilot is going to perform the landing using manual thrust, the FCOM recommends disconnecting the autothrust by 1000 feet agl on final approach. The use of autothrust is approved with or without the autopilot or flight director in selected or managed mode and can be left armed throughout the flight. If autothrust is not deselected, it will disengage when the crew selects the thrust levers to the idle detent during the flare and re-engage if the crew selects the thrust levers to the TOGA detent. Air France does not specify a minimum height for disconnecting the autothrust.

1.6.14 Fuel Management and Monitoring

Two fuel control monitoring computers assist the crew in managing fuel load, fuel transfers, and other associated fuel tasks. The aircraft's fuel state is displayed to the crew through the ECAM fuel page. This page provides a schematic of the fuel system and provides the crew with the following information: fuel used by each engine and total fuel used; fuel available in each tank; total fuel available; aircraft gross weight and centre of gravity; and status of fuel valves and pumps.

The total fuel on board is also displayed on the ECAM engines page. Additional information is available from the fuel prediction page on the MCDUs, including predicted fuel at destination and selected alternate. Specifically, the information displayed relevant to this occurrence consists of the following:

• Line 1: Displays ETA and estimated fuel remaining at the primary destination.
• Line 2: Displays the same predictions for the selected alternate airport.
• Line 3: Displays the current fuel on board.
• Line 4: Displays the route reserve in quantity and as a percentage of trip fuel remaining. In flight, it displays this value as a percentage of remaining trip fuel from current position to destination (that is, provides an indication whether flight will be consuming route reserve to arrive at destination).
• Line 5: Displays the final fuel and time available for holding on arrival at the alternate airport.
• Line 6: Displays the fuel and time available for holding on arrival at destination (before having to divert).

Calculations are conducted using the selected alternate airport in the active flight plan. Modifications to the active alternate are made to a temporary flight plan, which can then be selected as the active flight plan.

1.6.15 Weather Radar

The Airbus A340 is equipped with two separate weather radar systems, only one of which is active at a time. The control panel for the radar is located on the pedestal between the two pilots and allows the selection of which radar system to use in addition to the specific settings for that system (gain, tilt, mode, ground suppression on or off, and predictive windshear on or off).

The weather radar returns are displayed on the ND. The range of the ND for each pilot can be adjusted independently using a control knob located on the glare shield. Following the occurrence, both the captain's and first officer's range selector knobs were found to be set to the 10 nm range, the lowest possible setting.

The depiction of weather on the ND is based upon the intensity of precipitation detected by the radar. The lowest intensity of precipitation (no precipitation) is shown in black (no image), with green and amber showing progressively more intense areas of precipitation. The highest intensity areas of precipitation (greater than 12 mm/hour) are shown in red. Areas of turbulence within zones of precipitation and within 40 nm of the aircraft are shown in magenta.

All aircraft weather radars only detect rain, moist hail, and turbulence associated with precipitation. They will not detect clouds, fog, wind, turbulence not associated with precipitation, snow, ice or hail with a diameter less than 3 cm, windshear not associated with precipitation, or lightning. Because of these limitations, in addition to limitations such as attenuation (where the radar is unable to detect moisture beyond a dense area of precipitation), the weather radar should only be considered as a tool to be used for weather avoidance.

1.6.16 Windshear Detection and Prediction

During the approach and landing phase, the aircraft's windshear detection system provides a warning of an actual windshear encounter from 1500 feet radar altitude to 50 feet radar altitude, provided the slats and flaps are set to at least CONF 1. When active, the system will generate a signal whenever the energy level (based on angle of attack) decreases below a threshold value. Once generated, this signal will trigger a visual alarm and an aural alarm. A WINDSHEAR message will appear in red on both PFDs for at least 15 seconds, and "Windshear" will be announced three times via the cockpit speakers.

The aircraft is also fitted with a predictive windshear system that provides warning of windshear ahead based on weather radar information. The system is active below 2300 feet radar altitude, although during the landing phase, all windshear warnings and alerts are suppressed below 50 feet radar altitude. If windshear is detected between 50 feet and 1500 feet, an alarm, alert, or advisory will be generated, depending on the aircraft's altitude and the distance from the aircraft to the area of suspected windshear. The specific indications associated with each are as follows:

• An alarm consists of a voice alarm indicating: "Go around windshear ahead," a "W/S ahead" indication in red on the PFD, and a windshear indication on the ND.
• An alert consists of a voice message indicating "Monitor radar display," a "W/S ahead" indication in amber on the PFD, and a windshear indication on the ND.
• An advisory consists solely of a windshear indication on the ND.

During the accident approach and landing, there were no indications of windshear generated by either the windshear detection or windshear prediction systems. The aircraft's ND provides the pilots with wind direction and speed information. This wind information is also recorded by the FDR. The wind is only recorded once every four seconds and is within ± 5 knots and ± 10°.

1.6.17 Aircraft Communications Addressing and Reporting System

Air France aircraft are equipped with a number of voice and data-link means of communicating with ground stations, including very high frequency (VHF) radio, high frequency (HF) radio, ACARS, and in some aircraft, including the occurrence aircraft, a satellite communication system.

The ACARS allows the transmission and receipt of data-link messages that are sent via VHF radio or satellite depending upon the aircraft's location and equipment. Information routinely exchanged through the ACARS includes weather information, passenger service information exchanged with the company, maintenance information sent to the company (automatically or manually), pre-departure clearances at some aerodromes, oceanic clearances, and ATIS information.

The crew interfaces with the ACARS through one of the MCDU displays. One option on the main menu is weather. Selecting the WEATHER button takes the user to the default weather request page, which allows the user to request METAR and TAF Short data for three stations. If the user wants information other than the METAR and TAF Short, the WEATHER TYPE button on this page is selected. This will take the user to a page where there are six options to request weather: METAR, TAF Short,^{Footnote 7} TAF Long, METAR + TAF Short (default on previous page), RCNI.NOTAMs (Air France's Notices to Airmen), and significant meteorological messages (SIGMETs). Selecting one of these buttons takes the user to a page where the selected product may be requested for up to three stations.

The ATIS may be requested through the ACARS. There is a note in the MANEX stating that obtaining the ATIS through data link does not relieve the crew of listening to the ATIS. The ATIS may be obtained through the PRE-FLIGHT, ENROUTE, or REQUEST pages. Different types of ATIS messages may be requested such as departure, en route, or arrival. If an arrival ATIS is requested, another option may be selected for an automatic update each time a new ATIS is issued.

1.6.18 Ground Spoilers

Six spoilers on each wing act as ground spoilers. They are armed by moving the spoiler handle up to the armed position. When armed, the spoilers will automatically deploy during a rejected take-off or during landing provided both of the main landing gears are compressed and all four engines are set to idle. If the spoilers are not armed, they will deploy when reverse thrust is selected on at least two symmetrical engines. Where only one main landing gear is compressed initially at touchdown, the ground spoilers will partially deploy to decrease lift and facilitate the compression of the second main landing gear.

1.6.19 Brake System and Antiskid

The aircraft is equipped with a Messier-Bugatti-Goodrich braking system. The eight main wheels are equipped with carbon, multi-disc brakes that can be actuated by either of two independent braking systems. The nose gear and centre gear wheels are not fitted with brakes. Normal braking is provided by the green hydraulic system. Manual braking (pedals) and automatic braking is available. Either braking mode is provided with antiskid brake modulation. Autobraking, if selected, is activated when two of three ground spoiler signals are received by the brake and steering control unit (BSCU). For manual braking, maximum braking is achieved with the brake pedals at full deflection.

1.6.20 Engine Controls

The four engine thrust levers are located on the centre pedestal between the two pilots. They move only when moved by a pilot; they do not move during autothrust operation. The thrust levers are moveable between idle thrust and take-off/go-around thrust, with four detents for specific settings: idle, climb, maximum continuous thrust, take-off/go-around. The thrust levers have a pushbutton that can be used to disconnect autothrust.

In front of the thrust levers, there are four thrust reverser levers, operated by moving the levers up and back. There is a detent for the idle reverse position. Moving the levers past this detent increases reverse thrust. The reverse thrust levers for engines 1 and 4 are interlocked and cannot be moved beyond the idle reverse detent unless the thrust reversers on both engines are fully deployed.

1.6.21 Rain Removal System

There are two systems to assist in clearing rain from the windshield of the Airbus A340 - windshield wipers and rain repellent - with controls for the captain's and first officer's systems on opposite sides of the overhead panel. The windshield wipers have two settings, slow and fast. On the fast position, the wipers are reported to be very noisy. When the wipers are turned off, they stow out of view.

The rain repellent system is designed for use in moderate to heavy rain. When either the captain's or first officer's rain repellent button is depressed, a measured amount of rain repellent is applied to that side of the windscreen. At the time of the accident, there was no specific procedure in place at Air France with respect to the use of rain repellent, with the exception of checking the fluid quantity and pressure during pre-flight preparation of the cockpit.

An informal survey among Airbus A340 pilots and operators on the use of rain repellent was conducted during the investigation. The diversity of opinion ranged from non-users to those who held a strong opinion that rain repellent provided a significant improvement over wipers and offered a considerable safety improvement in moderate to heavy rain. Among those who were non-users of rain repellent, many had little or no experience with its use.

1.7 Meteorological Information

1.7.1 General

On the day of the accident, the major weather influence in the Toronto area was a high pressure system extending from northern Hudson Bay, Canada, to eastern Kentucky, United States, and a low pressure system northeast of Québec, Quebec, Canada, associated with a weak surface trough extending along the St. Lawrence River and over southern Ontario.

Canadian aviation forecasts and reports relevant to this accident are disseminated by the Canadian Meteorological Aviation Centre - East (CMAC-E) of the Meteorological Service of Canada (MSC), Environment Canada. Weather forecasts and SIGMETs for eastern Canada, including the Ontario region and CYYZ, are prepared by the CMAC-E.

1.7.2 Graphic Area Forecasts

The graphic area forecasts (GFA) issued at 0000 and valid until 1200 showed no convective activity. The 0000 GFA did not provide an 1800 forecast.

The GFA issued shortly before 0600 and valid until 1800 indicated no convective activity. At 1800, it indicated scattered cumulonimbus (CB) with tops to 45 000 feet asl, with thunderstorms and visibilities of one statute mile (sm) in heavy rain and mist.

The GFA issued shortly before 1200 and valid until 0000 indicated scattered CB with tops to 45 000 feet asl, with thunderstorms and visibilities of 1 sm in heavy rain and mist. At 0000 (August 3), it also indicated scattered CB with tops to 45 000 feet asl, with thunderstorms and visibilities of 1 sm in heavy rain and mist.

The GFA issued shortly before 1800, two hours before the occurrence, indicated isolated CB with tops to 45 000 feet asl, with thunderstorms and visibilities of 1 sm in heavy rain and mist, and scattered towering cumulus with tops to 20 000 feet asl and visibilities of 6 sm in heavy rain showers and mist. At 0000 (August 3), it indicated scattered CB with tops to 45 000 feet asl, with thunderstorms and visibilities of 1 sm in heavy rain and mist.

The GFA issued from 0000 onwards was consistent in forecasting thunderstorms for the Toronto area with minimum conditions of thunderstorms, with visibilities of 1 sm in heavy rain and mist.

1.7.3 Aerodrome Forecasts

1.7.3.1 Toronto/Lester B. Pearson International Airport (CYYZ)

The following is a plain language version of the TAF that the flight crew obtained from Air France dispatch before departure:

Issued at 0539 valid from 0600 to 0600 (August 3); surface wind 280°T at 10 knots, visibility greater than 6 sm, scattered cloud at 4000 feet agl; from 1700 wind variable at 3 knots, visibility greater than 6 sm in light rain showers, broken cloud layer at 3000 feet agl; between 1700 and 2200 30 per cent probability of visibility reducing to 2 sm in thundershowers and moderate rain, broken cumulonimbus cloud layer at 2000 feet agl; starting at 2200 surface wind 300°T at 8 knots, visibility greater than 6 sm, broken cloud layer at 3000 feet agl; next forecast by 0900.

The flight crew did not obtain updated CYYZ TAF information before take-off or while en route.

The following is the last CYYZ TAF issued before the aircraft landed:

Issued at 1851 valid from 1800 to 1800 (August 3); surface wind 300°T at 8 knots, visibility greater than 6 sm, broken cloud layer at 4000 feet agl; temporarily between 1800 and 2000, visibility 2 sm in thunderstorms and rain, broken cumulonimbus cloud layer at 2000 feet agl; starting at 2000, surface wind 320°T at 10 knots, visibility greater than 6 sm, broken cloud layer at 4000 feet agl; temporarily between 2000 and 2400, visibility 5 sm in light rain showers and mist; between 2000 and 2400 30 per cent probability of visibility reducing to 2 sm in thunderstorms and rain, broken cumulonimbus cloud layer at 2000 feet agl; starting at 0000, wind variable at 3 knots, visibility greater than 6 sm, broken cloud layer at 3000 feet agl; between 0800 and 1200 30 per cent probability of visibility 1 sm in mist; next forecast by 2100.

1.7.3.2 Niagara Falls International Airport, New York (KIAG)

The AFR358 flight crew received the following TAF for KIAG in the pre-flight weather package:

Issued at 0520 valid from 0600 to 0600 (August 3); surface wind 240°T at 5 knots, visibility 5 sm in mist, few clouds at 15 000 feet agl; temporarily surface wind 060°T at 10 knots, visibility 3 sm in mist, scattered clouds at 1500 feet agl; starting at 1200 surface wind 230°T at 5 knots, visibility greater than 6 sm, scattered cloud at 25 000 feet agl; starting at 1500 surface wind 250°T at 12 knots, visibility greater than 6 sm in haze, scattered cloud at 4000 feet agl; starting at 2000 surface wind 250°T at 12 knots, visibility greater than 6 sm in haze, broken cumulonimbus cloud layer at 4000 feet agl; starting at 0100 surface wind 230°T at 6 knots, visibility greater than 6 sm, scattered cloud at 4000 feet agl.

The flight crew did not obtain updated KIAG TAF information before take-off or en route.

1.7.3.3 Ottawa/Macdonald-Cartier International Airport (CYOW)

The AFR358 flight crew received the following TAF for CYOW in the pre-flight weather package:

Issued at 0539 valid from 0600 to 0600 (August 3); surface wind variable at 3 knots, visibility greater than 6 sm, scattered cloud at 3000 feet agl; starting at 0700 surface wind variable at 3 knots, visibility 6 sm in mist, scattered cloud at 800 feet agl, temporarily between 0700 and 1100 visibility 2 sm in mist, broken cloud layer at 800 feet agl; starting at 1100 surface wind 260°T at 8 knots, visibility greater than 6 sm, scattered cloud at 3000 feet agl, temporarily between 1100 and 1300 visibility 5 sm in mist, broken cloud layer at 1200 feet agl; starting at 1900 surface wind 270°T at 12 knots, visibility greater than 6 sm in light rain showers, broken cloud layer at 4000 feet agl, 30 per cent probability from 1900 to 2200 visibility 2 sm in rain from thunderstorms, cumulonimbus cloud broken layer at 2000 feet agl; starting at 0000 surface wind variable at 3 knots, visibility greater than 6 sm, scattered cloud at 3000 feet agl; next forecast by 0900.

The flight crew did not obtain updated CYOW TAF information before take-off or en route.

1.7.4 Aviation Routine Weather Reports

1.7.4.1 Toronto/Lester B. Pearson International Airport (CYYZ)

The AFR358 flight crew received the following METAR for CYYZ in their pre-flight weather package:

Issued at 0800, winds 350°T at 2 knots, visibility 15 sm, sky clear, temperature 22°C, dew point 19°C, altimeter 30.03 in. Hg, remarks sea level pressure 1016.6 hectopascals (hPa).

The AFR358 flight crew received the following METARs for CYYZ via the ACARS while in flight:

Issued at 1400, winds 360°T at 4 knots, visibility 15 sm, few clouds at 3500 feet agl, few clouds at 26 000 feet agl, temperature 28°C, dew point 19°C, altimeter 30.07 in. Hg, remarks cumulus 1/8, cirrus 1/8, sea level pressure 1017.9 hPa.

Issued at 1600, winds 330°T at 3 knots, visibility 15 sm, scattered clouds at 4500 feet agl, scattered clouds at 12 000 feet agl, scattered clouds at 26 000 feet agl, temperature 30°C, dew point 20°C, altimeter 30.05 in. Hg, remarks cumulus 3/8, altocumulus 1/8, cirrus 1/8, sea level pressure 1017.3 hPa.

Issued at 1800, winds 120°T at 8 knots, visibility 8 sm in light rain showers from thunderstorms, scattered towering cumulus clouds at 3500 feet agl, broken cloud layer at 9000 feet agl, temperature 23°C, dew point 22°C, altimeter 30.03 in. Hg, remarks towering cumulus 3/8, altocumulus 3/8, cumulonimbus associated, sea level pressure 1016.7 hPa.

Issued at 1900, winds 220°T at 7 knots, visibility 4 sm in heavy rain showers from thunderstorm, broken cloud layer at 5000 feet agl, broken cloud layer at 8000 feet agl, temperature 24°C, dew point 23°C, altimeter 30.03 in. Hg, remarks towering cumulus 6/8, altocumulus 1/8, cumulonimbus associated, sea level pressure 1016.8 hPa.

A METAR was issued at 2000, two minutes before the accident. The weather was reported as follows: winds 290°T at 11 knots, visibility 4 sm in heavy rain and thunderstorms, broken towering cumulus cloud layer at 5100 feet agl, broken cloud layer at 14 000 feet agl, temperature 23°C, dew point 22°C, altimeter 30.02 in. Hg, remarks towering cumulus 6/8, altocumulus 1/8, cumulonimbus associated, cloud-to-cloud lightning visible to the southwest and northwest, sea level pressure 1016.4 hPa. The crew did not get this METAR because they were on final approach at the time.

A special weather observation (SPECI) was issued at 2004, two minutes after the accident. The weather was reported as follows: winds 340°T at 24 knots gusting to 33 knots, visibility 1¼ sm in heavy rain and thunderstorms, scattered cloud at 1500 feet agl, overcast cloud layer at 4500 feet agl, with towering cumulus clouds and cumulonimbus clouds associated.

1.7.4.2 Ottawa/Macdonald-Cartier International Airport (CYOW)

The AFR358 flight crew received the following METAR for CYOW in their pre-flight weather package:

Issued at 0800, winds 250°T at 4 knots, visibility 10 sm, sky clear, temperature 18°C, dew point 18°C, altimeter 29.97 in. Hg, remarks sea level pressure 1015.0 hPa.

The AFR358 flight crew received the following METARs for CYOW via the ACARS while in flight:

Issued at 1800, winds 270°T at 10 knots gusting to 16 knots, visibility 15 sm, few clouds at 6000 feet agl, scattered clouds at 14 000 feet agl, temperature 32°C, dew point 17°C, altimeter 29.91 in. Hg, remarks cumulus 2/8, altocumulus 1/8, sea level pressure 1012.9 hPa.

Issued at 1900, winds 280°T at 11 knots, visibility 15 sm, few clouds at 6000 feet agl, scattered clouds at 12 000 feet agl, temperature 33°C, dew point 17°C, altimeter 29.90 in. Hg, remarks cumulus 2/8, altocumulus 1/8, sea level pressure 1012.3 hPa.

1.7.4.3 Niagara Falls International Airport, New York (KIAG)

The AFR358 flight crew received the following METAR for KIAG in their pre-flight weather package:

Issued at 0744, winds calm, visibility 1¼ sm in mist, ceiling clear, temperature 21°C, dew point 20°C, altimeter 30.03 in. Hg.

The AFR358 flight crew received the following METARs for KIAG via the ACARS while in flight:

Issued at 1353, winds 300°T at 6 knots, visibility 10 sm, few clouds at 1500 feet agl, scattered clouds at 15 000 feet agl, temperature 27°C, dew point 19°C, altimeter 30.07 in. Hg.

Issued at 1753, winds 330°T at 9 knots, visibility 10 sm, few clouds at 3500 feet agl, scattered clouds at 4000 feet agl, scattered clouds at 14 000 feet agl, broken cloud layer at 20 000 feet agl, broken cloud layer at 25 000 feet agl, temperature 31°C, dew point 18°C, altimeter 30.04 in. Hg, remarks occasional lightning in the distance to the northwest, cumulonimbus in the distance to the northwest to north moving southeast.

The following KIAG METARs were issued around the time of the accident:

Issued at 1918 winds 200°T at 9 knots, visibility 10 sm in light rain from thunderstorms, scattered cumulonimbus clouds at 6000 feet agl, broken cloud layer at 9500 feet agl, temperature 28°C, dew point 21°C, altimeter 30.03 in. Hg, remarks occasional cloud-to-cloud and cloud-to-ground lightning in the southwest to northwest, thunderstorms in the southwest to northwest moving south.

Issued at 1953 winds 220°T at 14 knots, visibility 10 sm in light rain from thunderstorms, few cumulonimbus clouds at 3600 feet agl, broken cloud layer at 4900 feet agl, broken cloud layer at 10 000 feet agl, temperature 26°C, dew point 21°C, altimeter 30.03 in. Hg, remarks frequent cloud-to-cloud and cloud-to-ground lightning in the southeast to southwest, thunderstorms in the southeast to southwest moving south.

1.7.5 Significant Meteorological Information

SIGMET K1 issued at 1913, valid from 1915 to 2315: A band of thunderstorms has been observed 20 nm either side of a line from 20 nm west of Buffalo, New York (latitude 42°56′ N, longitude 079°11′ W) to 50 nm southwest of Muskoka, Ontario (latitude 44°22′ N, longitude 080°07′ W). The broken line of thunderstorms was observed on radar, satellite pictures, and lightning detectors. Maximum tops are 44 000 feet asl. The line is quasi-stationary; weakening near 0000.

SIGMET K2 issued at 2204, valid 2205 to 0205: A band of thunderstorms has been observed 20 nm either side of a line from 30 nm west of Buffalo, New York (latitude 42°56′ N, longitude 079°24′ W) to 40 nm northwest of Toronto (latitude 44°06′ N, longitude 080°03′ W). The broken line of thunderstorms is observed on radar, satellite pictures, and lightning detectors. Maximum tops are 44 000 feet asl. The line is quasi-stationary; weakening near 0000.

SIGMET K2 cancelled at 2355: Thunderstorms are now isolated and out of the region.

1.7.6 Toronto/Lester B. Pearson International Airport (CYYZ) Wind Information

Wind information displayed in the CYYZ control tower is shown on the wind and altimeter digital display system (WADDS). This system receives wind information from an anemometer, measures static pressure, calculates an altimeter setting, and transmits this information to digital information systems and local display units. There are two sources for wind information. The north source is near the west end of Runway 05; these wind data are provided to aircraft using the north runway. The south source is at the NAV CANADA observation site at the mid-point and south of Runway 24L; these wind data are provided to users of the south runways. In the event that one source is unavailable, the other may be used. The wind information is displayed on WADDS units at the north and south ground and the north and south tower controller positions. Also available is a display, called the extended computer display system (EXCDS), which receives a feed and shows both north and south wind. Most controllers refer to the EXCDS display unit for wind information.

The south tower wind indicating system had become unserviceable at approximately 1954, just eight minutes before the landing of AFR358. The controllers advised landing aircraft that the tower winds were not available, but they continued to provide wind information supplied by landing aircraft. They did not provide wind information from the north tower display as directed by Section 2.7.3 of the Toronto tower procedures. Reports of poor braking action were passed to the tower by two Canadian Regional Jet aircraft landing ahead of AFR358. The tower relayed the reports to AFR358.

Coincident with lightning at 1954, the south field WADDS unit stopped functioning. The anemometer at the south field observation site continued to provide wind data for use in METARs. Wind information from the anemometer processor display unit (PDU) at the NAV CANADA observation site is sent to the WADDS unit located at the backup transmitter and, finally, to the WADDS displays at the control tower and the contingency tower. The south field WADDS unit required a reset at the site by a technician, which was done at 2300.

Controllers continued to provide wind information to landing aircraft from information provided by landing aircraft. There is no backup wind-indicating system available in the control tower in the event that both the north and south wind information data cannot be displayed.

A separate anemometer at the official meteorological observation site provides wind speed and direction to the Greater Toronto Airport Authority (GTAA) operations facility for purposes other than air traffic control. The GTAA anemometer is of the same type and is installed, calibrated, and maintained to the same specifications as the official anemometer.

Runway 24L was equipped with a lighted windsock on the left side of the runway, 500 feet past the threshold and 200 feet to the left of the runway edge. There is an additional lighted windsock located adjacent to the threshold and on the north side of Runway 06R.

1.7.7 Recorded Rainfall Rates

The following table was compiled from rainfall rates taken at the NAV CANADA weather observation site at CYYZ.

Start Time for Collection Period	Length of Collection Period (minutes)	Accumulation over Period (mm)	Average Accumulation Rate (mm/min)
1621	46	0.2	0.004
1707	11	7.8	0.709
1718	37	1.0	0.027
1755	6	2.2	0.367
1801	9	0.2	0.022
1855	45	2.0	0.044
1902	7	0.6	0.086
1955	13	21.0	1.615

1.7.8 Thunderstorms

Radar data from a weather radar operated by the MSC at King City, Ontario, approximately 33 km north of Runway 24L, was used to analyse the thunderstorm activity. This is the closest weather radar to CYYZ and can scan to as low as 280 m above Runway 24L. The analysis revealed that there was a downburst approximately 8 km to the northeast of Runway 24L at the time of the accident. The winds created by the downburst were analysed using both Doppler and reflective data from the radar as well as wind information from anemometers and other standard meteorological data. The conditions at the time were not characteristic of microburst. While updrafts and downdrafts are associated with downbursts at the surface, the boundary condition precluded a significant upward wind component at the level of the runway.

1.7.9 Lightning

There was significant lightning activity in the vicinity of the runway late on the approach. An analysis of the cloud-to-ground lightning strikes that could have intersected the path of the aircraft was conducted using recorded lighting strike information. The analysis showed that, at approximately 2000:17, within a period of approximately one second, there were six cloud-to-ground lightning strikes in the area of the threshold of Runway 24L. At 2001:20, when the aircraft was approximately 400 feet agl, there was a group of five cloud-to-ground strikes abeam the touchdown zone, to the left of Runway 24L. At approximately 2001:49 (within a one-second period), five seconds before touchdown, there were nine cloud-to-ground lightning strikes off the end of the runway. These numbers are likely a conservative estimate of the number of lightning strikes visible to the crew, since they only account for cloud-to-ground lightning that could have intersected the approach path.

1.7.10 Red Alerts

The GTAA has a procedure to protect ground personnel from the hazards associated with lightning activity. When lightning detectors record a predetermined number of lightning hits within a specific radius of the airport, the GTAA issues a red alert. Individual operators at the airport may, at their option, respond to a red alert by discontinuing their ground operations. A red alert had been issued by the GTAA at 1620, more than three hours before the arrival of AFR358. Because of the red alert, at the time of the occurrence, there were a large number of aircraft parked around the airport, unable to proceed to their gates. A red alert is not an airport closure.

1.7.11 Weather Conditions on the Ground

Several witnesses provided information about the weather at the time of the accident at locations on or near the airport. They indicated locally very heavy rain, hail, and strong gusty winds, particularly in the area to the northwest of the aerodrome, northwest of Runway 23, approximately two miles northwest of Runway 24L. There was heavy rain and a wind shift on the terminal two ramp at the time AFR358 landed. These observations were generally consistent with the forecast and aftercast weather produced by Environment Canada.

The following series of photos, taken by a bystander located on the ramp near gate C39 looking toward the threshold of Runway 24L, provides a good indication of how the weather at the airport was changing at the time of the accident. (Note: The time stamps on the photos are one hour behind and should read 4:00; 4:02, and 4:04.)

Photo 1 was taken two minutes before the arrival of AFR358. It is raining at the time and the visibility is good with a number of aircraft visible along the flight line.

Photo 2, taken two minutes later, shows AFR358 on final approach approximately 230 feet agl. The camera is aimed slightly to the right from Photo 1 and the photo shows that the rain is heavier and the visibility is decreasing.

Photo 3, taken about two minutes later, shows how the visibility decreased to the east as the storm intensified. There are fewer aircraft visible along the flight line.

1.8 Aids to Navigation

1.8.1 Air Traffic Control Radar

The radar system in use in the Toronto ACC was procured as part of the radar modernization program (RAMP) in the late 1980s and early 1990s. It employs monopulse technology to measure azimuth accuracy. The manufacturer is Raytheon Canada Limited, and the model number is RYC8405. The positional accuracy of the radar is 1/64 nm in range and the azimuth accuracy near the threshold of the runways is approximately one sigma error 0.07°, and at 50 nm is three sigma error 0.15°.

The displays used in the ACC, including the Terminal Speciality, are called radar situation displays (RSit) and they are part of the radar data processing system (RDPS). In the tower, controllers use a display called the NAV CANADA auxiliary radar display system (NARDS). Both RSit and NARDS were produced by NAV CANADA.

The primary surveillance radar (PSR) weather channel used by the Toronto ACC is not a true weather radar because it uses a vertical fan beam instead of a pencil beam. The detected rainfall intensity, therefore, is an integration of precipitation for all altitudes. The detected intensity depends on the height and intensity of the weather system. The ground-clutter level also affects the filter used and, therefore, affects the intensity of the detected precipitation.

Advanced weather displays for controller tactical use are not currently in use in North America. A previous safety communication, Safety Advisory A020052-1, dated 09 September 2002, from the TSB to NAV CANADA, suggested that NAV CANADA might wish to consider providing Doppler radar to certain control positions to improve controller awareness of hazardous weather conditions. NAV CANADA replied that such equipment is usually provided only to meteorologists and that extensive training would be required for controllers to make correct use of Doppler weather information. However, NAV CANADA uses data from the Canadian Lightning Detection Network (CLDN) to provide an overlay on displays so that controllers may be aware of the presence of thunderstorms. Lightning strikes are displayed within one second of the occurrence and are updated each minute (see Figure 3). A report published in The Journal of Air Traffic Control, dated April-June 2005 and entitled "Advanced Weather Displays for TRACON (terminal radar approach control) Controllers,"^{Footnote 8} indicated that simulations providing controllers with advanced weather information might prove beneficial for increasing traffic throughput. However, the report indicated that more research is required to determine what types of information might be of most benefit to controllers and what the optimal display of such information might be.

The RSit displays weather for the controller in two levels. Level 1 is for low-intensity weather and is set at 23 dB above noise level. In areas of no ground clutter, the intensity is about 4 to 6 mm/hour of rainfall rate. Level 2 is for higher-intensity weather and is set at 32 dB above noise level. In areas of no ground clutter, the intensity is about 10 mm/hour of rainfall rate or higher.

Weather intensity information is highly stylized and is displayed^{Footnote 9} to the controller as shown in Figure 3. Information on weather movement is not indicated on the display and any interpretation is based solely on the observations of the controller. As AFR358 is on final approach to land, an area of level 2 intensity is depicted on the upper left corner of the graphic. The remaining areas are level 1.

1.8.2 Runway 24L Instrument Approach

The AFR358 crew flew the ILS/DME (distance measuring equipment) 24L approach for Runway 24L (see Appendix A). Simultaneous approaches are authorized on runways 24L and 23.

The published decision height (DH) for the ILS/DME 24L approach is 797 feet asl (250 feet agl); Air France procedures use 800 feet asl. The advisory visibility and runway visual range (RVR) value to conduct the approach is 1 sm or 5000 feet RVR. These visibility values are limiting (not advisory) according to Air France procedures.

A calibration check of the ILS for Runway 24L was carried out by NAV CANADA on 04 August 2005. The check found the glideslope to be within limits, with a measured angle of 2.9976°. The localizer was not checked because it was on the same power grid as the damaged runway and approach lights. It was determined that there would be a risk if power was restored near the crash site.

1.9 Communications

1.9.1 General

Overall, communications during the occurrence flight were reasonable and normal. Communications between the flight crew and the chief purser and within the cabin crew before and throughout the emergency evacuation were effective and in keeping with the principles of crew resource management (CRM).

The following sections highlight areas where external (between the flight crew and other agencies) and internal (among crew members) communications appeared to be ambiguous or incomplete. Additional detail on these events is included elsewhere in the report.

1.9.2 External Communication

At 1444 (and at several other times), the crew members requested weather for their destination and possible alternate airports. Because of the type of request submitted, they did not receive the TAF information for these airports.

At 1753, the station agent in Toronto sent an ACARS message to the flight, which included gate information. Information concerning the red alert was not passed to the aircraft because it was considered by all parties to be a ground operations issue.

At 1913, AFR358 inquired if ATC had information about movement of the weather system. The crew believed that it was moving from north to south. ATC advised that the weather seemed to be moving east.

At 1920, the crew was advised by ATC to expect a hold at AMERT and to check if they had this in their navigation system. A holding clearance was not issued; however, at 1922, AFR358 advised ATC that they were entering the hold. They were given vectors instead.

At 1923, AFR358 requested an expected further clearance (EFC) time from ATC, normally part of a holding clearance. They were given an EFC of 1950. At 1940, the PNF asked ATC if the weather at CYYZ was worsening. The controller did not provide weather information, but instead advised that they were now able to send aircraft into CYYZ. The flight crew members asked to be kept advised about the ongoing conditions because they may have to divert if there were additional delays.

At 1944, the crew asked the controller to keep them advised of any worsening weather, and the controller indicated that he would keep them informed. The crew remained on this controller's frequency until 1951. No further update on the weather was provided. (See Section 1.8.1, Air Traffic Control Radar, for the weather information available to controllers.)

1.9.3 Internal Communication

At 1909, the PF briefed the PNF on the anticipated arrival (WASIE 2 for approach to Runway 05). The briefing for Runway 05 contained three errors that were not detected by the PNF. At 1936, the PF began an approach briefing for the ILS/DME 24L approach. This lasted until 1940, with several operational interruptions. The briefing did not include runway length or a missed approach procedure. However, non-standard missed approach options were discussed later during the approach. The length of Runway 24L was not briefed or discussed until two minutes before landing. At 1959, the pilots verbalized the runway length correctly (2743 m). During landing roll-out, two required calls by the PNF were not made: "Spoilers" and "Reverse verts" (reversers green).

1.10 Aerodrome Information

1.10.1 General

CYYZ is in the city of Toronto. The airport is operated under the authority of TC issued Airport Certificate 5151-1-157. The certificate was issued on 28 November 1996 to the airport operator, the GTAA. The GTAA is a private, not-for-profit corporation. CYYZ is the busiest airport in Canada, measured by passenger movements.

CYYZ is governed by Section 302 of the CARs. As such, CYYZ is required to operate in compliance with the standards set out in Aerodrome Standards and Recommended Practices (TP 312E), a manual published by TC in effect on the date of the airport certificate.

The airport was certified for day and night visual flight rules (VFR) and instrument flight rules (IFR) conditions. It has five runways, all hot-mix asphalt (HMA) hard-paved, as follows:

Runway 05/23 is 11 120 feet by 200 feet (3389 m by 61 m);
Runway 06L/24R is 9697 feet by 200 feet (2956 m by 61 m);
Runway 06R/24L is 9000 feet by 200 feet (2743 m by 61 m);
Runway 15R/33L is 9088 feet by 200 feet (2770 m by 61 m); and
Runway 15L/33R is 11 050 feet by 200 feet (3368 m by 61 m).

The NAV CANADA contract aviation weather reporting station is located approximately 4000 feet southwest of the threshold and 800 feet to the left (southeast) of Runway 24L. This site contains all the instruments necessary for the official observer to prepare METARs, including an anemometer and tipping bucket rain gauge.

1.10.2 Airport Closure

The airport operator is responsible for closing an airport or any part of an airport's infrastructure or manoeuvring area. The GTAA has well-established procedures (Chapter 2, Winter Operations) for closure of a runway in specified conditions including ice, snow, and nil braking. Also, the GTAA closes runways that are obstructed by any known obstacle. The GTAA does not close runways or the airport in the circumstances of summer weather including wind, rain, or lightning. Airports in Canada, the United States, and France were consulted and all indicated that they have no procedures in place to close an airport because of wind, rain, or thunderstorms.

During the course of the investigation, it was determined that a perception existed among both the occurrence pilots and other pilots that airports could be closed if weather conditions were too severe to allow approaches and landings to be conducted safely. In this respect, the air traffic controller is only responsible to ensure that the runway to be used by a departing or arriving aircraft is free, or will be free, of all known obstacles including vehicles, equipment, and personnel before departing aircraft commence the take-off or the landing aircraft crosses the runway threshold. ATC may restrict the flow of aircraft into a particular airport due to weather conditions, but the ultimate decision to conduct an approach or landing rests with the pilot.

1.10.3 Use of Runway 24L

The runway used for landing had changed several times over the course of the afternoon. At the time of the occurrence, Runway 24L was in use because other aircraft had been refusing Runway 23 because of the proximity of storms on that approach, and Runway 24R was not available because the ILS had been struck by lightning and had become unserviceable at approximately 1856. The ILS for Runway 24R was checked serviceable at 1944, although there was no indication that the tower controllers were aware of this. AFR358 had been told by the Simcoe ATC at 1933 to expect Runway 24L and was given vectors for that runway. Furthermore, because a number of preceding aircraft were all cleared for an approach on Runway 24L, no action had been taken to change operations to Runway 24R at the time of the occurrence. Runway 23 was active for departures, but there were no departures taking place since ramp and gate operations ceased at the main terminals due to the red alert, and there were no general aviation departures taking place. Some of the facilities supporting the other ILS approaches had been affected by lightning strikes and were unserviceable at various times during the hours preceding the accident.

1.10.4 Runway 24L Physical Description

According to TP 312E, Runway 24L is a Code 4 runway. A Code 4 runway is defined in TP 312E as one whose length is in excess of 2400 m. Its width must be a minimum of 45 m for Category D aircraft, and 60 m for Category E aircraft.^{Footnote 10} This runway was newly constructed and certified for use in October 2002. The entire surface consisted of HMA. The bearings for Runway 24L are 227°T/237°M. The runway is 9000 feet (2743 m) long by 200 feet (61 m) wide and is not grooved. The take-off run available (TORA) is 9000 feet, take-off distance available (TODA)^{Footnote 11} is 10 000 feet, accelerate-stop distance available (ASDA) is 9000 feet, and the landing distance available is 9000 feet.

The runway has an asphalt blast pad at each end. They are 100 feet (30 m) long and cover the full runway width, marked by chevrons. They are not included in the declared distances.

Engineering drawings indicate that the longitudinal slope for Runway 24L is 0.0 per cent for the first 1115 feet (340 m). It then slopes down at a gradient of 0.0686 per cent for the next 2963 feet (903 m) and increases further to 0.40 per cent for the last 4922 feet (1500 m). The total elevation change is 21.65 feet (6.6 m) down in the length of the runway based on centreline elevations. Runway 24L has an overall gradient of minus 0.24 per cent. These gradients fall within established requirements. The Air France approach charts for CYYZ indicate that Runway 24L has a -0.1 per cent slope.

Engineering drawings indicate that a transverse slope of 1.5 per cent away from the centreline on both sides is typical. This also falls within established requirements. Runway construction also included storm drains. A survey conducted after the accident did not identify any deviations in slope from the engineering drawings. The runway was not observed in a wet or flooded condition.

1.10.5 Runway 24L Lighting and Markings

The approach lighting for Runway 24L is a simplified short approach light system (SSALS), which is a high-intensity approach lighting system to provide a visual landing path for landing aircraft.

Runway 24L was equipped with a precision approach path indicator (PAPI), adjusted for an eye-to-wheel height of 45 feet. The design angle of the beam projection is 3° and is required to conform as closely as possible to the angle of the ILS glide path. The PAPI consists of four light units on the left side of the runway in the form of a horizontal bar. The aircraft is on slope if the two units nearest the runway show red and the two units furthest from the runway show white; the aircraft is too high if all units show white, and too low if all units show red. It was reported that, when the aircraft was on short final, the PAPI was indicating 3 white and 1 red. This indication translates into a threshold crossing height of between 31 to 40 feet above the glide path.

Runway 24L was equipped with high-intensity runway edge lights, uniformly spaced at 200-foot intervals, with five variable intensity settings. At the time of the occurrence, the runway edge lights were on setting 5, the maximum setting. The runway is equipped with centreline runway lights. The lights are white for the first 6000 feet of runway, alternate red and white for the next 2000 feet, and red for the last 1000 feet. Runway 24L is also equipped with rapid exit taxiway lights.

Runway 24L had white runway markings consistent with an instrument approach runway of over 5000 feet in length. The runway markings consisted of the following:

• threshold markings - a series of vertical bars marking the threshold;
  
• runway indication markings, consisting of the runway number;
  
• touchdown zone markings, consisting of repeating series of vertical bars either side of the centreline, every 500 feet within the first 3000 feet of the runway;
  
• aiming point markings at 1500 feet from the threshold; and
  
• centreline markings - a dashed line indicating the centreline of the runway.

All of the relevant markings and lighting on Runway 24L met the standards for runway marking and lighting contained in Chapter 5 of TP 312E.

To assess the distance of the aircraft from the threshold, the pilot would need to count the touchdown zone markings as the aircraft went by. The aircraft's orientation on the runway may be assessed using centreline markings, centreline lighting, runway edges, and runway edge lights. The runway was not equipped with distance-remaining signage, nor was it required to be by Canadian regulations or International Civil Aviation Organization (ICAO) standards.

1.10.6 Water-Contaminated Runways

The lack of runway condition information in heavy precipitation is a safety issue; however, there is no consensus as to how reports of braking action from preceding aircraft are to be interpreted by following aircraft. This is especially the case if the preceding aircraft is relatively small compared to the following aircraft. In this accident, the braking action reports passed to and acknowledged by AFR358 were generated by regional jets. Few, if any, airports provide information on runway water depth. However, some airports have adopted the practice of using preferential runway systems whereby, under wet conditions, a change is made to use longer runways or runways having a lesser crosswind component.

The following information was obtained from the ICAO Airport Services Manual (Doc 9137), Part 2, Pavement Surface Conditions:

2.1.10 There has been some speculation on whether measuring water depth could perhaps replace measuring runway friction. To this end, a study was undertaken to ascertain a list of requirements to be met by such measuring devices. [. . .] Although possible [to design], it would not be practical to develop a device that could meet all of the [. . .] requirements; it is preferable to develop programmes aimed at improving the surface texture and drainage of runways rather than measuring the water depth. [. . .] Even assuming that a device meeting [all of the] requirements [was to be] developed, another big difficulty appears to be the number and location of devices needed for a runway. [At the time of writing], it has been concluded that standardization of water depth measuring devices with the object of measuring runway friction is not practical.

Work continues in this area.

1.10.7 Hydroplaning

Hydroplaning is a phenomenon whereby the aircraft tires are separated from the pavement by a thin fluid film and friction coefficients become almost negligible. During hydroplaning, a buildup of hydrodynamic pressure between the tire and flooded runway occurs at nine times the square root of the tire pressure. When this hydrodynamic pressure exceeds the tire-pavement bearing pressure, a wedge of water penetrates the tire contact area and the tire footprint is partially or totally detached from the pavement surface. Under total dynamic hydroplaning conditions, tire friction capability is reduced to near zero because of the inability of the fluid to support significant shear forces. There was no evidence (marks on the runway or skidding or rubber reversion of the tires) that hydroplaning occurred during the landing rollout.

1.10.8 Runway Grooving

Cutting or forming grooves in existing or new pavement is a proven and effective technique for improving the drainage of some runways and providing skid resistance and preventing hydroplaning during wet weather. Test results demonstrated that, on similarly wetted grooved runways, the transverse runway grooves produced substantially greater aircraft braking friction levels than were shown by the wetted ungrooved surface data. The data also suggest that the effects of tire tread wear are secondary to the greatly enhanced tire/pavement water drainage capability available on grooved runways. However, in severe rainfall conditions, such as were present at the time of landing, a grooved runway may not make a significant difference to the stopping distance of an aircraft. Runway 24L was not grooved.

In Canada, only four runways have been grooved. This reflects a policy to employ grooving only where an unusual drainage problem exists. As well, grooving allows accumulation of ice and snow in the grooves, which can lead to runway deterioration and the creation of foreign objects on the runway.

1.10.9 Runway Friction

It is essential that the surface of a paved runway be constructed so as to provide good friction characteristics when the runway is wet. Adequate runway friction characteristics are required for aircraft deceleration, directional control, and wheel spin-up at touchdown. Serious reductions of friction coefficients can result from rubber deposits, especially when the runway is wet.

The field maintenance department of the GTAA has a program in place to take regular runway friction measurements. For Runway 24L, the most recent measurement before the accident was on 03 June 2005. The results indicated that, for Runway 24L, the average reading for the first third of the runway was 0.75, the second third was 0.67, and the last third was 0.75. Section 9.4 of TP 312E requires that corrective maintenance action be programmed when the average coefficient of friction for the entire runway falls below 0.60 or falls below 0.40 for any 100 m section.

A friction measurement for Runway 24L was taken on 09 August 2005, seven days after the accident; the runway had not been used since the accident. Standard measurements were made in the wheel-path area of the runway, approximately 3 m left and right of centreline. Additional full-length friction measurement tests were conducted at 5 m and 10 m left and right offsets to further define the surface characteristics of the runway. The results then indicated that, at 3 m left and right of centreline, the average reading for the first third of the runway was 0.78, the second third was 0.82, and the last third was 0.75. In the first third, the lowest reading for 100 m was 0.53, and in the last third, there were two readings of 0.59. These readings were well above levels requiring maintenance action, and the readings taken at 5 m and 10 m from the centreline were consecutively higher.

1.10.10 Runway Certification Requirements

TC's TP 312E serves as the authoritative document for airport specifications, including physical characteristics, obstacle limitations surfaces, lighting, markers, marking, and signs. TP 312E is written in accordance with Annex 14 to the Convention on International Civil Aviation. It uses the ICAO phraseology of "standard"^{Footnote 12} or "recommended practice."

Chapter 3 of TP 312E describes the standards and recommended practices for the physical characteristics of runways. Section 3.1.6 stipulates that "a runway and any associated stopways shall be included in a strip." A runway strip is defined as an area about the runway intended to reduce the risk of damage to aircraft running off a runway and to protect aircraft flying over it during take-off or landing. Subsection 3.1.6.2 indicates that the strip must extend a minimum of 200 feet (60 m) beyond the end of the runway with a longitudinal slope not to exceed 1.5 per cent. The width of the strip must be a minimum of 500 feet (150 m) on each side of the centreline of the runway and its extended centreline throughout the length of the strip.

Beyond the end of Runway 24L, the asphalt blast pad extends for the first 100 feet (30 m) followed by a downward sloping grassy area of approximately 1.5 per cent containing the approach light standards for the reciprocal Runway 06R for the remaining 100 feet (30 m). This area meets the standards in TP 312E.

Section 3.1.7 of TP 312E recommends that a runway end safety area (RESA) should be provided at the end of the runway strip for a runway such as 24L. This area is defined as an area symmetrical about the extended runway centreline and adjacent to the end of the strip, primarily intended to reduce the risk of damage to an aircraft undershooting or overrunning the runway. Among other criteria, it is recommended that the RESA should extend from the end of the strip (which is 200 feet (60 m) beyond the runway) and as far as practicable, but at least 295 feet (90 m). The GTAA airport operations manual states that Runway 24L is not designed with a RESA.

Before 1999, TP 312E was in compliance with the RESA criteria as described in ICAO Annex 14. In 1999, ICAO elevated the "Recommended Practice" of a RESA length of 295 feet (90 m) to the status of a standard and incorporated a recommended practice of a RESA length of 780 feet (240 m). As a result of the change in status in the ICAO specification, Canada filed the difference to ICAO in accordance with the contractual agreement within the Chicago Convention; therefore, a RESA is still not required in Canada. However, TC is presently reviewing the Canadian aerodrome certification requirements, including consideration to harmonize with the current ICAO requirement of a RESA. It is estimated by TC that this harmonization will not take effect for a number of years.

1.10.11 Runway End Safety Area Alternatives

The United States Federal Aviation Administration (FAA) conducted a study on aircraft overruns over a 12-year period (1975 to 1987) and found that approximately 90 per cent of all overruns occur at exit speeds of 70 knots or less, and most come to rest within 1000 feet off the runway end. Therefore, the FAA requires that commercial airports have a standard runway safety area (RSA) that extends 1000 feet beyond each end of the runway and is 500 feet wide. Since most airports were built before the 1000-foot RSA was adopted, many of these airports cannot achieve the RSA standard. This is because of obstacles such as bodies of water, highways, railroads, populated areas, or severe drop-off of terrain. A visual description of the areas for RESA and RSA is provided at Appendix E for a clearer understanding of the size of each of these RESAs.

Recognizing the difficulties associated with achieving a standard safety area at all airports, the FAA permits an alternate means of compliance, such as the use of an engineered material arresting system (EMAS) to provide a level of safety that is generally equivalent to a full RSA.

An EMAS is an area of materials of closely controlled strength and density placed at the end of a runway to stop or greatly slow an aircraft that overruns the runway. When an aircraft rolls into an EMAS arrester bed, the tires sink into the material and the aircraft decelerates. A standard EMAS installation extends 600 feet from the end of the runway. An EMAS arrester bed can be installed to help slow or stop an aircraft that overruns the runway, even if less than 600 feet of land is available. Currently, the system using lightweight crushable concrete is the only system that meets the FAA standard. It is installed at 18 runway ends at 14 different airports in the United States, with plans to install four additional EMAS at four more airports. To date, there have been several cases where aircraft that have overrun the runway end have stopped successfully because of an EMAS, preventing aircraft damage and passenger injuries.

Following a Cessna Citation 550 overrun accident at the Eastleigh Airport in Southampton, UK, in May 1993, the UK Air Accidents Investigation Branch (AAIB) recommended the following to the UK CAA:

The CAA should review all UK licensed airfields to identify potential safety hazards beyond current RESAs and determine the need for, and practicality of installing, ground arrester systems.

The CAA responded with the following:

The Authority is consulting with aerodromes about the guidance now being developed, in particular with those which have an interest in this work. Two aerodromes, in addition to Southampton which has installed an arrester system, have developed plans for the installation of soft ground arrester beds.

The CAA publication CAP 168, Licensing of Aerodromes, has the same RESA requirements as ICAO Annex 14 (90 m minimum, recommended 240 m). The following information in CAP 168 applies for RESA alternatives:

If a RESA beyond the 90 m minimum is deemed necessary but there are physical constraints to achieving the desired distance, declared distances should be reduced unless other mitigation measures can be demonstrated to achieve an equivalent safety result for the same set of operational circumstances. Mitigation measures that may be acceptable, singly or in combination, as alternatives to the reduction of declared distances, include (in part): installing suitably positioned and designed arrester beds, to supplement the RESA where appropriate. Soft ground arrester beds are not intended to replace RESA and, therefore, should not be located within the minimum RESA distance.

There are no Canadian airports equipped with soft ground arrester beds.

1.10.12 Previous Runway Overrun Accident at Toronto

In 1978, a McDonnell Douglas DC-9 overran the end of Runway 23L (now Runway 24R) at CYYZ during a rejected take-off. Of 107 persons on board, there were 2 fatalities and 47 serious injuries. The TC Aircraft Accident Review Board, a forerunner to the current Transportation Safety Board of Canada (TSB), produced report number A78H0002, which included 10 findings. Finding 10 stated the following: "The overrun area for Runway 23L at Toronto was within accepted international standards. A ravine beyond the overrun area left no additional margin for error and contributed to a high casualty rate." While the facts of this accident are different, the safety issues involved are similar, in that the terrain beyond the runway contributed to the severity of the accident.

The Province of Ontario, Office of the Coroner, held an inquest into the deaths and the Coroner's jury made 12 recommendations. Recommendation 7 proposed that an extended RSA of 1000 feet be created for Runway 23L at CYYZ by constructing a causeway across the ravine. Recommendation 9 proposed that the grassy area between the ravine and Runway 23L be paved immediately so as to provide better braking for aircraft. Neither recommendation was accepted; however, the area beyond the end of (the current) Runway 24R was re-graded.

1.10.13 Automated Terminal Information System Broadcasts

CYYZ's ATIS information Uniform was as follows:

Weather at 1900 Zulu^{Footnote 13} wind 220 at 7, visibility 4 sm, thunderstorms, heavy rain, ceiling 5000 broken, towering cumulus 8000 broken, temperature 24, dew point 23, altimeter 30.02, cumulonimbus associated. SIGMET Kilo 1 valid until 2315 Zulu, within 20 nm of a line 20 nm west of Buffalo to 50 nm southwest of Muskoka, broken line of thunderstorms observed on radar, satellite picture, lightning detector. Maximum tops 440. Line quasi-stationary, weakening near 00 Zulu. Due to rapidly changing weather conditions air traffic control will assign landing runway. Departure runway will be assigned by ATC. Monitor 133.1 for NOTAM unavailable by data link. Inform ATC that you have information uniform.

1.10.14 Notice to Airmen

At the time of the accident, a NOTAM was in effect to advise that the first two sequenced flashing approach lights for Runway 24L were unserviceable. The absence of these lights had no effect on the approach of AFR358 and the subsequent accident.

At 2012, about 10 minutes after the accident, a NOTAM was issued advising of the closure of Runway 24L/06R. At 2041, another NOTAM was issued advising of the closure of Runway 24R/06L as well.

At 2157, a NOTAM was issued to advise that aircraft rescue and fire fighting (ARFF) services were not available at CYYZ. At 0122, the NOTAM was cancelled when Category 9 ARFF services were re-established at the north fire hall.

1.11 Flight Recorders

1.11.1 Cockpit Voice Recorder

The cockpit voice recorder (CVR) was recovered from the accident site. The CVR was a Team model SSCVR, part number AP7123-2101 and serial number 170. This model of CVR is a solid-state recording device with a storage capacity of approximately two hours. An external examination of the CVR revealed significant heat exposure. The CVR identification plate was missing. The underwater locator beacon (ULB) or pinger bracket was damaged, and the ULB was missing. All relevant data were transcribed in full.

1.11.2 Flight Data Recorder

1.11.2.1 General

The solid-state FDR was a SFIM Industries model ESPAR, part number AP41116101, serial number 197. This particular FDR system on the Airbus A340 records over 500 parameters in a dataframe of 128 words per second, with a capacity of approximately 45 hours using data compression. An external examination of the FDR revealed significant heat exposure. Although the FDR was burned, it was possible to identify it from the name plate. There was no apparent impact damage and the ULB remained attached to its bracket.

A recorder of this type can be downloaded directly without disassembly if there is no damage to the memory module connectors. The module appeared to be intact; however, the memory module connector and the external interface cards exhibited heat damage. After disassembly, it was clear from the extent of the damage that a direct download would not be possible and that the memory cards would have to be removed for data recovery. Further disassembly of the unit was required to access the memory cards. There was considerable heat exposure to the internal circuitry and some connectors were melted. The module showed no signs of internal heat damage. The memory board was found to be in pristine condition.

Due to the extent of the observed damage to the units, it was deemed prudent to perform the repair work on the connector and its interface, as well as the downloading of the data with the assistance of France's Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA). The TSB team travelled to France for this delicate task. The memory modules were successfully downloaded using SFIM Industries software tools, and the full 45 hours of data were successfully recovered.

1.11.2.2 Relevant Flight Data Recorder Information

The winds encountered by the aircraft on short final were calculated using FDR recorded airspeed, groundspeed, heading, track, and angle-of-attack parameters. The calculated averaged winds were as follows:

Position	FDR Recorded Winds	Calculated Wind	Tailwind Along Runway Axis	Crosswind Across Runway Axis
Autothrust Disconnect		327°M/15 knots	-1 knot	15 knots
Threshold Crossing		004°M/22 knots	12 knots	18 knots
Touchdown	330°T/11 knots	005°M/24 knots	12 knots	19 knots
Reverse Selection		360°M/20 knots	10 knots	16 knots
End of Runway		355°M/21 knots	10 knots	18 knots

FDR data revealed that the aircraft touched down at 2001:53 at a recorded computed airspeed of approximately 143 knots and a recorded groundspeed of approximately 150 knots. The aircraft touched down with a recorded normal g force of 1.2 g on a heading of 243°M. Ground spoilers were armed for the approach and were fully deployed at 2001:58. The nose landing gear squat switch activated 5.75 seconds after touchdown. Manual brakes were applied approximately 2.5 seconds after touchdown, and the pedal displacement increased to 70° approximately five seconds after touchdown and remained at this level for the entire rollout. This corresponds to the maximum braking demand, 2500 pounds per square inch (psi) brake pressure. Reverse thrust was selected some 13 seconds after touchdown and the N1 parameters of the four engines stabilized at maximum reverse approximately five seconds later. The FDR stopped recording at 2002:23, four seconds after the aircraft left the runway.

FDR timings, longitudinal accelerometer data, and recorded groundspeed were used for various calculations to determine the touchdown point on the runway. It was determined that the touchdown point on Runway 24L was between 3800 feet and 3900 feet from the threshold. A comparison of the recorded longitudinal acceleration values and predicted longitudinal acceleration for conditions like those of the day of the accident provided by Airbus indicates a correlation with the performance expected for a runway contaminated by ¼-inch of water.

Review of the systems data did not show any failures that would have degraded the stopping performance of the aircraft.

1.12 Wreckage and Impact Information

1.12.1 Impact Damage

Tire marks from the left and right main gear, centre main gear, and nose gear were evident on the end of Runway 24L, the blast pad, and down the grass hill. The aircraft's left main landing gear inboard tires travelled directly over the survey button at the threshold of Runway 06R, indicating that the aircraft was just right of the Runway 24L centreline when it left the runway. Tire marks left on the blast pad and the grassy area indicate that the aircraft was yawed slightly to the right.

The aircraft crossed the service road, then Convair Drive, the landing gear, and two inboard engines leaving gouges in the pavement of Convair Drive. The aircraft knocked down the guard rail along the western side of Convair Drive and the fourth approach light tower. A small amount of aircraft debris was found in the field leading up to the edge of the ravine.

The aircraft came to rest in a ravine alongside Etobicoke Creek, on the extended centreline of Runway 24L. Most of the wreckage was contained within the radius of the aircraft, but there were several small components in the field before the ravine. The aircraft struck and destroyed the fifth set of approach lights as it entered the ravine. This set of lights comprised three pairs of frangible light towers, individually mounted on poured concrete pillars and arranged perpendicular to the runway centreline. The right landing gear struck and uprooted the inner concrete pillar of the right set of lights.

A post-crash fire consumed most of the upper portion of the main fuselage, vertical fin, and inner wing sections. The fire was intense and mainly limited to the fuselage. Fire singed and burned some of the surrounding vegetation, but did not spread beyond the circumference of the aircraft.

The top of one of the passenger oxygen bottles exploded during the post-crash fire; the top was blown approximately 84 m (276 feet) across Etobicoke Creek.

1.12.2 Fuselage

Major break-up of the aircraft occurred only after it descended into the ravine. The nose cone sustained one minor puncture at the seven o'clock position. The upper part of the front fuselage, which contains the flight deck and the front passenger doors, was not significantly deformed. All windshield sections were intact and appeared undamaged. The upper fuselage and the interior aft of the L1 door were consumed by fire. The lower part of the front fuselage was severely dented.

Further aft, the front portion of the passenger cabin on the left side was consumed by fire. The forward cargo compartment, located beneath the cabin floor, retained its shape, although it was also consumed by fire. The forward cargo door was found in place and closed. Next to the cargo door, coincident with the location of the passenger oxygen cylinders, was a large hole in the fuselage wall that bore signs of explosive force. The surviving window frames were not distorted, indicating that this section of the fuselage did not experience undue stresses during the event.

There was distortion, resulting from the forces generated when the landing gear collapsed, transmitted through the integrating structure for the wing centre box. The condition of the keel beam, also located in this area, was impossible to assess due to fire damage and collapse of the surrounding structures. As the wreckage was being cleared from the site, the keel beam was inspected and found to have no pre-existing weaknesses.

The rear portion of the fuselage on the left side was consumed by fire down to and including the cabin floor. Part of the left-side cabin wall was standing, though heavily damaged by the fire. Approximately four feet ahead of cabin door R4, there was a fold in the outer fuselage skin, indicating that the location was subjected to substantial bending forces during deceleration and break-up. The permanent deformation of the fuselage was very likely transmitted to the door frame. This would explain the difficulty the cabin crew experienced when attempting to open the R4 door. The door initially resisted opening and required two cabin crew members to push the door open. The rear cargo compartment door was found in place and closed, though almost burned through. The bulk cargo door was found on the ground, with the charred remains of the cargo spilling out of the door opening.

The unpressurized portion of the rear fuselage (aft of the rear pressure bulkhead) was less affected by fire than the rest of the fuselage. The collapsed and burned pieces of the vertical and horizontal stabilizers prevented an immediate assessment of the tail section of the fuselage, but it was later confirmed that there were no pre-accident deficiencies.

1.12.3 Wings

The left wing was found attached to the aircraft. The wing box rear spar-to-wing trailing edge inboard of the number 2 pylon was broken off. The wing bottom and top skins, including associated internal ribs, were sheared off, and the rear spar was found broken at rib one. The left main landing gear was attached to this piece of wing structure. The left wing had suffered heavy fire damage at the rear spar/rib one area. The top skin had melted in the vicinity of rib five. The inboard flap was found broken and separated from the wing structure.

All other left-wing trailing edge movable surfaces were identifiable. Four outboard spoiler panels were attached and in the closed position. Two inboard spoiler panels were located on the detached section of the wing. The aileron panels and the outboard flaps were attached and in the deployed position. The left-wing tip fence (winglet) was attached and basically undamaged. The leading edge movable surfaces (seven slats) were attached and in the deployed position. The leading edge of the left wing was heavily damaged in the vicinity of the number 2 pylon.

The right wing was attached to the aircraft. The wing box rear spar-to-wing trailing edge inboard of the number 3 pylon was broken off. The wing bottom and top skins, including associated internal ribs, were sheared off. The rear spar was found broken at rib one. The right main landing gear was broken and had separated from the wing. The right wing had sustained heavy fire damage at the rear spar between ribs one and five. The top skin and the internal wing structure had actually melted. The inboard flap was found broken and separated from the wing structure. All other movable leading and trailing edge surfaces (slats, ailerons, and flaps) were accounted for. The right-wing tip fence (winglet) was attached and basically undamaged. The right-wing leading edge was severely damaged at the number 3 pylon. Slat measurements were taken at three tracks, which confirmed that the slats had achieved full extension. The spoilers were in the retracted position.

1.12.4 Stabilizers

The trimmable horizontal stabilizer was still joined to the fuselage through the main box. The left-hand stabilizer was attached in position and had impact damage. The left-hand elevator was partially detached, but in position, and had impact damage. The right-hand stabilizer and elevator were attached in position and partially burned away. The tailplane tips, made of an aluminum alloy and part of the lightning protection system, were examined for evidence of a lightning strike; none was found. The vertical stabilizer was attached to the aircraft and in position. It was only after the intense fire that the lower half of the fin and rudder burned away and the rest collapsed to the right side. The rudder was separated from the fin box.

1.12.5 Aircraft Engines and Auxiliary Power Unit

Examination of the four engines revealed no pre-impact anomalies. Organic material found on all booster inlet guide vanes of the four engines indicated that there was engine rotation during the impact sequence. Extension of the thrust reverser actuator pistons indicated that the thrust reverser doors were deployed during the impact sequence.

The electronic control unit (ECU) for each engine was removed and sent to General Electric for downloading of the non-volatile memory (NVM). Downloading was successfully completed and revealed no pre-impact faults with the engines. Two TSB investigators were in attendance.

The eight engine fire bottles were removed, and except for the forward bottle of the number three engine, all held their charge. The number three bottle was punctured in three areas. None of the squibs had fired.

The auxiliary power unit (APU) engine was in normal condition. There was no indication of pre-impact anomalies. The engine ducting was singed and wiring insulation was softened, consistent with excessive compartment temperatures from the post-impact fire.

The APU is equipped with a Halon fire-extinguishing bottle located forward and outside of the APU housing structure. The bottle was not physically damaged but had lost its charge; laboratory analysis revealed that the pressure relief valve was open. The squib had not fired.

1.12.6 L2 Emergency Exit Door

The pre-fire condition of all passenger and emergency exit doors was assessed, where possible. Some doors were significantly damaged by the fire. The emergency slide equipment was examined, with particular attention paid to passenger door L2, which was reported to have opened while the aircraft was decelerating. The L2 door, frame, and slide were moved to the TSB Engineering Laboratory for detailed examination and analysis.

Photos submitted by an evacuating passenger show that the L2 door was open and the emergency slide was not deployed. During the fire, the structure supporting the door had weakened and the door dropped to the ground. The initial examination at the site found the inner door handle in the up (open) position and the emergency handle armed. The rear slide release pin and cable was still attached to the door along with a piece of charred packboard. The girt bar, which secures the slide to the fuselage, was locked in the door frame sill. The door power assist had been activated, as the rupture disc in the actuator assembly had been punctured.

The interior face of the door was heavily damaged by the fire, the lining and insulation approximately 90 per cent consumed. A number of structural parts had melted. The connecting rod to the control handle mechanism was burned away. The hinge-arm door-open locking mechanism (hooks and overcentre device) was locked in the open position. The lifting mechanism was in the lifted position. The hooks, guides, stop fittings, and rollers were in good condition. There was no indication of binding, jamming or overstressing. The exterior of the door showed localized burn marks, the lower front corner was dented, and the adjacent inner structure was bent. The outside door handle was found in the closed position and was free to move by hand.

The various locking, lifting, and lowering mechanisms were cycled several times to test their function. The hinge-arm lock worked as designed. The locking shaft was moved back and forth, and the spring unit held the locking shaft in the overcentre position, as designed. Door unlocking can only be accomplished by the locking shaft rotation via the inner door handle. The weight balance torsion bar spring was disconnected and the door lifting mechanism was switched to the door lowered (closed) position. Attempts were then made to return the mechanism to the lift (open) position. It was impossible to rotate the lifting shaft because the overcentre travel blocked the movement, as designed. The door lifting (opening) can only be initiated by the inner door handle movement. The outer handle was tested and found functional. The emergency handle returned to the disarmed position when the outer handle was lifted, as designed.

The emergency evacuation slide was about 50 per cent consumed by the cabin fire. The slide had fallen into the cabin and was still in the folded configuration. The girt portion of the assembly (dark grey in colour) was not found. The packboard, which attaches the folded slide assembly to the door, was not found and is presumed to have been destroyed by fire. A small charred portion of the packboard, complete with the rear slide release pin and cable, was still attached to the door. The release pin was bent and discoloured from heat. The front slide release pin was found intact inside the cabin, an indication that it had released properly when the door opened. A force of approximately 80 pounds was needed to push the pin out of the rear attachment rail. The girt bar that attaches the slide to the door sill was found locked in place as it should be if it were used for an emergency evacuation.

1.12.7 Cockpit Seats

Both seats experienced high vertical forces during the event. The captain seat was displaced from its normal position. The floor of the seat base had fractured, allowing the chair to detach from the base. The nut attaching the centre screw to the bottom of the base on the first officer seat had pulled through the retainer. The force necessary to pull the nut through the retainer was mathematically calculated. It was determined that a vertical acceleration of a minimum of 16 g was likely reached before the seat broke. The seats were designed to withstand 5.7 g vertically and 9 g longitudinally.

1.12.8 Cockpit

The cockpit was photographed to document items such as switch and lever selections, as well as instrument readings. The speedbrake control lever was observed in the RETRACT position. The length of the lever was measured to be approximately 66.5 mm, which corresponds to the ground spoilers not being in an armed position. After the in situ physical position was documented, the lever was pulled up to the armed position and released back down into RETRACT. The flap lever was observed in the FULL position. The landing gear lever was observed in the DOWN position. The antiskid and nosewheel steering switch was ON. The EVAC ON pushbutton was found in the out, OFF position.

The aircraft is equipped with three emergency locator transmitters (ELTs); one of the ELTs is equipped with an automatic g switch, which is unidirectional along the longitudinal axis. No signals were reported to have been received from any of the transmitters. The extensive post-crash fire destroyed the structure where the three transmitters were located. No components from these beacons were identified or recovered from the wreckage.

The windshield wipers were found deployed and partway up on both the captain's and first officer's windshields. The captain's and first officer's windshield wiper selector switches were both set to the SLOW position. Rain repellent was not used.

The weather radar settings were set to the Weather and Turbulence mode, Predictive Wind Shear was on AUTO, the Ground Clutter Suppression was OFF, and the GAIN was on calibrated.

1.12.9 Tires and Brakes

There was no evidence of hydroplaning on any of the tires. All brakes had the pistons extended, and the average brake wear remaining was about 66 per cent. There was no indication of pre-impact hydraulic leakage found. Brake pedal linkages in the avionic bay (under the cockpit floor) were in good condition. The brake and steering control unit (BSCU, FIN 3GG) and both landing gear control interface units (LGCIU, FIN 5GA1 and FIN 5GA2) were recovered. All of the units were severely damaged by fire, as were the braking components in the main landing gear bay. Wheel hubcaps and tachometer assemblies were removed on main landing gear wheel positions 1, 2, 3, 4, 5, 7 and 8; the tachometer for wheel number 6 could not be removed. No visual anomalies were observed on the tachometer driving shafts.

1.13 Medical Information

For the last several years, the captain had been restricted from various flying duties for medical reasons, reportedly for a condition that made him susceptible to fatigue. On 04 September 2003, he was found fit to fly with the restriction of no flights to Africa or Madagascar for six months. On 01 June 2004, the same restriction was repeated. On 24 February 2005, he was restricted from flights to Africa and Madagascar for a period of one year.

On 11 July 2005, the captain voluntarily requested a reduced flying schedule due to an unusual level of fatigue. On 25 July 2005, upon returning from the flight before the accident flight, having consulted with his treating physician, the captain requested and was granted by Air France medical staff eight days off followed by a 50 per cent reduction in schedule for three months. He was restricted to flights to North America during this period, but flights to the west coast of North America were excluded. Further clarification with respect to the specific medical condition of the captain and any possible impact on performance was requested from the BEA medical personnel. Other than the information provided above, no medical assessment was available that would explain the ongoing fatigue symptoms experienced by the captain or their possible impact on performance.

1.14 Fire

1.14.1 Fire Initiation and Spread

Evaluation of the wreckage trail indicated that there was no fuel leakage until the aircraft crossed Convair Drive. The first debris related to the fuel tanks and the fuel distribution system was found in the field adjacent to the ravine. Traces of fuel were visible at the top of the embankment on the left-hand side of the aircraft trajectory. A piece of an internal wing box rib was also found in the same area. A wing access door panel with slight fire damage was identified among the debris deposited halfway between Convair Drive and the edge of the ravine. There was no indication of fire on top of the embankment because no scorched grass or soil was visible.

The fire intensified as the aircraft came to a halt. The fire path was from the wing area toward the fuselage. By the time the fuselage was seriously threatened by fire, the aircraft had been totally evacuated. There were four principal areas of fire:

• left-wing root main landing gear area;
• right-wing root main landing gear area;
• fuselage from the cockpit door to the rear pressure bulkhead; and
• APU area.

The left wing sustained heavy fire damage at the rear spar/rib one area and the top skin had melted in the vicinity of rib five. The right wing sustained heavy fire damage to the rear spar section between ribs one and five. The top skin and the internal wing structure had melted in that location (see Photo 5). The fuselage burned from the cockpit door to the rear pressure bulkhead. The great portion of the fuselage was consumed by fire down to and including the cabin floor. Part of the right-side cabin wall was standing, though heavily damaged by fire.

1.14.2 Aircraft Rescue and Fire Fighting

In accordance with Section 301, Subpart 3 of the CARs, the GTAA provided Category 9 ARFF services at CYYZ. Due to the size of the airport, the GTAA divided the airport into two distinct airports, each with its own fire hall. The north airport includes Runway 23/05, and the parallel Runways 15L/33R and 15R/33L. The south airport includes the south parallel Runways 24R/06L and 24L/06R. The south fire hall is adjacent to Runway 24L, about 3000 feet from the threshold.

The aircraft left the runway at 2002:19. When the tower controller activated the crash alarm at 2002:45, notification went to both fire halls on the airport, the GTAA operations centre, and surrounding fire halls in the City of Mississauga, Ontario. A group of ARFF firefighters were in the alarm room of the south fire hall watching the storm and witnessed the aircraft landing. They responded before the crash alarm activation by the control tower and the first response vehicle arrived at the scene within one minute of the crash alarm sounding. This response time was well within the three-minute time standards prescribed by Section 303, Division IV of the CARs.

GTAA fire crews regularly undertake training with respect to the aircraft using CYYZ. In 2003, they had a week-long training session on an Air Canada Airbus A340. Training records are maintained and TC conducts an annual audit on firefighter training. All audit results have been positive. GTAA ARFF regularly uses electronic information sources including a website published by Airbus to study the type of aircraft using CYYZ.

The ARFF initial response team consisted of 15 members. The minimum staffing level is 11 members per shift. There were additional crews on hand at the time because firefighters were beginning to arrive for a scheduled shift change. Others were called in, arrived for their regular shift, or came in on their own initiative after hearing of the accident through the media.

The ARFF response equipment comprised one command vehicle, one rapid intervention vehicle of a 6000-litre capacity, two structural pumpers, and four major foam vehicles of a 12 000-litre capacity each. Two of those vehicles were equipped with snozzles. A snozzle is a probe located at the end of a hydraulically operated arm attached to the fire truck. It is used to penetrate the aircraft structure at designated locations and inject firefighting extinguishing agents inside. This response equipment exceeded the number of firefighting vehicles and the total quantity of water that is required under Section 303.09 of the CARs for Category 9 ARFF. The first vehicles took positions adjacent to a public road at the tail of the aircraft. Because of the terrain of the final resting place of the aircraft, the snozzle equipment could not be used.

GTAA ARFF trucks delivered an initial quantity of 39 500 litres of water to the fire, 63 per cent more than the capacity required by applicable regulations. Additional water was obtained through hydrants and subsequently through a tanker arrangement established by the City of Mississauga and the Town of Caledon, Ontario.

The primary firefighting agent used was aqueous film-forming foam. These foam concentrates are mixed with water and air and produce an aqueous film on the surface of hydrocarbon fuels to prevent evaporation. The closest fire hydrants to the accident location were about 1 km away at the GTAA bus terminal adjacent to the south fire hall. When trucks ran out of water, they shuttled back and forth to the hydrants until a tanker operation was established by Mississauga Fire and Emergency Services to supply the GTAA trucks on site.

The GTAA Emergency Operations Centre (EOC) was opened at 2018. At 2022, the GTAA mobile command post arrived at the scene and three passenger buses and a Toronto emergency services (EMS) multiple casualty bus were dispatched to the scene.

At 2141, 297 passengers were accounted for, but emergency crews were still waiting for a manifest to confirm the total number of persons on board. Currently, the GTAA ARFF command vehicle has laptop capability in order to pull up aircraft charts published on the internet.

1.14.3 Aircraft Familiarization Charts

As stated in Section 1.14.2, the GTAA firefighters had received extensive training on the Airbus A340 and had on-site access to crash charts published on the internet. GTAA ARFF personnel indicated that they routinely conduct aircraft familiarization by visiting various aircraft parked at a gate for a period of time or in a hangar for maintenance.

A binder containing aircraft familiarization charts was retrieved from one of the GTAA ARFF trucks. These charts show information particular to each aircraft model, such as locations and volumes of fuel tanks, fuel lines, emergency exits, battery locations, emergency penetration points, and other information of significance to firefighters. The charts provide value as a training aid for firefighters and other emergency response personnel and as quick reference material when response is required and other sources are not available. The retrieved binder was identified as TC's publication ERS Aircraft Crash Charts (TP 11183).

Some manufacturers such as Airbus and Boeing make these charts available via the internet. Subscriptions can be obtained for both hard-copy and electronic versions that can be incorporated into driver-enhanced vision systems^{Footnote 14} installed in fire trucks.

In the mid-1990s, during the devolution of airport operations to local airport operators, TC ceased the production of TP 11183 and transferred its copyright to the National Fire Protection Association. At the time of the Air France occurrence, TP 11183 was no longer being produced, and the provision of such crash charts to ARFF personnel was at the discretion of individual airport operators.

The condition and contents of the manual found in the truck indicated that it was not a primary reference tool. It contained charts for aircraft that are no longer in service anywhere in the world and did not contain charts for the Airbus A340.

CAR Standards require ARFF personnel training in the following area:

323.14(1)(b)(ii) Familiarization with the types of aircraft regularly operating at the airport or aerodrome where the firefighter will be carrying out fire-fighting duties.

323.14 (2)(b)(ii)(H) Use an aircraft crash chart to identify and describe the location of normal and emergency exits, fuel tanks, passenger and crew compartments, oil tanks, hydraulic reservoirs, oxygen tanks, batteries, and break-in points for given aircraft.

Although there is no direct regulatory requirement for an airport authority to possess a set of appropriate aircraft familiarization charts, a requirement is implied in CAR Standards for training purposes.

In the late 1990s, TC initiated a series of Notice of Proposed Amendments (NPA) to update the CARs with respect to aerodromes and airports. NPAs 2000-243 and 2000-244 addressed the fact that Emergency Response Plan requirements under Section 302 of the CARs and TP 312 did not ensure that consistent planning for emergencies, commensurate with the type of aircraft and amount of traffic, is developed by the airport operators. NPA 2000-243 proposed regulatory changes in that Section 302.104(1), Aircraft Crash Charts and Grid Maps, would require that "The airport operator shall provide aircraft crash charts in accordance with the airport standards." The relevant standards, drafted in NPA 2000-244, proposed that "The operator of an airport shall provide the aircraft crash charts specific to the commercial passenger-carrying aircraft using the airport. . . ."

As of 07 October 2006, the proposed changes to Section 302.206 of the CARs had been published in Part I of the Canada Gazette as follows:

302.206 Aircraft Crash Charts and Airport Grid Maps will require the airport operator to make available at the emergency coordination centre, aircraft crash charts specific to the aircraft used by the air operators that use the airport. Copies of these charts must be supplied to the organizations responsible for fire-fighting services that are identified in the plan and to the on-scene controller.

1.15 Survival Aspects

1.15.1 General

The passenger load comprised 297 passengers: 168 adult males; 118 adult females; 8 children; and 3 infants. Adult passengers included: three wheelchair passengers and one blind passenger. Three non-revenue passengers were seated in crew seats: one in the third occupant seat of the flight deck, and two in the flight crew rest area.

The dynamic loads generated in this occurrence were within range of human tolerance. However, given the number of serious impact injuries incurred by passengers and crew located in the flight deck and forward cabin, it is apparent that significant forces were experienced in those areas of the aircraft.

1.15.2 Runway Excursion

From the time the aircraft left the runway until it came to a stop in the ravine, it bounced violently and repeatedly, and there were a minimum of three distinct impacts. On each impact, cabin occupants were propelled upward from their seats, their arms and legs flailing. It is estimated that approximately 15 to 20 seconds elapsed between the time the aircraft departed the runway hard surface and it came to a stop in the ravine. The following events occurred during the impact sequence:

• the handset for the PA/interphone system fell out of the stowage cradle at the L1 cabin crew station;
  
• a number of overhead baggage compartment doors opened, uncommanded, allowing carry-on baggage to fall into the cabin;
  
• the L2 passenger door opened while the aircraft was moving, sometime after it left the end of the runway;
  
• in the passenger aisle adjacent to the L2 door, the emergency exit light and a ventilation grill partially detached and hung from the ceiling;
  
• some oxygen masks fell from stowage;
  
• a portable serving table stowed/secured in the forward galley dislodged and fell in the cross-aisle between the L2 and the R2 exit doors;
  
• the curtain rod between the passenger seating area (right passenger aisle) and the R4 exit area detached and fell on the floor;
  
• one end of the curtain rod separating the passenger seating area (left passenger aisle) from the L1 exit area detached and hung down into the passenger aisle;
  
• the fire started on the aircraft exterior before the aircraft came to a stop; and
  
• smoke entered the cabin through the opened evacuation doors before the evacuation was complete.

1.15.3 The Evacuation

When the aircraft came to a full stop, the chief purser, in the front of the aircraft, released his seat belt and retrieved the PA handset from the floor. He was not aware of the smoke/fire from where he was standing, nor did he know that many passengers were already in the aisles making their way to the emergency exits. He made a direct PA, stating "Everything is OK - remain seated, the crew will look after you." The L2 purser then arrived and told the chief purser that there was a fire by door L3, and that an evacuation was required. The chief purser turned and faced the cabin, and saw the fire outside the aircraft through the windows on the left side of the aircraft and the passengers in the aisles. When the captain was advised of the fire and the need to evacuate, as per the flight crew's emergency procedures, he pushed the EVAC ON pushbutton to activate the evacuation alert system. The system did not respond. The cabin crew commanded the evacuation at four of the aircraft's eight emergency exits.

Fire was observed on the left wing through the open L2 door, through the viewing window in the L3 door, and through the window in the L4 door. Forty-two per cent of passengers who responded to the passenger safety questionnaire saw flames on the outside of the aircraft while it was still moving and 10 per cent saw smoke in the cabin before the aircraft came to a stop. Black smoke first entered the cabin from the left side of the aircraft, just below the windows in the area of passenger seat rows 29 and 31. When the aircraft came to a stop, smoke continued to enter the cabin, making it difficult to see during the evacuation. The L3 cabin crew member, whose station was just aft of row 31, donned a smoke hood for personal protection. There was no fire in the cabin during the evacuation.

Passengers evacuated the aircraft during heavy rainfall. Continuous heavy rainfall and thunderstorms were reported at CYYZ from about 1900 until at least 2020 when it tapered off to light rain. Most passengers appeared to be coming up the embankment along the right-hand side of the aircraft; others were scattering in both directions along the creek. One passenger, with a broken leg, was found in this area adjacent to the aircraft. The R3 steward, the supplementary cabin attendants, and a GTAA employee remained with the passenger until a team of firefighters were able to assemble and carry the passenger up the hill on a backboard. Entry was gained to the aircraft interior at the front cabin door. The flight deck and first six rows of passenger seats were checked for survivors before the firefighters were ordered to evacuate from the aircraft due to increasing danger because explosions were occurring. No one was observed to be on board. Except for the one passenger with a broken leg, no passengers were observed that required assistance by any ARFF firefighters.

1.15.4 Use of Emergency Exits

At the onset of the evacuation, exits R1 and R2 were assessed by cabin attendants as unusable because the creek was immediately outside the exits. Both attendants followed the prescribed procedure for unusable exits. As the evacuation progressed, the attendants reassessed their original decision regarding the usability of exits R1 and R2, and concluded that they would have to be used to expedite the evacuation in light of the ever increasing amount of smoke in the cabin.

The forward purser knew that opened exit L2 was unusable because of the fire outside and because the slide had not deployed. However, when the aircraft came to a stop, he realized that the chief purser was not aware that the aircraft was already on fire. He rushed over to him and advised him that an evacuation was required. This action likely enabled the evacuation to begin sooner. In doing so, he did not have time to close the exit door and left the open exit unattended for an undetermined period of time. In his absence, at least 16 passengers egressed via exit L2. Two of the passengers incurred serious injuries-one when he jumped from the exit, a height of 10 to 12 feet, and the other when pushed out of the exit by other passengers. The purser subsequently returned to the L2 emergency exit and redirected passengers to the L1 exit.

When exit R3 was opened, the slide deployed but immediately deflated when it contacted debris, making it unsafe for use. As the responsible cabin attendant proceeded to close the exit door, two passengers forced their way by and jumped from the exit. It is not known what, if any, injuries they incurred. Exit R3 was subsequently closed by the cabin attendant and he redirected passengers to another exit.

Fire outside the aircraft rendered emergency exits L3 and L4 unusable. The L3 cabin attendant blocked the unusable exit and redirected passengers to the nearest available exit as per the operator's prescribed emergency procedures. The aft purser, stationed at the L4 emergency exit, did not block the unusable exit nor assign an able-bodied passenger or supplemental cabin crew member to block it; it was evident that the exit could not be used because of the fire on that side.

The R4 door was difficult to open, requiring two cabin crew members to lift the door control handle to the fully up position and push the door out. Once outside the door frame, the door moved forward easily. It appeared to cabin crew that the door assist did not engage; however, after the occurrence, the emergency operation cylinder pressure gauge was documented as being in the red zone, indicating that it functioned as designed. Approximately one door width forward of the R4 door was a permanent fold in the outer fuselage skin, indicating that the location was subjected to a substantial bending force. The deformation of the fuselage was very likely transmitted to the door frame and would explain the difficulty experienced opening exit R4.

Fire rendered two of the eight exits (L3 and L4) unusable for evacuation. Exits L2 and R3, although the slides had either not deployed or had deflated, were used by a few passengers, some of whom incurred injuries. Exits L1, R1, R2, and R4 were used. Two cabin crew members blocked access to unusable exits and redirected passengers to the nearest available emergency exit, as per the company's emergency procedures manual.

Four of the eight exits were therefore unsafe for use, or unusable: L2, L3, L4, and R3. However, L2 and R3 exits could have been used, had other options not been available. The L3 and R3 cabin crews remained at their exits, as per their emergency procedures, directing passengers to alternate available exits. Following the occurrence, the L2 cabin crew member was unable to recall very much about his actions during the evacuation. The L4 purser also left her exit unattended (unusable because of fire/never opened) while she commanded the evacuation at exit R4. The R4 cabin crew had been directed by the L4 purser to evacuate and help passengers at the foot of the slide.

Approximately two-thirds of the passengers evacuated via exit R4. The remainder evacuated via exits L1, R1, and R2, and a few evacuated at exits L2 and R3. It is estimated that the aircraft was evacuated in a little more than two minutes. A number of passengers took their carry-on baggage with them; in view of the urgency to egress rapidly because of the smoke in the cabin and the fire, this action presented a significant risk to safety.

During emergency procedures training, cabin crews are taught to use a megaphone when wearing a smoke hood so as to make themselves heard/understood. The L3 cabin crew did not have ready access to either of the megaphones on board the aircraft.

1.15.5 Exit Slides

The L1 slide partially deployed/inflated. Given the nose-down, left-wing-high attitude of the aircraft, neither the intermediate tie restraint device nor the toe tie restraint device separated from the slide. As a result, the slide came to rest folded in half against the fuselage. When passengers jumped from exit L1, some became trapped in the folded portion of the slide and were unable to extricate themselves before other passengers jumped on top of them. During the evacuation, the slide deflated completely. Post-occurrence examination of the slide revealed that it had been punctured in two areas. The tears measured 18 cm and 13 cm in length.

The L2 slide failed to deploy, rendering the exit unsafe, although a few passengers jumped out of that exit. Because exits L3 and L4 were not opened, the slides at those doors were not actuated. The R1 slide deployed automatically as designed. However, the angle of the slide was very shallow because it was almost perpendicular to the aircraft. As a result, the rate of descent was slowed considerably. At the bottom of the slide, vegetation on either side of the deployment path pushed against the slide, causing it to curl inward, forming a tube. At one point, the R1 cabin attendant had to stop the evacuation to wait for passengers already on the slide to pass through this tube. As more passengers used the slide, the bottom of the slide flattened. The operation of the R2 slide was unremarkable. The R3 slide deployed as designed; however, immediately thereafter, the slide deflated. The R3 cabin crew closed the door to prevent injuries to passengers who might try to use that exit. It was subsequently determined that the slide had torn on a piece of wreckage. The R4 slide deployed as designed. Passengers evacuated single file on dual-lane slides at positions R1, R2, and R4.

1.16 Tests and Research

1.16.1 Simulator Trials

On 25 September 2005, TSB investigators conducted simulator trials at the Airbus training facility. The Airbus simulator used for the trials is a flight crew training simulator, not an engineering simulator. Therefore, the trials were not able to achieve quantitative results, but qualitative results and a general idea of aircraft handling and pilot technique when used with the Air France standard operating procedures (SOPs). The simulator trials allowed the investigators to observe various automatic and manual modes of operation, using the actual wind profile and runway conditions present at Toronto at the time of the accident. Various profiles were flown to determine what profile the aircraft would have followed.

One of the trials in the manual mode was to fly the same profile as the accident aircraft. At approximately 300 feet agl, when the wind changed direction to a tailwind, the airspeed trend vector showed a decrease in speed. To maintain the target airspeed with autothrust disconnected, thrust was increased to about 70 per cent N1. When this additional thrust was maintained as in the accident flight, the airspeed increased. Without any pitch corrections, the simulator went above the glideslope and reproduced results similar to those of the accident profile. The tailwind and extra thrust contributed to an extended float and longer-than-normal landing. The selection of reverse thrust was delayed after touchdown and this increased the stopping distance.

The trials showed that, when landing with the autothrust on and the autopilot off, the target speed was maintained and the simulator landed within the first 2000 feet of the runway.

Using Air France procedures and notwithstanding any meteorological condition such as a microburst, the simulator trials showed that a go-around can be safely accomplished at any time up to thrust reverser deployment. In the event of a low-energy go-around in a tailwind situation, extreme caution must be used to prevent a tail strike. The simulator trials were not able to fully replicate the evolving conditions and especially the visibility associated with the extreme weather conditions present in Toronto at the time of the accident, and no conclusions may be drawn from the simulator trials with respect to pilot judgment concerning the go-around.

1.16.2 Testing of Aircraft Brakes

On 13 October 2005, the eight brake units from the main landing gear were transported by TSB investigators to Goodrich Corporation in the United States for testing. It was noted during examination of brake unit 1 that it had been exposed to high heat. Before testing, a new quick connect fitting was installed for the main system because the original fitting had sustained impact damage. As the hydraulic pressure increased, leakage occurred around one of the pistons. Due to the damage sustained during the accident, no further functional testing was possible on this unit. The leakage noted around the pistons for brake unit 1 was expected due to the extent of impact damage that the unit had sustained. There was no indication of internal fluid leakage, indicating that the pin seals were likely intact at the time of impact. Though the main system showed evidence of fluid in all cylinders, the alternate system did not have any evidence of fluid in three of the cylinders. This was likely due to some of the fluid leaking out after the accident because the fittings had been damaged. Disassembly did not reveal any pre-existing condition that would have led to a failure or reduced capability of the unit.

A slight leakage was noted from one piston of brake unit 2 as it was being tested. This leakage was expected due to the extent of impact damage. The unit passed all functional tests. The remaining brake units, units 3 to 8, all passed functional testing. In conclusion, the brakes and the brake system were found to be serviceable.

1.16.3 Passenger Questionnaire

As part of this investigation, a safety questionnaire was mailed to the occurrence passengers as a means of collecting valuable safety-related information. The TSB mailed questionnaires to 264 of the 297 passengers. Thirty-three passengers were younger than 16 years and were not sent a questionnaire. The overall response rate was 35.6 per cent and represented a sampling of 31.31 per cent of all the passengers. Basic non-parametric statistics from the summarized raw data are reported throughout the factual portion of this report.

1.17 Organizational and Management Information

1.17.1 Air France Human Factors Training

The principal aim of the Air France human factors program is to improve culture in Air France to adequately address human factors issues. There are two mechanisms used to achieve this aim: human factors training (initial and recurrent) and return on experience (that is, analysing the preconditions to incidents collected through the flight safety program). These two elements are complementary, in that the return of experience serves to direct future training efforts.

There are 65 human factors trainers for flight crew. The trainers are given a two-day pedagogy course provided by Air France, a four-day human factors training course presented by Dédale (a contractor), and participation in a one-day joint CRM program each year presented by Air France.

All flight crew members receive CRM training at different times throughout their career. For most crew, their first exposure to CRM will come in the form of a two-day multi-crew coordination (MCC) training course provided during initial training. This is followed by a two-day initial CRM course presented in two parts, the first before type-rating training and the second six months following type-rating training. In addition, some human factors topics are discussed during type-rating training. Pilots upgrading to captain receive an additional two days of CRM training during the upgrade process, with the first part presented after type-rating training and the second, follow-up part, presented six months after type-rating training. CRM is also covered during recurrent simulator training with different topics being selected each year.

1.17.2 Air France No-Blame Policy

A "no-blame" safety policy was published on 17 January 2001. It was signed by the Director General and applies to everyone in the company. The safety policy places a responsibility on employees to report events related to safety and states:

To encourage this return on experience, I am committing that Air France will not enter disciplinary procedures towards an individual who has spontaneously and without delay revealed a failing in the rules of safety in which they are implicated for which Air France would not have otherwise been aware. At the same time, this principle cannot apply in a case of deliberate or repeated deviations from the rules of safety.

This policy is seen as being instrumental in allowing the human factors department to identify the areas that will be the focus of recurrent training each year.

1.17.3 Air France Airbus A340 Training

Air France's Professional Standards Division produces a general training program, a standards book and specific training syllabi (for use by instructors). The training is then provided by flight divisions and the training centre.

In general, simulator training at Air France is focused on completing the manoeuvres specified by the applicable regulations. Decision making and handling of specific operational circumstances are taught during line-oriented flight training (LOFT) or during line training. Specific exercises are added to the training curriculum based upon feedback received from the Air France flight safety organization. The following were of particular relevance to the occurrence flight:

• Go-Around after MDA (Minimun Descent Altitude)/DH: In 2003, an aborted landing exercise was added to simulator training where the aircraft enters fog at touchdown during a manual approach. Both flight crew of the accident flight received this training. In 2006-2007, there will be exercises for each crew member incorporating a go-around after DH.
  
• Contaminated Runways: In 2004-2005, there was a LOFT exercise that included contaminated runways in which the crew is departing Toronto with snow on the runway and must make a determination of maximum take-off weight. This exercise terminated with a landing in CYOW.
  
• Use of Weather Radar: In 2006-2007, there will be an item on the use of weather radar to detect turbulence.

1.17.4 Air France Manuals, Policies, and Procedures

Air France's operations manual (MANEX) provides the sole regulatory reference for Air France operations personnel. France's Direction Générale de l'Aviation Civile (DGAC) approves the compulsory sections and accepts the manual as a whole. The MANEX consists of four parts:

• Part A deals with general operating procedures and is called manuel Généralités Opérations (GEN.OPS). It provides all the general operating policy and standards for the Air France fleet.
  
• Part B includes the TU (Technique Utilisation) manual for each specific aircraft type. It provides the technical standards for Air France crews.
  
• Part C consists of route and aerodrome data.
  
• Part D includes programs and procedures for flight operations personnel training and checking.

The manuel Aéronautique Complémentaire (MAC) is not part of the MANEX. It provides general aeronautical information for Air France crews (for example, information on specific meteorological phenomena such as icing and volcanic ash).

At Air France, the department responsible for the MANEX is the Direction des Opérations et du Développement Technique (Operations and Technical Development Branch). Modifications to these manuals are made following a schedule. Although the GEN.OPS is normally updated twice yearly, it was updated three times in 2005. The TU manual is updated four times per year. These modifications are distributed to all pilots in paper copies and as a CD-ROM to all Airbus A330/340 pilots. The paper version is the official copy.

Changes to these manuals are initiated through the Groupe Normes et Standards (GNS) (Standards Group) of Air France, which meets monthly and has input from different sources including the flight safety and training departments. There is also an on-line discussion forum on the Air France intranet, to which approximately 100 flight crew, managers and instructors have access, which provides an opportunity to gather input before any changes are put into effect.

As a guiding principle, Air France tries to stay as close as possible to manufacturers' recommendations for operating standards. However, exceptions to this principle are made based on operational experience or in an effort to harmonize operations between different aircraft fleets and manufacturers. Should a procedure differ from the manufacturer, a No Technical Objection (NTO) is requested from the manufacturer by Air France before the procedure is implemented.

1.17.5 Flight Planning

Air France's flight planning software, Octave, is optimized to select the most efficient route, flight level, and alternate for a given flight. A flight preparation agent using this tool prepares an OFP for use by a crew. The crew will review the flight plan and make any changes required.

Air France crews operate to many destinations and it is not uncommon for crews to be flying to destinations with which they do not have extensive or recent experience. To share information with respect to specific destinations, information sheets have been developed by the Airbus A330/340 fleet flight safety office to provide background information to crews flying to a specific destination. These are available from the flight safety office or on the company Airbus A340 Division internet site. They are not included as standard practice among the briefing information provided to crews in planning their flight. The sheet specific to the Toronto flight indicated the following, but the occurrence crew did not consult the sheet because they were very familiar with its contents:

It is rare to have a hold at CYYZ except due to weather (snow, storms...) but we do not always have the planned track or FL. The weather at KIAG is very close to that at CYYZ, in case of doubt when a front is passing through the area, anticipate a diversion in front of the front (CYUL [Montréal-Pierre Elliott Trudeau International Airport, Quebec] or CYOW) or behind the front (KORD) [Chicago O'Hare International Airport, Illinois, United States].

For long-haul flights originating at LFPG, flight crews meet at the flight planning room a minimum of 1 hour 45 minutes before the scheduled departure. The crew receives a flight planning package prepared by a flight preparation agent, which includes paper copies of all flight plans, weather, etc. The crew members go to a dedicated briefing room where they have a desk and access to additional information by computer.

The captain and first officer review all aspects pertinent to the flight including weather, flight plan, NOTAMs, security, etc. They share the tasks and work individually before exchanging notes. They discuss their final fuel calculations and then enter the agreed-upon figure in the computer system. This system (called Peter Pan) calculates take-off performance. The crew then prints a take-off sheet. During this process, the flight crew has telephone access to a flight preparation agent for questions with respect to the way the flight was prepared. When preparation is completed, the flight crew leaves a copy of the OFP in a box in the flight planning room. The flight crew then meets with the cabin crew where the captain will give a briefing covering operational aspects of the flight including security, safety, and weather.

When in the aircraft, the crew has multiple means of obtaining updates from the aircraft systems, including VHF, HF, and ACARS. These provide access to updated weather reports and forecasts and access to Air France dispatchers/flight followers via ACARS or satellite communications.

The following requirements represent the minimum fuel required for flight planning. In addition, the captain may, at his or her discretion, elect to carry supplementary fuel. The minimum fuel for a standard flight with Air France is calculated as follows:

• Taxi Fuel: includes engine start, use of APU, taxi and contingencies such as time required for de-icing.
  
• Trip Fuel: fuel required from brake release to touchdown at destination taking into account the anticipated flight conditions and route.
  
• Route Reserve: additional fuel carried for unanticipated contingencies. Must be equal to 3 per cent or 5 per cent of trip fuel (not including transport coefficient) depending upon whether an en route alternate is available and in any case may not be less than 5 minutes of holding fuel at 1500 feet above the destination airport.
  
• Diversion Reserve: fuel required to conduct a missed approach at destination and then fly to the declared alternate airport and land, taking into account the anticipated flight conditions.
  
• Final Reserve: sufficient fuel to hold for 30 minutes at an altitude of 1500 feet above the declared alternate airport.

The OFP for the accident flight indicated the following fuel amounts:

Trip Fuel	54 800 kg
Diversion Reserve (using KIAG)	2400 kg
Route Reserve	1300 kg
Final Reserve	2800 kg
Taxi Fuel	700 kg
Total Fuel Required	62 000 kg

Given the anticipated weather conditions at the time of arrival, the captain elected to carry an additional 3000 kg of supplementary fuel. Given the fuel burn required to carry the excess fuel, this would have provided 2250 kg of extra available fuel upon arrival at destination.

The primary alternate, KIAG, was automatically pre-selected by the flight planning software. This is done solely on the basis of proximity to the destination airport, and without consideration of weather. An additional page from the above-noted software, which was also provided to the crew, lists the fuel required for other alternates. For the occurrence flight, other alternates included KCLE (4300 kg), CYOW (4500 kg), Montréal (CYUL) (5900 kg), O'Hare International Airport (KORD), Chicago, Illinois (6900 kg), and John F. Kennedy International Airport (KJFK), New York, New York (7400 kg).

For AFR358 into Toronto, the operational flight plan provided the maximum landing weight (LAW) of 190 000 kg, which is the maximum allowable structural weight for the aircraft. There were no other landing performance calculations provided to the crew.

For a long-haul flight, a flight preparation agent is used to optimize and check the flight plan, taking into account the flight specifics, including weather and landing minima. The agent will complete and, if needed, revise the preparation with comments to draw the attention of the flight crew to specific points. During flight preparation, the crew has the option of calling a flight preparation agent to obtain additional calculations for various contingencies, such as alternate tracks or flight levels. Given that the system optimizes track and flight level selection, it is not uncommon for multiple flights departing at near the same time to have identical routings, resulting in frequent deviations from planned tracks once airborne. In the case of the occurrence flight, the flight was completed on a different track and at a lower altitude than indicated in the OFP in effect at the time of departure.

Early in the descent to Toronto, the crew decided that, in the event of a missed approach at Toronto, they would divert to CYOW. The minimum fuel required for a diversion to CYOW was calculated by TSB investigators and amounted to 4500 kg plus a final reserve fuel of 2800 kg for a total 7300 kg. This amount was based on aircraft weight for given times during the approach and landing. The aircraft landed in Toronto with 7630 kg of fuel on board, enough fuel to carry the missed approach and proceed to the CYOW alternate.

Air France's fuel management procedures indicate that, at the latest, the captain must make a decision with respect to diverting or continuing to destination when the estimated fuel remaining at destination is equal to the minimum diversion fuel.

Toward the end of the flight, the crew members consulted their MANEX to confirm the definition of minimum fuel. It states that, if the estimated fuel at landing is forecast to be less than 1.5 times the final reserve, the crew must declare "minimum fuel" to ATC (in this case 4200 kg). This does not provide priority handling to the aircraft but advises ATC that an emergency situation may develop if the flight is subject to delays. The procedure also states that the crew must declare a low-fuel emergency - a Mayday or a Pan Pan Pan, depending on the situation - if the flight has less than the final reserve fuel (in this case 2800 kg).

For the occurrence flight, had the crew elected to divert to CYOW after a missed approach in CYYZ, they would have had to declare "minimum fuel." In the event of traffic or weather delays en route to CYOW, it is likely that the crew would have had to declare an emergency due to low fuel.

The flight crew had considered the need for additional fuel (in excess of the minimum 7300 kg) for the diversion to CYOW. The captain's copy of the OFP recovered from the cockpit was annotated with the figure 5000 next to CYOW on the alternate planning page. This would indicate that the crew was considering the need for additional fuel in excess of minimum diversion fuel for the trip to CYOW given the current conditions.

1.17.6 Air France Procedures for Approach and Landing

The minima and weather conditions required to initiate a Category I ILS approach are outlined in Air France's GEN.OPS. The minima relevant to the conduct of an ILS approach are visibility or RVR. The approach may be conducted without a specific division of tasks (termed Category I Standard) if the visibility or RVR is greater than 800 m (2600 feet). If the reported visibility or RVR is less than 800 m, flying tasks must be redistributed between crew members because it is below the limit set to allow first officers to fly the approach. The approach may not be continued past the final approach fix or "gate" if the reported visibility or RVR is less than that specified on the appropriate approach chart.

A go-around must be executed at the decision altitude if the required visual references are not established or, with the runway environment in sight, the position or trajectory of the aircraft is such that it would compromise the ability to continue the landing.

The crew members receive, as part of their pre-flight package, a sheet with information on diversion airports with respect to aircraft servicing and passenger handling. For the occurrence flight, five alternates were listed: KIAG, CYOW, CYUL, KORD, and KJFK. The sheet indicated that, in the event KIAG was used, passengers would be bused to Toronto, a three-hour trip. For CYOW, a five-hour trip by bus was specified. On the crew's copy of this sheet, the length of the bus trips for KIAG and CYOW had been circled. There is no information to indicate that this information factored into the crew's decision to conduct the approach.

The MANEX specifies the briefings and their content that must be carried out each flight. As a general guide, the procedure specifies that a good briefing should be short and easily understood by all crew members. It should incite questions and encourage other crew members to express themselves.

During the arrival briefing, which is ideally conducted prior to top of descent, the PF will present the following:

• landing parameters (fuel remaining, weight and speeds);
  
• aerodrome charts to be used (specify page numbers);
  
• key waypoints for arrival, approach, and missed approach and minimum safety altitudes;
  
• radio aids to be used;
  
• stabilization altitude goal;
  
• stabilization minimum altitude;
  
• level of automation planned;
  
• particularities of approach and landing leading if necessary to a review of procedures for GPWS (ground proximity warning system), TCAS (traffic alert and collision-avoidance system), unstabilized approach, etc.; and
  
• key points for taxi route after landing.

There are two checklists to be performed on each arrival - the approach checklist and the pre-landing checklist. The approach checklist consists of four items: briefing completed; ECAM status verified; altimeters set to QNH and cross-checked; and seat belts on.

The pre-landing checklist consists of two items - autothrust in speed mode or off, and landing memo green. If the landing memo is unavailable on the ECAM, it can be completed by the crew and consists of checking the following: signs, cabin, landing gear, flaps, and spoilers. The checklists are located on the back of the quick reference handbook (QRH) and are also posted on the pilots pull-out tray tables.

The MANEX specifies the callouts to be made by the PNF should deviations from the ideal approach trajectory be observed. At the stabilized approach floor (1000 feet agl for the occurrence flight), if the approach is unstabilized, the PNF is expected to announce: "x pi non stabilisé" (x feet unstabilized). Below the minimum stabilization altitude, the following calls are to be expected as required:

• "Vitesse" (speed) if speed deviates more than 10 knots above VAPP or 5 knots below VAPP;
• "Vario" if vertical speed exceeds 1000 feet per minute;
• "Inclinaison" (bank) if bank angle exceeds 5°;
• "Assiette" (attitude) if attitude exceeds limit specified for aircraft; and
• "x pi non stabilisé" (x feet unstabilized) if it becomes obvious that the approach is no longer stabilized.

The MANEX includes a note that specifies that an announcement of an unstabilized approach necessitates a decision from the captain. It further notes that, if the first officer judges a go-around to be necessary, he or she must suggest it to the captain.

The Airbus A330/340 operations manual indicates that both pilots will monitor the localizer and glideslope below 500 feet agl. The tolerances listed are plus or minus one dot on the localizer and glideslope between 500 and 300 feet agl and plus or minus ½ dot on the localizer and plus or minus one dot on the glideslope between 300 and 200 feet agl. There is no requirement to monitor the localizer and glideslope below 200 feet agl.

The MANEX specifies that, at DH, the captain (whether PF or PNF) will call either "on continue" (we continue) or "remise de gaz" (go-around). As such, it is the captain who makes the decision at minima whether to continue or to initiate a missed approach.

Air France revised its procedures, effective 02 September 2004, to address the potential for an approach to become destabilized or for visual references to be lost after the aircraft is already past the decision altitude. The revised procedure reads as follows:

After passing decision height, if the visual references, the trajectory or the position of the aircraft evolve in a fashion to compromise the successful completion of the approach or landing, the captain must initiate a go-around or missed approach or aborted landing.

This change also applies to the procedures for non-precision approaches, circling approaches, and Category II/III ILS approaches. It was implemented in accordance with Air France's annual prevention plan (April 2004 to March 2005), which included runway excursions as a risk area to be targeted and a stated objective of improving decision making with respect to executing missed approaches where stabilization or visual references are lost after passing DH or MDA.

The normal procedure for landing the Airbus A340 specifies that the PF will begin the flare at approximately 40 feet agl while placing the thrust levers in the idle position. After main gear touchdown, the PF will select idle reverse. The PNF will announce "Reverse verts" (reversers green, indicating that the four reversers have deployed) and "Spoilers" in the order that the indications that these systems are working properly appear in the cockpit. Should a reverser not function, the PNF will announce: "La X [1, 2, 3, 4] ne passe pas" (# X (1, 2, 3, 4) not deploying), indicating which reverser has not deployed properly.

The PF will select maximum reverse once the "Reverse verts" call is heard. The procedure specifies that a landing must be completed once reversers are selected (that is, the point at which a go-around is no longer possible). It is normal to initiate reverse thrust after the nosewheel is on the runway.

During the landing roll, the PNF will monitor the autobrake system presentation on the wheels page of the ECAM to ensure correct functioning. In the event of an autobrake fault, or if it becomes necessary, the PF will apply manual braking.

At 70 knots, the PNF will announce "70 knots," at which time the PF will move the thrust levers to idle reverse, unless an emergency condition prevails. Upon reaching taxi speed, the PF moves the throttles to idle and the reversers stow. Autobrake must be disengaged before reaching 20 knots.

1.17.7 Weather Radar

The Air France suggested practices for the use of weather radar and avoidance of thunderstorms include the following:

• regularly adjust tilt and range;
• complete any manoeuvre upwind of thunderstorms;
• avoid passing less than 5000 feet above or below a storm cell;
• avoid zones of red or magenta or their edges (radar image);
• make decisions for avoiding weather before the radar echoes are within 40 nm;
• above 23 000 feet, avoid cells by 20 nm; and
• below 23 000 feet, avoid cells by 5 to 20 nm, depending upon temperature.

1.17.8 Air France Calculation of Landing Distance

The certificated landing distance is the horizontal distance from the point where the aircraft passes 50 feet agl to where the aircraft comes to a complete stop on the runway. This distance is demonstrated by the manufacturer under the following conditions:

• an aircraft speed at 50 feet equivalent to 1.23 times the stall speed in landing configuration;
• a dry, flat, hard-surfaced runway;
• standard temperature; and
• maximum braking without the use of autobrake, antiskid operative, automatic deployment of spoilers, and thrust reversers not used.

The Air France FCOM procedures state that the pilot must check before departure that the available runway length at destination is at least equal to the required landing distance for the forecast landing weight. For a dry runway, the regulatory distance required is the certificated landing distance divided by 0.6. For a wet runway, the dry runway distance is increased by 15 per cent. For a contaminated runway, the regulatory requirement is to take the longer of the following values: the length of runway required for a wet runway or the actual demonstrated landing distance required on a contaminated runway. Before departure, there were no specific Air France procedures that required the crews to make landing distance calculations that would take into account the expected or forecast environmental conditions at destination. Before commencing an approach to an airport, the pre-descent checklist called for a verification of the weather conditions at destination. The Air France pre-descent procedures did not require the crew to calculate the landing distance required for the expected landing conditions.

Chart TU 04.01.64. 14^{Footnote 15} from the MANEX is used to determine landing distance (not factored) with flaps full or flaps 3 on a dry or wet runway and with autobrake selected to low or to medium. There is a note to indicate that this is for information purposes only as certification is not conducted with autobrake. Additional charts are provided to determine the runway length (factored distance) required for landing on a contaminated runway. These are the charts to be used under normal circumstances for the determination of the suitability of a given runway.

Charts in Section 34 of the QRH are used to determine landing distance required for various weights, configurations, and runway conditions. These charts include a note that indicates that they are to be used in case of a system failure in flight. At other times, MANEX Chart TU 04.01.64. 14 is used for landings on contaminated runways or wet runways, and MANEX Chart TU 04.02.50. 13^{Footnote 16} is used for landings on contaminated runways. These charts have corrections for airport pressure altitude, tailwind, and the use of thrust reversers. There are no instructions on how these corrections are to be applied, and it was noted during the investigation that different values were obtained depending on the methods used to apply the corrections.

According to Air France, a runway is said to be contaminated with water when it is covered partially or completely with water 3 mm (1/8 inch) deep or greater. Furthermore, the terms flooded runway and standing water are used to describe this condition. Landing is prohibited (except in an emergency) on a runway with standing water greater than 13 mm deep (½ inch).

Landing on a runway contaminated with less than 13 mm (½ inch) of standing water is permitted subject to crosswind limitations. The crosswind limit is 15 knots for landing on a contaminated runway:

• when the coefficient of friction exceeds 0.25; or
• if no coefficient of friction is available, the braking is reported as medium/poor or better.

The crosswind limit for landing on a contaminated runway decreases to 10 knots:

• when the coefficient of friction is between 0.2 and 0.25; or
• if no coefficient of friction is available, the braking action is reported as poor.

The procedure to be used for landing on a contaminated runway is as follows:

• use autobrake to medium if contaminant is evenly covering runway, otherwise use manual braking;
  
• use normal approach speed;
  
• in a crosswind with a slippery runway, touch down with a crab;
  
• after a brief flare, touch down firmly;
  
• bring the nosewheel down and apply maximum reverse - do not hold the nosewheel in the air;
  
• without autobrake and where the runway length is limiting, begin braking before the nosewheel touches down, but be prepared to counter the nose-down pitching tendency produced;
  
• maintain directional control with rudder as long as possible; and
  
• use nosewheel steering with caution.

It is noted that touching down with both main gear simultaneously is desirable because this will allow full spoiler deployment. If only one main gear is in ground contact, the spoilers will deploy partially.

1.17.9 Air France Policy on the Use of Reverse Thrust on Landing

The use of reverse thrust when the aircraft is misaligned with the runway centreline can lead to a loss of directional control in crosswinds since the wind vector and reverse thrust vector are both working to take the aircraft off the side of the runway. The Air France procedure on the use of reverse thrust on landing in case of skidding or loss of directional control is identical to the Airbus procedure. The preferred technique for regaining control following a skid or loss of directional control while landing on a contaminated runway is as follows:

• immediately release brake pressure;
• return all thrust levers to idle reverse position;
• use rudder and differential braking to return to runway centreline; and
• re-apply reverse thrust and maximum braking once directional control is re-established.

1.17.10 Air France Procedures for Dealing with Windshear

Air France's GEN.OPS includes a procedure for management of possible windshear encounters. The document advises that, in the majority of accidents involving windshear, the crew had insufficient warning of the windshear to prevent the accident. Crews are advised that the means to detect windshear include ground-based systems, such as low-level windshear alert systems (LLWAS) and terminal Doppler weather radar (TDWR), which are mostly available in the United States, on board equipment for the detection and prevention of windshear, and crew vigilance to identify early effects of windshear on aircraft performance or trajectory.

For the purposes of prevention, the procedure specifies that crews should avoid areas where windshear is probable. Areas identified as presenting a strong probability of significant windshear (storms, strong precipitation, virga, etc.) must be avoided. When windshear is announced or significant storm activity exists in proximity to the airport of departure or destination, flight crew should wait for improved conditions before taking off or conducting the approach (eventually diverting the flight).

This is followed by procedures to be used where windshear may be suspected but where conditions are such that a take-off or approach may be undertaken. In general, crews are instructed to employ the predictive windshear system (if installed) to ensure that the aircraft's path is clear of windshear and to closely monitor both indicated airspeed and the aircraft's trajectory. With respect to the conduct of an approach, crews are instructed to:

• employ the recommended flap setting;
  
• increase approach speed (up to 20 knots) or, in the case of Airbus aircraft, use managed speed;
  
• aim to stabilize the approach early to allow easier detection of windshear; and
  
• when using manual thrust, avoid abrupt reductions in power in response to increasing airspeed since it is common to experience a reverse shear after passing through an initial windshear.

Procedures specific to the Airbus A340 are also presented for crews in the Airbus A340 operations manual. The procedure indicates that, if a very strong windshear is reported, or detected by the predictive windshear system, the crew should delay landing or divert to another aerodrome. Where windshear is likely and the crew elects to conduct an approach, the following actions are specified:

• use the most favourable runway;
• use weather radar and predictive windshear (if installed);
• select CONF 3;
• use managed speed on approach;
• activate the APPR phase on the MCDU;
• use 2 flight directors engaged in mode ILS, FPA or V/S;
• use autopilot if an ILS is available; and
• the use of autothrust and managed speed is recommended.

A note in the procedure indicates that, when groundspeed mini is employed, the system will command an increased speed in high wind conditions. If downdrafts are expected, crews are advised to augment VAPP on the MCDU up to a maximum of VLS + 15 knots.

In the event a windshear is suspected or encountered during landing, crews are instructed to apply the emergency procedure "Windshear TOGA." This procedure involves selecting TOGA thrust, leaving the aircraft configuration unchanged until the windshear has dissipated, and maintaining or monitoring pitch attitude to ensure altitude is maintained.

1.17.11 Air France Information on Thunderstorms

At the time of the accident, the only procedure within Air France for dealing with thunderstorms appeared in the chapter "weather radar" of the Air France MANEX TU manual (Section 1.17.7).

Air France's MAC includes a chapter dealing with the general meteorology of cumulonimbus (CB) clouds, lightning, and thunderstorms, and a chapter dealing with the theory of CB clouds, thunderstorms, and hail. These chapters provide crews with a reminder of the conditions likely to produce convective weather, the potential hazards associated with this type of weather, and the difficulties associated with forecasting or predicting where these hazards will be present.

CB clouds are unlike any other. They are the local manifestation of the effects of atmospheric convection. They can produce and focus the panoply of all the meteorological concerns that pilots can come across in their aeronautical career. In sum, CB clouds constitute a hostile aerial environment, which is inhospitable, and one must always look for the means to avoid them. At the time of the accident, there were no specific procedures within Air France for dealing with thunderstorms during approach and landing.

1.17.12 Air France - Fatigue Management

Air France has measures in place to manage the potential for fatigue during long-haul operations. For example, duty and flight times are limited and tracked; there are reserve pilots on longer flights; and on flights with only two pilots, crew members are permitted to nap in their seats during the flight, provided certain conditions are met. During the occurrence flight, neither pilot felt sufficiently tired to take the opportunity to have such a nap.

Air France, like many other airlines, has no stated requirement for flight crews to reside within a specific commute time from the departure airport; crews are required to report for work adequately rested.

1.17.13 Air France - Previous Safety Initiatives Concerning Landing Accidents

The possibility of an approach and landing accident has been a focus of Air France's Service de Prévention et Sécurité des Vols (Flight Prevention and Safety Division) for some time, and the annual prevention plan (April 2004 to March 2005) included runway excursions as a risk area to be targeted. This focus was justified by the fact that landing accidents are a preoccupation of all operators, with most accidents attributable to the reluctance by pilots to initiate a go-around at low altitude when faced with a reduction in visibility or an approach that becomes destabilized. Two specific objectives were included in this plan with respect to runway excursions: improve decision making with respect to executing missed approaches in the conditions described above, and participate in the work being undertaken by the International Air Transport Association (IATA) in this area.

Air France has taken steps to reduce the risk of this type of accident by communicating the lessons learned through previous accidents to crews, discussing the issue in recurrent training, and changing procedures to emphasize the ability to initiate a go-around anytime up to the deployment of reverse thrust. Many articles dealing with landing accidents, missed approaches when faced with dangerous weather, landing in heavy rain, and runway excursions have been published in its monthly flight safety bulletin Survol in the past years.

This issue has also been addressed in recurrent training. For example, recurrent training in 2003 included a presentation dealing with destabilized approaches on short final, leading to a loss of control during landing. Another presentation addressed the hazards associated with windshear and microburst, loss of visibility on short final, and short landings. Its concluding slide stated that "A go-around is an option that remains open up to landing. After the selection of reversers it is too late!!

In 2004, a case was put forward by the Flight Safety Department to the Standards Group to revise procedures with respect to interrupted landings. The revised procedure would require a landing to be interrupted in the event the approach becomes destabilized or visual references are lost after the decision to continue has been taken at DH or MDA. Air France conducted a survey of flight crew with respect to experience conducting a go-around.

1.17.14 Emergency Procedures

Emergency exit lighting in the cabin (including exit markings and floor-level lighting) is powered by eight independent batteries. These are controlled from the cockpit by a three-position switch: ON, OFF, and ARM. The switch is normally in the ARM position. When armed, the lights will illuminate if there is a power interruption or if the evacuation button is selected in the cabin.

The actions to be taken by the flight crew for an evacuation are contained in the evacuation checklist in the QRH. The checklist calls for the following actions:

• Aircraft stopped and parking brake set (PF)
• PA to cabin crew to take positions (captain)
• Contact ATC or ground personnel on VHF 1 (first officer)
• Cabin delta pressure verified at zero (captain)
• Engine masters OFF (captain)
• Fire cut-off (all engines and APU) (captain)
• Extinguishing agent 1 and 2 discharged (all engines and APU) (captain)
• PA to passengers (captain)
• If evacuation required - direct PA to passengers and EVAC button pushed
• If no evacuation required - normal PA to passengers

1.17.15 Air France Differences from Airbus Manuals, Procedures, and Recommendations

The Airbus FCOM provides a chart of standard calls to be expected from the PF and PNF during approach and landing. Similar to the Air France MANEX, the calls to be expected after touchdown from the PNF are, "Ground Spoilers, Reverse verts." The Airbus FCOM includes a note: "If reverse deployment is not as expected, call NO REVERSE ENGINE X or NO REVERSE, as appropriate." The Air France MANEX does not include a callout in the case that no reversers are deployed. Air France's underlying philosophy is that standard calls should only be established for specific anomalies, and establishing a callout for everything that has not happened yet would overload the crew. Given that a single reverser failing to operate has the potential to have an impact on lateral stability, Air France has chosen to maintain this callout.

According to the Airbus FCOM standard calls during approach and landing, upon reaching minima, the PNF will call "minimums" and the PF will call "landing" or "go-around - flaps" as appropriate. As such, it is the PF who makes the call to continue or go around. Air France MANEX specifies the callouts to be expected on approach. Upon hearing the "minimums" call from the PNF (or the automated callout), it is the captain who makes the call either: "On continue" or "Remise des gaz." There are two differences between the Airbus and Air France procedures. The first is the specific call to be expected if the required visual references are established. While Airbus uses "landing," Air France uses "On continue" (we continue) to emphasize the fact that a go-around may still be performed. The second difference is that Air France specifies the captain as being the one to make the decision to conduct a go-around. However, the Air France MANEX also includes a note that, if the first officer judges a go-around to be necessary, he or she must suggest it to the captain.

Air France and Airbus procedures on the use of autothrust are the same, with the exception that Airbus recommends the use of autothrust (A/THR) to manage speed on approach, even in turbulent or gusty conditions. An FCOM bulletin issued by Airbus explains the rationale and gives a suggestion of the procedures to follow under varying conditions as follows:

The A/THR is, in particular, best suited to tracking a moving target speed, when flying in managed speed mode. Statistically, the A/THR provides the best protection against airspeed excursions and its use is, therefore, recommended even in turbulent conditions, unless thrust variations become excessive.
Autothrust response to airspeed variations is the result of a design compromise between performance and comfort, and it is optimized when the AP [autopilot] is engaged. Therefore, in turbulent conditions when flying manually, the pilot may sometimes find autothrust to be too slow or lagging. If conditions are such that a large speed decrease with engines at idle is anticipated, the pilot may, above 100 feet RA (radio altimeter), move the thrust levers slightly above the CL (climb) detent to reduce the autothrust response time. This will temporarily deactivate and arm the autothrust. As soon as positive acceleration is achieved, and before the thrust becomes too high, the pilot should move the thrust levers back to the CL detent to resume A/THR operation.

After studying this suggested method, Air France did not adopt it because it was considered contrary to the Airbus golden rule related to automation. The following is extracted from the Airbus flight training "Golden Rules" card:

# 6 - When things don't go as expected - TAKE OVER and
# 7 - Use the proper level of automation for the task.

If a landing will be carried out using manual thrust, the Airbus FCTM and FCOM for the Airbus A340 recommend disconnecting autothrust above 1000 feet agl on approach.

An informal survey of pilots and operators of the Airbus A340 was conducted on the use of autothrust. Most of the airlines operating Airbus A340-300 had a high level of confidence in autothrust, and the general practice is for autothrust to be used throughout the landing. Airlines typically recommend a minimum height of 500 or 1000 feet for autothrust disconnection.

Air France only recommends the use of autothrust during approach where windshear is suspected. Many Air France pilots preferred to disconnect the autothrust when flying manually because they found control responses to be more immediate when they had manual control of both pitch and thrust. They also expressed concern about situations where the autothrust would allow engine rpm to decrease beyond the point from which recovery may not be possible.

1.17.16 Recurrent Emergency Training for Cabin Crew

In France, regulatory requirements with respect to the safety duties of cabin crews, including the organization of the emergency evacuations, and recurrent emergency procedures training for cabin crew are found in the 05 November 1987 Order. Recurrent emergency training must include practical exercises (for example, emergency drills). Annex 10 of the Order states that these practical exercises should be carried out in conditions that recreate, as near as possible, the environment that might be encountered in operations, in the presence of smoke, if possible, and that items will be scattered about the cabin to create obstacles to the evacuation.

Recurrent training programs must be submitted to the regulatory authority for approval. Cabin crew must participate in recurrent emergency procedures training every 12 months, but a 3-month grace period may extend the time to 15 months.

Cabin safety inspectors of the DGAC conduct on-site audits of air operators' initial and recurrent training programs, and conduct in-flight audits. Based on the training audits conducted by the DGAC, Air France's emergency training for cabin crew met all the current regulatory requirements and exceeded the requirements in some areas.

The TSB investigator observed a recurrent emergency procedures training session at Air France. The time allotted for each emergency evacuation drill was about 35 minutes, including a pre-drill briefing and a post-drill debriefing. During the emergency evacuation drill, no articles were scattered about the cabin to create obstacles to the evacuation, and none of the crew members who were assigned to play the role of passengers tried to take their carry-on baggage with them to the emergency exits.

1.18 Additional Information

1.18.1 Weather-Related Landing Occurrences - Internal Air France Investigations

On 04 March 1999, the crew of an Air France Boeing 737-200 aircraft was on a night approach to Biarritz Airport, France, in heavy rain and gusty winds. During the flare, the aircraft drifted to the left and departed the side of the runway. The aircraft was destroyed and came to rest alongside the runway. There was no fire or injuries. Safety action taken by Air France in light of this accident included providing additional training to crews with respect to landing in gusty crosswinds, studying available options for improving visibility in heavy rain (that is, rain repellent, treated windscreens), and taking steps to encourage airports to install centreline lighting and/or reflective markings.

On 11 September 1999, an Air France Boeing 747 was on approach to Pointe-à-Pitre Airport, French West Indies, in darkness, in stormy weather, with a storm cell located at the airport. Shortly after touchdown, the aircraft entered heavy rain and drifted to the left. The PF lost visual reference with the runway and both pilots applied right rudder to regain the centreline. Visual references were regained and the aircraft was brought under control. The aircraft had left the side of the runway, damaging several runway lights and two of the aircraft's tires. During the approach, the crew members were aware of the presence of a storm cell located over the far end of the runway and of the rain falling at the airport.

The Air France internal accident report concluded that the crew members had underestimated the effects of the storm cell on their ability to carry out a safe landing. The report also summarizes the difficulties associated with estimating the impact of a storm cell by judging the picture presented by the aircraft's radar. The report indicated that some companies provide additional guidance to crews as to whether or not to continue on final (for example, remaining 3 nm from a storm below 1000 feet agl). Following the accident, Air France examined the issue and decided that more generic information with respect to thunderstorms should be incorporated in the MAC. However, it was decided that more specific guidance to crews with respect to avoiding thunderstorms was not in line with the company culture because crews needed to be enabled to make decisions based on the particularities of each situation. It was also noted that, during this accident, reverse thrust was deployed before nosewheel contact with the ground. Following the accident, Air France conducted an analysis of recorded data from 180 landings across most aircraft types and found quite a number of instances where full reverse thrust was deployed before nosewheel contact with the ground. Given potential directional control problems related to this practice, action was recommended to emphasize the importance of waiting until the nose had commenced de-rotation before engaging full reverse thrust.

On 14 January 2001, an Air France Boeing 747 was on a Category I ILS approach at Houston, Texas, United States, with the first officer as the PF. Just after DH, the first officer indicated that he was unable to land the aircraft due to a loss of visual references. The captain took control of the aircraft for the remainder of the landing, and during the flare, both outboard engines contacted the runway.

On 25 May 2001, an Air France Airbus A340 was on a stabilized, daytime approach to Cayenne, French Guiana. On very short final, the aircraft descended below the glideslope and touched down 30 feet short of the runway. A storm had passed over the airport approximately five minutes before the aircraft began its descent. The crew could see areas of strong precipitation during the approach, and the aircraft entered precipitation on short final, although the runway could still be seen. The approach and landing were being conducted with autothrust engaged. The Air France internal investigation concluded that the aircraft had encountered an increased performance windshear at low altitude (increasing headwind) that resulted in an increased indicated airspeed and a consequent significant reduction in engine thrust initiated by the autothrust. This was quickly followed by a reversal in wind direction, resulting in a decreased performance shear, decreasing airspeed, and a departure from the normal trajectory. At this point, the captain, as PNF, announced the deviation from the glide path, the crew received a "sink rate" alarm as the aircraft began to descend, which was followed immediately by the "Retard" call. The first officer pitched the nose up in response to the sink rate alarm and retarded the thrust levers for the flare. Although the captain immediately added power, there was insufficient time to prevent the aircraft from striking the ground. The crew received no further aircraft warnings or alarms related to the airspeed because this function is inhibited below 100 feet agl. The aircraft was not equipped with predictive windshear equipment. Safety action taken by Air France in response to the 25 May 2001 accident included the following: revising its GEN.OPS to provide more information with respect to windshear; investigating the possibility of retrofitting aircraft with predictive windshear; introducing windshear exercises to recurrent training (requiring a go-around below MDA); and entering into discussions with Airbus with respect to the recommended use of autothrust in possible windshear conditions.

On 28 December 2001, an Air France Airbus A340 on very short final during a night Category I ILS approach to Port-Harcourt Airport, Nigeria, entered an area of extremely restricted visibility due to fog. At the same time, the aircraft entered an area of shifting winds (from a light headwind to a stronger quartering tailwind) that caused the aircraft to deviate from the runway centreline. The captain ordered a go-around, during which the aft portion of the fuselage contacted the ground. The first officer was the PF and the go-around was initiated by the captain advancing the thrust levers at approximately 5 feet agl. At the same time, a dual-control input was recorded with both the captain and first officer applying back pressure on the stick. This caused the aircraft to pitch up, contributing to the tail strike. Air France concluded that the captain had not intended to take control of the aircraft, but that the control input was instinctive during the go-around. Safety action taken by Air France in light of the 28 December 2001 occurrence included the following: writing expanded procedures for the conduct of go-arounds for each aircraft type, including a balked-landing procedure; installing a "dual-control" alarm in Airbus aircraft; and taking steps to improve the infrastructure at the destination airport.

On 04 March 2004, an Air France Airbus A330 was approaching the airport in Libreville Airport, Gabon, in stormy conditions. During the approach to land, the winds were reported as calm and the runway was described as wet. The crew members had the airport and runway environment in sight before reaching the MDA and they were experiencing a crosswind from the right. Just before touchdown, the winds began to shift to a quartering tailwind from the left. On touchdown, the aircraft entered a curtain of rain that reduced visibility to close to zero. The crew regained visual contact with the runway environment approximately 1 km further down the runway and regained the centreline. During the landing, the right main landing gear departed the side of the runway. Safety action identified by Air France following the 04 March 2004 accident was as follows: contacting the airport operator to emphasize the importance of accurate, up-to-date information with respect to weather; sensitizing crews to the conditions that could necessitate a go-around after MDA; promoting among crews the need to use the rain repellent system; and modifying manuals to expand the concept of contaminated runways to include water-covered runways.

1.18.2 Weather-Related Landing Occurrences - Other Operators

1.18.2.1 Hawaiian Airlines at Tahiti

France's BEA investigated a runway overrun of a Hawaiian Airlines DC-10 at Tahiti on 24 December 2000 (BEA report n-aa001224). The accident occurred when the aircraft was landing while a thunderstorm was over the airfield. The report indicated that "The accident was caused by the failure, during the preparation for the approach, to take into account the risk of a storm passing over the airfield at the time of landing." The report further elaborated on the problem faced by crews in deciding to discontinue a particular course of action, whether it be discontinuing an approach in favour of a hold or breaking off a landing to go around, as they are likely to underestimate the severity of the risks presented by this type of weather. In response, the BEA recommended that:

Operators ensure that crews are made aware of the importance of specifically planning, during the arrival briefing, for circumstances that would lead to a modification in the approach strategy, where the meteorological situation warrants it.

1.18.2.2 American Airlines at Little Rock, Arkansas

The United States National Transportation Safety Board (NTSB) investigated a 1999 runway overrun involving an American Airlines MD-83 in Little Rock, Arkansas (NTSB report DCA99 MA060). The NTSB's probable cause statement indicated that:

The probable causes of this accident were the flight crew's failure to discontinue the approach when severe thunderstorms and their associated hazards to flight operations had moved into the airport area and the crew's failure to ensure that the spoilers had extended after touchdown.

The report recognizes that the conduct of an approach in convective weather was not an isolated occurrence by including a finding that stated: "Aircraft penetration of thunderstorms occurs industry-wide." The report recognizes the potential for pilot's judgment, with respect to the advisability of penetrating a thunderstorm, to be affected by the limitations of airborne weather radar in the depiction of the severity of storms and operational factors such as stress and fatigue. It points out that there are wide variations between air carriers in terms of the guidance given to crews to help in handling such situations. The value of such guidance is summarized:

. . . these explicit, formalized cue recognition and decision aids minimize the potential for thunderstorm penetrations resulting from impaired judgment and decision making because of situational stress and fatigue (p. 142).

As a result of the investigation, the NTSB issued the following recommendation to the FAA:

Establish a joint Government-industry working group to address, understand and develop effective operational strategies and guidance to reduce thunderstorm penetrations, and verify that these strategies and guidance materials are incorporated into air carrier flight manuals and training programs as the strategies become available. The working group should focus its efforts on all facets of the airspace system, including ground and cockpit-based solutions. The near term goal of the working group should be to establish clear and objective criteria to facilitate recognition of cues associated with severe convective activity and guidance to improve flight crew decision making (A-01-55).

The FAA indicated that it had previously convened working groups on the subject, which delivered a Windshear Training Aid in 1987 and a Turbulence Training Aid in 1997 to the industry. In addition, the FAA indicated that it had convened another working group under the Commercial Aviation Safety Team (CAST) to examine issues related to turbulence and convective weather, in particular to examine the feasibility of ground-based and cockpit-based solutions.

In assessing the FAA's response to this recommendation, the NTSB cites the results of the Massachusetts Institute of Technology (MIT) research study, which demonstrated a significant incidence of aircraft penetrating convective weather as demonstrating that the training material produced by the FAA in 1987 and 1997 was ineffective at raising the awareness of the hazards associated with convective activity. The NTSB was also uncertain whether the charter of the CAST working group incorporated all the elements of the recommendation. The status of this recommendation remains "Open - Unacceptable Response."

The NTSB conducted an investigation into the 02 July 1994 accident involving a US Air DC-9 that flew into terrain while conducting a go-around in convective weather (NTSB report DCA94MA065). The investigation concluded that the aircraft had flown into a microburst produced by a thunderstorm over the airport at the time of landing. Due to the logic employed by the on-board windshear detection system, the crew did not receive a windshear warning and executed a standard missed approach procedure rather than a more aggressive windshear escape manoeuvre. Simulations conducted during the investigation demonstrated that the aircraft could have escaped the windshear if specific pitch, power, and configuration conditions had been met. The NTSB determined the probable causes of the accident to be:

. . . the flight crew's decision to continue an approach into severe convective activity that was conducive to a microburst; the flight crew's failure to establish and maintain the proper airplane attitude and thrust setting necessary to escape the windshear; and, the lack of real-time adverse weather and windshear hazard information dissemination from air traffic control, all of which led to an encounter with and failure to escape from a microburst-induced windshear that was produced by a rapidly developing thunderstorm located at the approach end of runway 18R.

The report also included a finding that indicated that the crew's decision to continue the approach may have been influenced by the information received from preceding aircraft.

1.18.2.3 Australian Transportation Safety Board

The Australian Transportation Safety Board (ATSB) conducted an investigation into a runway overrun involving a Boeing 747-400. In the overview of the accident, the ATSB noted that:

In terms of overall accident statistics, runway overruns are a relatively common event. Of the 49 accidents involving western-built, high-capacity, jet aircraft reported during 1999, 11 were landing overruns. Landing overruns typically occur when the runway is wet or contaminated and/or the aircraft is high and fast during final approach.

At the time of the accident, there was heavy rain and thunderstorms at the airport. The crew did not notice any ill effects of the weather until very short final, when the aircraft entered an area of reduced visibility in heavy rain and began to drift above the glideslope. The captain ordered a go-around and the first officer, who was the PF, advanced the thrust levers. Shortly after this, the aircraft's main gear touched down, and the captain decided to cancel the go-around by retarding the thrust levers. Reverse thrust was not selected, and the aircraft hydroplaned on the water-covered runway. The aircraft did not stop before the end of the runway.

The ATSB cited a number of errors committed by the crew, including: allowing the aircraft to get high on the glideslope; cancelling the go-around decision by retarding the thrust levers, which created confusion; and failing to deploy reverse thrust. However, from an operational point of view, the bulk of the ATSB report focused on the use of proper procedures for landing on runways contaminated with water. In particular, the ATSB concluded that the crew did not consider the possibility that the runway would be contaminated and as such employed an inappropriate approach configuration for the runway conditions. Deficiencies in information, procedures, and training provided to flight crew were cited as contributing to this occurrence.

1.18.3 Study of Go-Around Events

The IATA safety trend evaluation, analysis, and data exchange system (STEADES) conducted an analysis of 4991 go-around events between January 2003 and September 2004.^{Footnote 17} Motivated by a finding by IATA's Accident Classification Working Group that 1 in 3 approach and landing accidents in 2003 could have been avoided by a timely decision to go around, the purpose of the study was to develop a better understanding of the factors leading to go-around events. At the first level of analysis, 34 per cent of go-arounds were attributed to traffic management, 22 per cent to meteorology, 16 per cent to unstable approaches, and 28 per cent to other. Within the meteorology group, reports were categorized into sub-groups in order of frequency: windshear; insufficient visual reference; and tailwind, turbulence and severe weather (includes at least two of the other events). An interesting observation is made with respect to the reports involving tailwinds:

The series of threats outlined in the Tailwind sub-group can be laid out in a chain, where each factor compounds risk upon the previous, creating a scenario where the outcome becomes increasingly dangerous. The chain begins in communicating with the ATC unit supervising the approach. Twenty-one per cent of the higher Risk Ratio Tailwind ASRs [accident safety reports] included poor or missing meteorological/information briefings on approach factoring into the decision to go-around. Onboard inertial reference systems (IRS) will accurately calculate the tailwind velocity components on the approach, but they often become unreliable and over-read when measurements are conducted within ground effect, close to the runway (IATA, 2005).

1.18.4 Studies of Penetrations into Convective Weather

A number of studies have been conducted at the Lincoln Laboratory, MIT, to identify the factors that contribute to decisions of flight crews to penetrate convective weather. The value of these studies to the present occurrence are that they conclusively demonstrate that flight crews are disposed to fly into convective weather when entering into a terminal area for landing, which would be avoided during the en route phase of flight. These studies revealed the following findings of note:

• Aircraft were more likely to penetrate significant weather when they were closer to the airport.
  
• Aircraft were more likely to penetrate significant weather when they were closely following another aircraft that had already gone through.
  
• Aircraft were more likely to penetrate significant weather when they were more than 15 minutes behind schedule.
  
• Aircraft were more likely to penetrate convective weather during the hours of darkness.
  
• Pilots use visual cues outside the aircraft to help make the decision to deviate around convective weather.
  
• The difference in the number of storm penetrations in en route and terminal airspace is striking. Pilots almost never penetrated level 2+ precipitation in the en route regime, whereas they penetrated it hundreds of times in the terminal area.

The authors presented a number of possible reasons for this difference. First, thunderstorms may be harder to detect for aircraft that are landing given that they are flying low, in busy terminal airspace. Therefore, workload, ground clutter, and frequent turns may make it more difficult to make effective use of on-board radar. Second, assuming crews are able to detect the weather, avoiding it in terminal airspace incurs a greater cost than avoiding weather en route, as it could result in a missed approach or necessitate a diversion. Finally, pilots in the terminal area have fewer options to deviate around weather due to traffic density and the confines of the approach.

The findings of these combined studies clearly indicate that aircraft penetrations into heavy precipitation returns in terminal areas are common. Further, most of these encounters result in no adverse consequences. The difference in penetrations between the en route and terminal areas would strongly suggest that pilots are aware of the risks of flying into thunderstorms en route and will choose to avoid this where possible, but that they are willing to accept the risk of flying into heavy precipitation when landing.

One author indicated that penetration of storms near an airport is sometimes abruptly interrupted by pilots, presumably because of windshear alerts given by air traffic controllers or cautionary pilot reports from other penetrating aircraft. The presentation of heavy precipitation on radar screens is insufficient to convince pilots not to enter a particular area; however, once one aircraft breaks off the approach, or another piece of information becomes available to indicate that it may not be a good idea to continue, following crews are more likely to avoid the same convective weather.

1.18.5 Research into Pilot Decision Making - Assessment of Risk and Weather

Researchers at the NASA (National Aeronautics and Space Administration) Ames Research Center conducted a review of decision errors identified in a sample of NTSB-investigated aviation accidents ^{Footnote 18}, ^{Footnote 19} with the aim of understanding the factors contributing to decision errors and the most effective means of preventing such errors. The authors identified multiple instances where the crew persevered with a course of action in the face of evidence that this course of action was inappropriate. They hypothesized four factors that likely contribute to such decision errors: ambiguity of information; dynamically changing risks; goal conflicts (organizational or social pressures); and unanticipated consequences.

All four of these influences can be seen to have an impact on a crew's decision to conduct an approach in the face of convective weather. Convective weather is unpredictable, and it is difficult to provide clear indications of the severity of the convective weather. Crews are faced with convective weather on a regular basis and have likely landed successfully in close proximity to storms in the past. Crews are focused on reaching destination and diverting is in conflict with that goal. Finally, decisions with respect to how to deal with thunderstorms during approach and landing are required during the busiest portion of the flight, where resources for projecting the full impact of available information on the future state of the flight are most limited.

This is made more difficult by the way risks are perceived in an operational setting. In an FAA study of risk perception and risk tolerance in pilots,^{Footnote 20} the authors concluded that it was a misperception of risks, rather than a high tolerance to risks, that had a greater influence on pilots' decisions with respect to various hazards. In other words, pilots underestimated the risks associated with particular activities; they did not simply accept a high level of risk. Further, the authors demonstrated that experience was inversely related with perception of risk; as experience increases, the perceived level of risk associated with a given hazard decreases.

In light of the above influences on decision making, one can envisage possible countermeasures to decision errors. Steps may be taken to reduce the ambiguity of information (for example, through predictive weather displays), to improve crew's estimations of risk (for example, through training or decision aids), to remove goal conflicts (for example, through the use of clear weather limits), or to provide tools to assist crew members in anticipating the possible outcomes of a particular course of action.

Elgin and Thomas (2004)^{Footnote 21} employed current models of decision making and situation awareness as a framework to understand how existing weather products assist crews in making weather-related decisions with a view toward developing improved representations of the weather situation. They begin with the premise that one's ability to maintain situational awareness with respect to weather is dependant upon both the accuracy and availability of weather information and the phase of flight. The authors cite McAdaragh (2002)^{Footnote 22} who outlines the characteristics of the weather products that are required to optimize decision making at each phase of the flight.

In the pre-operational phase, the time available to review and assimilate information makes any available weather product or existing decision aid appropriate for use. During the operational planning phase, the greater time pressure means that weather information should ideally be presented in a format that minimizes the amount of synthesis and interpretation required on the part of the user. Weather data that will assist during this phase of flight include most recent updates of existing conditions and on-board information such as weather radar. Finally, the operational immediate phase involves significant time pressure, and thus information must be presented in a manner that permits easy understanding within a brief moment of attention and should be presented in real time. The most immediate example of this type of information is on-board weather radar.

1.18.6 Flight Safety Foundation - Approach and Landing Accident Reduction Report

The Flight Safety Foundation (FSF) convened a task force to study approach and landing accidents. The task force produced the approach and landing accident reduction (ALAR) tool kit, which summarized the findings of the task force and recommended preventive action to reduce approach and landing accidents in various categories.

A briefing note included within the tool kit^{Footnote 23} specifically addresses runway excursions and runway overruns. It is noted that 20 per cent of 76 approach and landing accidents and serious incidents worldwide between 1984 and 1997 fell into the categories of runway overruns or runway excursions.

The tool kit suggests a number of prevention strategies that may be taken to reduce the likelihood of the situations listed above in the areas of policies, standard operating procedures, performance data, procedures, and crew awareness or have an impact on them. Of note to the subject occurrence type are recommendations to establish a policy to encourage a go-around where it is warranted, to establish a policy to prohibit landing outside the touchdown zone, to establish procedures for identifying the amount of runway remaining, and to enhance crew's awareness of the relationship between crosswind limitations and runway conditions.

An additional briefing note deals with human factors in approach and landing accidents.^{Footnote 24} The briefing note points out that repetitive briefings, done as a formality, have limited value over time. Briefings need to address the specific circumstances of the approach that may present a threat to the safety of the flight. Also, the briefing note points out the failure of crews to recognize a changing situation, specifically to changes in wind direction and the potential for crews to remain unaware of the need to modify a plan of action. This may be due to a reluctance to seek additional information or verify landing data as a situation progresses, or a lack of time to observe, evaluate, and control the aircraft attitude and flight path in a dynamic situation.

1.18.7 Research into Crew Management of Risk

To better understand the role of the crew in managing risk during normal operations, the NASA University of Texas Human Factors Crew Resource Project has developed a model, called the Threat and Error Management (TEM) model. The model has been effectively used to gather data during routine flight operations through line operations safety audits (LOSA).

The model is based on the premise that, in every flight, hazards that must be handled by the crew will be present. These hazards increase the risks during a flight and are termed "threats" in the TEM model. Threats include such things as weather conditions, traffic, aircraft serviceability issues, unfamiliar airports, etc. Provided the crew members have an opportunity to handle the threat, effective management of the hazard leads to a positive outcome with no adverse consequences (that is, the crew members take action to mitigate the threat). However, mismanagement of the threat can lead to crew error, which the crew must also manage. Mismanagement of crew error may lead to an undesired aircraft state, which can lead to an accident. At any point, effective management of the situation by the crew can mitigate the risk, and the situation may be inconsequential.

The TEM model identifies five types of errors: intentional non-compliance (violations of SOPs); procedural errors (slips, lapses in the application of procedures); communication errors (information is incorrectly transmitted or interpreted); proficiency errors (skill or knowledge is lacking to manage the aircraft); and operational decision errors (where a decision is taken that increases the risk of the flight). Crew responses to errors may be to trap the error by identifying and correcting it, to exacerbate the error by making a subsequent error, or to make no response to the error.

With respect to crew errors, 64 per cent of observed flight segments contained at least one error. On average, each flight segment contained 2 errors, with a maximum of 14 errors observed in one flight segment. Descent, approach, and landing were the flight segments where the most crew errors were observed, with most errors relating to the use of checklists, automation, and crew proficiency. Further, more than any other flight segment, errors observed during this phase of flight had the greatest potential to result in adverse consequences.

The most common crew behaviours cited for effective error management included vigilance and crew member advocacy and inquiry. CRM can be defined as the effective use of resources by the crew to ensure a safe flight. The data above clearly demonstrate that, although threats and errors are present in the majority of flight segments, they rarely carry significant consequences because they are effectively managed by the crew. Therefore, the management of risks on the flight deck is inextricably linked to effective CRM.

1.18.8 Public Address System

When the captain tried to use the PA, it did not work. It is not known what information/directions the captain intended to broadcast had the PA system been working. The timing of the captain's attempt to use the PA relative to the timing of the announcements made by cabin crew could not be determined.

Cabin crew made three announcements via the PA system before it stopped working. The first PA made by cabin crew was a direct PA stating "Everything is OK - Remain Seated." The aft purser immediately made a second direct PA, in French only, stating "Door 4 left, I see flames, fire. I am evacuating door 4 right - I am evacuating." The chief purser did not hear the aft purser's PA concerning the fire. Other cabin crew heard the PA. The chief purser was subsequently told by the forward purser that there was a fire. The third and final announcement made using the PA system was the command to evacuate the aircraft made by the chief purser. The chief purser attempted to repeat the command to evacuate, but the PA system was no longer working.

In 1995, the TSB published a document entitled A Safety Study of Evacuations of Large, Passenger-Carrying Aircraft (report SA9501).^{Footnote 25} Twenty-one occurrences involving emergency evacuations were reviewed. In 8 of the 21 occurrences, the aircraft's PA system was inoperable or inaudible following the accident. As a result, cabin crew and/or passengers did not hear the initial command to evacuate and/or did not hear other emergency instructions. The onset of these evacuations was delayed, placing the safety of passengers and crew at risk.

1.18.9 Evacuation Alert System

After the chief purser gave the command to evacuate, he pressed the EVAC/CMD button on the FAP, signalling to the flight crew to activate the evacuation alert system. The system is designed to operate as follows: when the EVAC/CMD button is pushed, it illuminates and the EVAC/ON pushbutton located in the flight deck flashes red and rings three times. The purpose of activating the evacuation alert system is to ensure that all cabin crew know that they are to initiate an evacuation immediately. When the chief purser pushed the EVAC/CMD button, it did not illuminate. Neither member of the flight crew noticed that the EVAC/ON pushbutton in the flight deck flashed red or rang three times.

Nevertheless, the captain later stated he had pushed the EVAC ON pushbutton to activate the evacuation alert system, but that the system did not respond. The timing of the captain's attempt to activate the system in relation to the chief purser's actions could not be determined.

As part of this investigation, the position of all the switches/toggles, etc. in the flight deck were recorded and/or photographed. The EVAC ON pushbutton was found in the out position, that is, the normal position. When the button is pushed in to activate the system, the button should remain in. If the button is pushed a second time, it pops back out to the normal position. The design of the evacuation alert system allowed for the system to be activated from the FAP and the flight deck. However, Air France operating procedures called for the system to be set up so that it could only be activated from the flight deck, that is, the toggle switch in the flight deck was maintained in the CAPT position, rather than the CAPT & PURSER position.

In the previously mentioned TSB safety study, one of the safety issues addressed was crew communication during evacuations and communications equipment. In light of the communication problems identified in the TSB study and based on the premise that an evacuation alarm unequivocally and immediately delivers a message throughout the aircraft that an evacuation needs to begin, the NTSB reiterated its earlier recommendation (A-98-22) that "newly manufactured aircraft should be equipped with independently powered evacuation alarm systems operable from each crew member station."

The NTSB's recommendation with respect to activation of evacuation alert systems from each cabin crew station is supported by the SAE International, which recommends that ". . . evacuation control [of aircraft evacuation signal systems] should be located at each cabin crew's station near the door operating mechanism and in the flight compartment. . . ." The FAA did not accept NTSB's recommendation.

1.18.10 Aircraft Emergency Lighting

Based on information provided by cabin crew and passengers and from completed passenger safety questionnaires, it appears that, during the impact sequence, the regular lighting system in the cabin went out. The emergency lighting system came on, flickered, went off in some areas of the cabin and remained on in other areas. The floor escape path marking system lights were not on in the passenger aisle leading to the R4 emergency exit door during the evacuation. Photos taken by passengers inside the cabin during the evacuation confirmed that the ceiling exit sign adjacent to the exit L2 was lit. The emergency lighting in the forward cabin likely failed at the same time as the PA system.

In the passenger safety questionnaire, passengers were asked to report on visibility after the aircraft came to a stop. In all, 20 per cent of respondents reported that, from their seats, they could see only a "few rows around them"; 14 per cent reported that they could only see "a few seats around them." Respondents did not indicate why their visibility was restricted, although they were asked to do so. Although it was somewhat dark in the cabin, the ability of the passengers to evacuate was not compromised by insufficient lighting.

1.18.11 Viewing Windows - Assessing Exterior Hazards in an Evacuation

When the aircraft was certified, there was no requirement to equip emergency exits with viewing windows. Nevertheless, the aircraft had viewing windows in each emergency exit door. The radius of the circular prismatic lens in the viewing windows was approximately 15 cm (6 inches). The angle of vision for the outside view was approximately 31° symmetrical in all directions. Outside viewing, with a distance of 1 m between the eyes and the inner pane of the viewing window, provided a cone of visible area of 62°.

Air France procedures for emergency evacuations call for cabin crew to assess the exterior conditions before opening an exit to determine if there are hazards that would preclude using the exit. Cabin crew are trained to complete this task by looking through the viewing window in the exit door or the nearest cabin window. In this occurrence, the L3 cabin attendant did not use the viewing window to assess the exterior conditions because it was too small for her to clearly observe the conditions outside. She left the attendant station, went into the passenger seating area, looked out a cabin window, and saw the fire outside. She subsequently returned to the emergency exit, blocked it, and redirected passengers.

The only thing visible to the L1 cabin crew through the viewing window was light. When the emergency exit was opened, it was usable.

The R3 cabin attendant assessed the exterior conditions using the viewing window but did not see the fire below the exit or the wreckage in the slide deployment path. When the emergency exit door was opened, black smoke entered the cabin and the slide deflated when it contacted sharp pieces of wreckage.

The R1 cabin attendant assessed the exterior conditions using the viewing window, but did not see that there was a creek outside until the exit was opened. When the slide deployed, the foot of it was very near the water. The cabin crew blocked the exit and redirected passengers.

Although it was raining heavily, none of the cabin crew felt that their ability to visually assess the outside conditions was hampered by the rain.

In a 1992 investigation, the NTSB identified the risk to passenger safety created by cabin crew when they leave their emergency exit and enter the passenger seating area to assess exterior conditions. On 30 July 1992, during daylight hours, a Lockheed L-1011 was destroyed by fire after the crew executed a take-off followed by an immediate emergency landing at KJFK. The cabin attendant responsible for exit L2 was unable to clearly see the conditions outside through the viewing window, and left her exit and moved to a passenger window to see the conditions outside. After assessing the conditions through the passenger window, she found it impossible to return to her exit because passengers blocked the aisle leading to it. Another cabin attendant assumed her position at the exit and, when told by the L2 cabin attendant that it was clear outside, opened the exit door, allowing passengers to escape from the burning aircraft.

The NTSB examined a viewing window on another Lockheed L-1011 operated by the air carrier to determine why the cabin crew had been unable to clearly see the conditions outside through the viewing window. They found that several of the outside window panes were crazed or scratched to the extent that it was difficult to view the ground clearly. Some other window panes also had scratches or crazing that interfered with a clear view, especially when looking aft. Due to extensive fire damage, it could not be determined if the condition of the viewing windows on AFR358 contributed to the cabin attendant's difficulty in assessing the conditions outside the aircraft in this occurrence.

1.18.12 Safety Briefing Cards for Passengers Travelling on the Flight Deck

JAR-OPS 1.285, Subpart D, Passenger Briefing, states in part that operators shall ensure that passengers travelling on the flight deck are provided, before the flight, with a safety briefing card on which picture-type instructions indicate the operation of emergency equipment and exits likely to be used by passengers. In this occurrence, the passenger seated in the flight deck was given a safety briefing card specific to the flight deck. The card indicated that, in the event of an evacuation, occupants were to evacuate via the forward crew/passenger doors. The card did not include egress information with respect to the evacuation/decompression panel in the flight deck door or the emergency exit windows located on either side of the flight deck. The passenger received a verbal safety briefing before departure, but he was not advised of the location and use of the emergency descent rope. The passenger evacuated the aircraft by jumping from the left emergency exit window, which the captain had opened to throw out his flight bag. The descent rope was found dangling outside the left window, but it is not known if it had been rolled out at the time the passenger jumped out.

1.18.13 Brace-for-Impact Commands

When the aircraft left the runway, it bounced violently and repeatedly until it came to an abrupt stop in the ravine. On each impact, occupants were propelled upward from their seats; a minimum of three distinct impacts were reported. Simultaneously, occupants were subjected to longitudinal decelerating forces. A number of passengers hit their heads on the seat-back in front of them and/or on the cabin sidewall panels.

During this time, the cabin crew did not instruct passengers as to what actions they should take relevant to the emergency situation at hand, that is, they did not instruct passengers to assume brace-for-impact protective positions. European regulations do not require such "brace command" and, therefore, do not require any recurrent training in the event of an unexpected accident. Therefore, Air France's emergency procedures for cabin crew revealed that they did not include a requirement to shout BRACE commands in the event of an unexpected accident. Notably, cabin crew are only required to shout BRACE commands in prepared emergency landings. TC regulations require cabin crew manuals and cabin crew training programs to include procedures for cabin crew to shout BRACE commands at the first indication of a potential accident.

In 1996, during the investigation of a Boeing 747 runway excursion on take-off, the NTSB determined that only 3 of 12 cabin crew members shouted brace commands during the impact sequence. Citing the importance of providing emergency instructions that are known to prevent or reduce passenger injuries, the NTSB recommended that the FAA:

Issue a flight standards information bulletin to principal operations inspectors of 14 CFR, Part 121 air carriers, to ensure that cabin crew training programs stress the importance of shouting the appropriate protective instructions [BRACE COMMANDS] at the first indication of a potential accident, even when flight attendants are uncertain of the precise nature of the situation. (A-96-156)

Current FAA training requirements for cabin crew stipulate that cabin crew members must be trained to command passengers to assume protective positions (brace positions) in unanticipated impact conditions.

1.18.14 Provision of Safety Information - Recommended Brace-for-Impact Positions

Although the passengers of AFR358 were not directed to BRACE during the impact sequence, some passengers did assume brace positions. However, the actions and positions taken may not all have been appropriate. For instance, some passengers held onto the sides of the seat-back in front of them to brace themselves. In a study assessing passengers' knowledge with respect to appropriate brace positions, it was determined that approximately 50 per cent of passengers (including frequent flyers) did not know how to assume an appropriate brace position, and that the most common unsafe position cited was sitting upright rather than bent forward.

Information regarding two brace-for-impact positions was available to the passengers of AFR358 on the safety information cards. The first showed an occupant sitting upright, head tipped slightly downward, hands clasping the armrest. The second showed an occupant bent forward, forearms folded across the knees. The occupant's head was not touching the knees. The words "OU/OR" were found between the two diagrams. Air France personnel advised that the upright brace position was meant for passengers travelling in economy because the limited distance between seat rows prevented economy passengers from bending forward 90° and that the second brace position, bent-forward, was for business-class passengers where the seat pitch is greater. In addition, it was reported that the brace positions depicted on the safety information cards were accepted by the DGAC.

A review of the safety literature did not identify any studies recommending an upright brace position for passengers. As part of this investigation, over 50 safety information cards from other air carriers, including European carriers, were reviewed. Only two air operators recommended upright brace positions.

TC, the FAA, the SAE International, the UK CAA, and Australian CAA all recommend either of the following two brace positions: aircraft occupants are bent forward against the seat-back in front of them (high-density seating - typically economy seating), or with their head face-down on their knees, arms wrapped behind/under legs (low-density seating - typically business and/or first-class seating).

1.18.15 Provision of Safety Information Regarding Carry-on Baggage

In Canada, TC's Commercial Air Services Standard 725.43, Briefing of Passengers, covers the mandatory briefing items that must be given to passengers before and after take-off, in flight during certain conditions, and before landing. There is no requirement to brief passengers to leave their carry-on baggage behind should the need for an emergency evacuation arise. Likewise, there was no regulatory or company requirement for Air France to conduct such briefings. Although there was no regulatory requirement to include this information on the safety information cards, the Air France safety information cards on board AFR358 included a pictorial that informed passengers of the prohibition.

Existing data suggest that less than half of passengers read safety information cards. In a 1989 survey of Canadian air travellers, it was found that only 29 per cent of passengers read or looked at safety information cards. In a survey of passengers involved in emergency evacuations, conducted by the NTSB in 2000, 68 per cent of the passengers reported that they had not read the safety information card.

Air France emergency procedures called for cabin crew to inform passengers during an evacuation that they must leave their carry-on baggage on board the aircraft by shouting "LAISSEZ VOS BAGAGES/LEAVE YOUR LUGGAGE." The cabin crew of AFR358 shouted this command throughout the occurrence evacuation in both languages, as per their emergency procedures.

Despite this order, 49 per cent of questionnaire respondents attempted to bring their carry-on baggage with them when they exited the aircraft. However, 48 per cent reported that carry-on baggage slowed the evacuation, in that the aisles leading to the emergency exits were blocked by people retrieving their baggage. In one instance, when a cabin crew told a passenger that she could not evacuate with her baggage, another passenger responded, "Don't pay attention, we have enough time." In a second case, a cabin attendant noted that a passenger blocked egress while retrieving and arranging items in his carry-on baggage. The passenger did not respond to the attendant's commands to leave his baggage and go to the emergency exit, nor did he respond to the angry comments from passengers standing behind him. Consequently, the attendant had to redirect passengers through the middle bank of seats to the other side of the aircraft to access the only available emergency exit in the aft cabin.

Fifteen years before this occurrence, the Engineering Society for Advancing Mobility: Land, Sea, Air, and Space issued an Aerospace Information Report identifying the hazards created by passengers retrieving and evacuating with carry-on baggage during emergency evacuations of transport aircraft. The report stated the following:

This process can slow the evacuation, possibly damage the slide, and create the problem of where to place the items taken from the passengers during the evacuation. Passengers who have used slides while carrying items have been unable to stabilize their descent, thereby increasing the risk of incurring injuries.

To mitigate these risks, the SAE International recommended that "Passengers should be informed during pre-flight emergency [safety] briefings . . . of the prohibition of evacuating with carry-on-items during an emergency." To date, there is no regulation in Canada concerning directives to passengers during pre-flight or pre-landing briefings related to the prohibition to evacuate with carry-on items during an emergency.

1.18.16 Provision of Safety Information During an Emergency - Language

Air France's normal and emergency operating procedures call for provision of safety information in French and English. Safety information provided to passengers in preparation for a planned emergency landing/ditching must also be given in both languages. Information collected in the passenger safety questionnaire indicated that 77 per cent of the passengers on AFR358 understood English, while 54 per cent understood French. In all, 11 per cent of the passengers had trouble understanding the evacuation instructions due to language.

1.18.17 Portable Emergency Equipment - Smoke Hoods and Megaphones

The aircraft was equipped with 13 smoke hoods for cabin crew, 11 of which were located at the cabin crew stations, and two megaphones (one at the L1 cabin crew station, the other at the L4 station), as per the applicable regulations. The smoke hoods were certified in accordance with specifications found in Technical Standard Order (TSO) TSO-C116, Crewmember Protective Breathing Equipment. The TSO states in part that "the unit must allow intelligible two-way communication. . . ." Smoke hoods for cabin crew were equipped with a phonic membrane to enhance the speaker's ability to communicate effectively.

The TSO also states that the device is not intended as an evacuation aid. However, Section 3.0, Minimum Performance Standards, Subsection 3.11, states: "The unit must allow intelligible two-way communication, including the use of airplane interphone and megaphone. The user must be able to communicate with a user or nonuser at a distance of at least four meters. A background noise of 65 db and a user communication sound level of 85 db or equivalent method is recommended."

There was a significant amount of black smoke in the area of the L3 cabin crew station. Consequently, the L3 cabin attendant donned a smoke hood; however, she subsequently removed it because the passengers could not hear/understand what she was saying to them.

During the recurrent emergency procedures training session for cabin crew observed by a TSB investigator and a representative of the BEA, each cabin crew member was required to shout an emergency command while wearing a smoke hood. Even when standing beside the cabin crew members, it was very difficult to hear/understand what they were saying. Each cabin crew member was subsequently given a megaphone, shown how to position it in relation to the smoke hood's phonic membrane, and asked to shout the same command. Commands given with the assistance of a megaphone were not difficult to hear. In this occurrence, the L3 cabin attendant did not have ready access to either megaphone on the aircraft. Regulations that speak to accessibility of emergency equipment state that "The commander shall ensure that relevant emergency equipment remains easily accessible for immediate use." Relevant emergency equipment is not defined in the regulations.

1.18.18 Dual-Lane Slides

Dual-lane slides are designed to enhance the rate of egress by enabling evacuees to slide simultaneously in each lane. Certification specifications for dual-lane slides found in TSO-C69c do not specify whether evacuees are expected to jump onto the slide two at a time. The required rate of egress, however, is clearly stated: "The device must be shown . . . to be capable of safely accommodating evacuees at a rate of at least 70 evacuees per minute per lane." Goodrich Corporation advised that, when they test dual-lane slides, their subjects are trained to use the slide, and they jump onto the slide two at a time. Under these testing conditions, Goodrich Corporation has attained 80 evacuees per minute per lane. However, Goodrich Corporation also indicated that people rarely jump onto the slide two at a time, except during such tests.

Airbus advised that the Airbus A340 did not have a full-scale evacuation demonstration, which would have included occupants evacuating via dual-lane slides. Evacuation demonstration requirements were met through analysis based on the full-scale evacuation demonstration test conducted on the Airbus A300-600. The Airbus A340 doors are the same size as the A300 doors and the slides are similar, except that the A340 slides are longer. Although an evacuation demonstration was apparently video-recorded, a copy of this video, or any other video showing aircraft occupants evacuating via emergency exit doors and dual-lane slides, has not been provided to the TSB.

Following a review of Air France's emergency evacuation procedures and discussions with Air France training personnel, it was confirmed that their evacuation procedures for dual-lane slides called for cabin crew to instruct passengers to form two lines at the entrance to the slide and to instruct passengers to jump onto the slide two at a time by using the command "JUMP." Cabin crew members train for this procedure during aircraft qualifications training and recurrent emergency procedures training. Photo 9, taken by investigators at the Air France cabin crew training facility, in September 2005, shows the slide training device used by cabin crew.

The occurrence cabin crew noted that there was not enough room to form two lines of passengers at the entrance of the slide. Moreover, cabin crew conveyed that it was somewhat difficult for two passengers to jump onto the slide simultaneously, given the position of the slide in relation to the door opening and the location of the exit door alongside the exterior fuselage. One cabin attendant assisting at the bottom of a slide noted that passengers tended to jump onto the middle of the slide. All of the escape slides used during the evacuation of AFR358 were dual-lane slides. Only 23 per cent of passengers who indicated that they evacuated via an escape slide reported that they went beside another passenger.

There is no regulatory requirement for dual-lane slides to be equipped with a raised divider or other feature indicating that the slide comprises two lanes. However, Goodrich Corporation advised that there were divider tubes on the dual-lane slides installed on the aircraft. The dividers on the canted dual-lane slides at the L2 and R2 emergency exits were prominent; the dividers were designed to prevent cross-flow effects. Dividers on the other dual-lane slides at the other emergency exits were not prominent. In the safety questionnaire sent to AFR358 passengers, passengers were asked, "If you used an emergency slide, was it a dual-lane slide?" to which 63 per cent of respondents answered "No."

1.19 Useful or Effective Investigation Techniques

1.19.1 Use of Flight Data Recorder and Cockpit Voice Recorder Animation as an Interview Tool

During the investigation, the flight crew members were interviewed by TSB investigators on several occasions. The final interview was conducted approximately six weeks after the accident, which has the potential for some loss in the ability to remember specific events.

The FDR animation was successfully used to structure the final interview, which was conducted in three stages. In the first stage, the flight crew members, who in this instance were interviewed together, were provided an opportunity to ask questions and to discuss any thoughts they had had about the accident since their last discussion with TSB investigators. In the second stage, the FDR animation with no CVR overlay was played for the crew. During the playback, they were encouraged to talk through what was happening during the various stages of the approach. The animation was stopped and backed up as required to facilitate the discussion. In the third stage, the FDR animation was played for the flight crew with the CVR overlay added, and the above process was repeated.

This interview framework was noteworthy in that the use of the animation stimulated the crew to recall specific events. The use of the animation also provided a common frame of reference for aircraft position and location. For example, in discussing the weather during the approach, the crew members were able to position the aircraft where the weather began to deteriorate and point out what areas of the airport they could see.

The use of this technique provided a corollary benefit for the crew. Having been through the trauma of an accident, both crew members had spent significant time and energy considering what had happened and questioning what had gone wrong. The use of the animation provided them an opportunity to review the accident sequence and answer many of these questions for themselves. Both crew members appreciated this opportunity.

2.1 Introduction

All aircraft systems were serviceable and working as designed throughout the approach and landing for AFR358. Therefore, a mechanical malfunction did not contribute to this accident. The analysis will concentrate mainly on the human factors and decision-making processes that were at play during the accident flight.

There have been numerous investigation reports and studies completed on runway overrun accidents, as reported in the Factual Information of this report. Although most overrun accidents, including this one, have unique elements, there are also many similarities. Throughout the industry, the information available concerning runway overrun accidents has been used to develop awareness programs and improved training procedures. Before this accident, Air France recognized the potential for overrun accidents in its operation and took measures to prevent such an occurrence. However, despite its targeted efforts, the overrun accident in Toronto essentially fits the pattern of the accident these programs and training procedures were aimed at preventing.

In hindsight, the risk presented by the rapidly deteriorating weather conditions was greater than most pilots would deem acceptable. However, when the AFR358 pilots assessed the available weather information and the traffic flow into the airport, they did not expect that such a severe deterioration in the weather was imminent. This analysis will discuss the circumstances that led to the overrun of AFR358, the adequacy of the defences that were intended to prevent this occurrence, and the initiatives that could lead to improved defences.

2.2 Aircraft

2.2.1 Emergency Exit Door L2

There was no plausible explanation found for the opening of the L2 door. The possibility that something might have hit the outer handle to trigger the opening of the door while the aircraft was crashing through fences and guard rails and sliding into the ravine through shrubbery was assessed. It was considered unlikely that this happened because the outside handle is recessed and there was no indication of mechanical damage to the handle or to the door in the handle vicinity. In addition, when the outside handle is activated, the slide deployment is automatically disarmed. Since the girt bar was found in the door sill and the arming lever in the armed position, it is reasonable to conclude that the door was not opened with the outside handle.

Consideration was also given to the possibility of the interior door panel becoming loose and unseating the interior handle from its position. In the area of the handle recess, the interior panel is securely fastened to the door frame structure by screws. It is highly unlikely that the screws and fasteners would become loose to allow the paneling to contact the door handle. Many hypotheses were studied to try to establish how this door opened. None of these hypotheses could be proven. However, the analysis positively concluded that the inside door handle had to be raised in order for the door to open. How this handle moved could not be determined.

The door started to open while the aircraft was still moving. It is possible that an asymmetric pull on the slide's release cable had developed, causing the aft release pin to jam and bend. However, if the release pin jammed, it may have prevented complete opening of the door. Since the forward pin pulled out, the forward end of the packboard was freed from the front rail, which remained attached to the door. The door would continue the predetermined trajectory, that is, move out and translate forward. The front end of the packboard would drag along the door sill while pivoting around the rear end still connected to the rear attachment rail, which travels with the door. The opening of the door would continue until the front end of the packboard butted up against the door frame or the cabin crew seat. At that point, the door would be open enough to permit passengers in single file to jump out. The packboard, because of its orientation (rear end attached to the partially open door and front end resting against the door frame) would not represent an obstacle to exiting passengers. From the deformed packboard remnant in relation to the lug, the angle of the resting position of the packboard was determined to be approximately 40° with respect to the door.

When the slide assembly started to deploy, it was hindered by the jamming of the aft release pin. In fact, the girt portion of the slide assembly, which is attached to the girt bar in the door sill, unravelled enough to protrude from the partially open door. This seems to be supported by one picture submitted by a passenger. A dark grey material (colour of the girt) is seen extending beyond the bottom of the door. It would also explain why there were no remnants of the girt found, as it would have been consumed by fire. The door, the packboard, and the girt would remain in the stuck position until the fire consumed a substantial amount of the packboard and the door support arm weakened. The attitude of the aircraft at rest (nose-down and roll to the right) would tend to favour the packboard and slide assembly falling into the cabin during the ensuing fire rather than falling to the ground.

As a result of the door having opened in this manner, the potential for smoke/fire to freely enter the cabin was introduced, presenting a significant risk to the passengers and crew. There was no attempt by the cabin crew to close this door because passengers were either exiting or being pushed through it soon after the aircraft stopped moving.

2.2.2 Aircraft Air Data Inertial Reference System - Wind Calculation

The wind speed and direction is presented to the crew's navigation displays (NDs) by the air data inertial reference system (ADIRS). Airbus documentation on this system states the following: "The wind information presented to the crew is computed from the difference between groundspeed (GS) and true airspeed (TAS) for the speed, and track (TRK) and heading (HDG) for the direction." Two aspects need to be considered for the accuracy of the wind information:

• the yaw movements: Indeed, during a yaw movement, transitorily, the value seen on the NDs could be different than the one seen by the ADIRS unit. However, as soon as the yaw is stabilized, the value seen should be the same; and
  
• the GS and TAS accuracy: Indeed, considering the accuracy of each component used for the wind speed and direction, ADIRS unit computation, the wind speed and direction displayed to the crew have to be used with care.
  GS accuracy: ± 8 knots - TAS accuracy: ± 4 knots
  Wind (> 50 knots) accuracy: ± 12 knots and ± 10°
  True track: ± 2.3° with GS=200 knots
  True heading: ± 0.4°

It should be noted that the precision on the value of the wind is not given for wind speeds below 50 knots. Furthermore, because the groundspeed accuracy was about six knots off at the time of landing, the rear wind component shown on the NDs was therefore underestimated.

2.3 Airports

2.3.1 Runway End Safety Areas

The asphalt blast pad beyond the end of Runway 24L extends for 30 m and is followed by a downward-sloping, grassy area. This area is not prepared or advertised as a stopway, nor is it required to be by Canadian regulations. In accordance with TP 312E, published in 1993, and the related ICAO standard, a strip shall extend beyond the end of the runway for a distance of at least 60 m, which the grassy area does. The ICAO standard further states that a RESA must extend from the end of the strip to a distance of at least 90 m, and that the downward slope should not exceed 5 per cent. Since TP 312E only recommends that airports meet the minimum length of 90 m for a RESA, airports are not required to provide it.

The distance from the end of the runway to the beginning of the perimeter road was 155.7 m along the centreline of the runway, which is the approximate path followed by the aircraft. Although there is no RESA published for the runway, the distance along this path was actually within the distance stipulated for a RESA in the applicable ICAO standard. Nevertheless, the ditch by Convair Drive, the fences, and the ravine beyond, with its concrete pillars supporting the approach lighting for Runway 06R, largely contributed to the damage incurred by the aircraft and the injuries to the crew and passengers.

As early as 1989, the FAA established airport design criteria that included a requirement for a RSA length of 300 m (1000 feet). By 1999, in recognition of the enhanced safety of a longer RESA, ICAO recommended that a RESA should extend at least 240 m beyond the end of the runway strip. Had a RESA been designed and published for Runway 24L in accordance with the ICAO recommended practice, an obstacle-free overrun area, free of hazardous ruts, depressions, and other surface variations, would have extended to a distance approximately 75 m beyond Convair Drive.

As stated in Section 1.10.11, alternative solutions do exist for runways that cannot meet the RESA standard or where the area beyond the RESA does not meet the recent ICAO recommended practice of a 240 m overrun area beyond the 60 m runway strip. The EMAS technology is designed to stop an aircraft where it is not possible to construct a 300 m (ICAO 60 m + 240 m) or FAA 300 m overrun. This technology has demonstrated that it provides an alternative for runways where natural obstacles, such as bodies of water or sharp drop-offs, as in the case of Runway 24L, make the construction of a standard safety area impracticable. Had Runway 24L been designed with a RESA built to ICAO recommended practice, the FAA standard, or the FAA alternate means of compliance, the damage to the aircraft and injuries to the passengers may have been reduced.

2.3.2 Adequacy of Aircraft Rescue and Fire Fighting Aircraft Familiarization Charts (TP 11183)

The aircraft crash charts binder (previously TP 11183) recovered from one of the GTAA fire trucks did not contain familiarization charts for the Airbus A340. Important information such as locations and volumes of fuel tanks, fuel lines, emergency exits, battery locations, emergency penetration points and other information provide firefighters a quick reference when response is required. While the presence of outdated hard-copy crash charts had no adverse impact on the GTAA response, it does highlight inefficiencies in the CAR requirements for the provision of crash chart information.

There is no regulatory requirement for an airport authority to possess appropriate aircraft charts. However, the CARs state that it is the responsibility of airport authorities to obtain and maintain an appropriate set of charts for training purposes. Aircraft manufacturers make these charts readily available for airport authorities. Regulations currently proposed by TC regarding airport emergency planning will establish a requirement for airport authorities to possess current charts for aircraft that regularly use the airport.

2.3.3 Adequacy of Wind Information

The two wind-recording locations at CYYZ are necessary to provide valid wind information to crews landing on widely separated runways. For purposes of providing separate wind indications, these two locations are seen as redundant and controllers are directed to provide wind information from the serviceable site if the other is not serviceable. The failure of the south field WADDS unit should have caused controllers to provide wind information to landing aircraft from the north field site. No such information was passed. As well, in the quickly changing conditions at the time, wind information from a measuring site far removed from the landing runway would have had no value.

Windsock-based information provided to the tower by the two landing aircraft immediately ahead of AFR358 provided data about the wind on the runway, and this information was transmitted to the crew of AFR358. The wind information provided by ATC to aircraft provides data about the wind at the recording point, not as it is affecting the aircraft at its position.

Nevertheless, wind information is critical to aircrew during the landing, particularly in adverse weather conditions when much of their attention is concentrated on maintaining visual contact with the runway. In these situations, controllers often continue to provide wind information beyond that required in the operations manual. Since the ability of controllers to provide immediate and relevant wind information could prove critical to the safe landing of an aircraft, the provision of this service should not hinge on the failure of a single electronic component.

2.4 Weather

2.4.1 Adequacy of Meteorological Data

The forecasters at the CMAC-E of the MSC followed the relevant standards to produce the TAFs (regular and amended issues) and to issue convective SIGMETs. The forecasters introduced thunderstorms in TAFs as early as 14 hours before the accident. These thunderstorms were kept in all TAFs as a 30 per cent probability up to two hours before the accident. The last TAF issued 1.5 hours before the accident indicated a TEMPO (temporary change) of thunderstorms with visibilities of 2 sm until four minutes before AFR358 landed, thereafter a PROB 30 of the same conditions. Also, a SIGMET indicating a line of thunderstorms was issued 45 minutes before the accident. Based on the information available to the forecasters at issue time, the forecasts were of good quality and complied with accepted practices. All the forecasts met the standards and were issued on time.

2.4.2 Weather Information Provided by Air Traffic Control

The Air Traffic Control Manual of Operations requires controllers to provide landing information to aircraft. In Toronto, the latest weather is recorded on the ATIS for use by inbound crews. ATIS message Uniform was the latest available weather information, and the AFR358 crew members indicated that they had received Uniform when they contacted Toronto arrival. Apart from the information provided through ATIS, ATC endeavours to provide other information that would be of assistance to aircrew. Information concerning poor braking action was passed on several occasions. The radar used in the Toronto tower by ATC is not specialized weather radar and does not provide highly detailed weather information. Therefore, the crew of AFR358 had a better view of radar-derived weather information from their aircraft's weather radar than the controllers did from their own display.

There is no indication that more sophisticated weather radar information, had it been available to ATC and communicated to the crew of AFR358, would have altered their decision to continue to land. However, without some indication of the speed and direction of intense, rapidly moving weather phenomena, controllers are limited in their ability to provide information that might be of assistance to aircrew. Controllers attempt to use the runway most nearly aligned into the wind. However, because of weather and ILS outages due to lightning strikes, the landing runway had been changed several times.

At 1856, the ILS localizer for Runway 24R became unserviceable, forcing the use of Runway 23 for some time. Some arriving aircraft, however, were refusing the approach to Runway 23 because of the nearness of the storms north of the approach path. At 1913, the ILS glideslope for Runway 23 became unserviceable and, with the unserviceability of the glideslope for Runway 24R, the only remaining runway aligned into wind was Runway 24L. Under normal circumstances, the preferred approach and landing runway is announced in the ATIS broadcast. Equipment outages for extended periods are advertised by NOTAMs. There was no indication from the crew that use of Runway 24L was unacceptable. The final decision on the acceptability of a particular runway rests with the aircraft captain.

Given the limitations of the information available on board, crews may require assistance in projecting the weather situation into the future and may look to ATC for additional information. This was certainly the case in the accident flight because the crew made multiple requests to ATC during the initial approach phase for information with respect to the developing weather conditions. Crews may believe that ATC will be able to provide the most up-to-date information as they have local climatological knowledge, are located at the airport (in the case of tower controllers), and may be aware of what other aircraft are experiencing. However, ATC's ability to provide up-to-date weather information during rapidly changing conditions observed with thunderstorm activity is quite limited. Further, some crews have an inaccurate belief that ATC will close airports based on weather conditions.

2.5 Flight Operations

2.5.1 Crew Rest

There is little information to suggest that the occurrence crew members were fatigued or that their performance was degraded by the effects of fatigue. The accident occurred at approximately 1600 local time, which is 2200 at the crew's point of departure, the time zone to which the crew were adapted. This does not correspond to a circadian low. Although the crew members were nearing the end of a long flight, they were only 10.5 hours into their duty day. While the crew members were naturally feeling tired from the flight, particularly given that this is one of the longer flights Air France conducts without an augmented crew, the duty day was not so long that the performance of a normal, healthy individual should be adversely affected by fatigue.

Both the captain and first officer had been off for sufficient time before the flight to allow them to obtain sufficient restorative sleep, and both were well rested before beginning the flight. Although the captain had declared that he had recently been experiencing an unusual level of fatigue, the aeromedical centre (AMC) had determined that his condition did not affect his fitness to fly. Based on AMC's determination, Air France medical staff put in place a reduced flight schedule for the captain. BEA's medical physician was requested to provide an assessment of the possible impact of the captain's medical situation on his performance. No medical assessment was available to the TSB.

2.5.2 The Accident Flight

There was nothing unusual in the pre-flight activities of the flight crew. The addition of three tonnes of holding fuel for the accident flight was considered standard practice for the weather conditions that were forecast. There was no perceived pressure within the company to preclude carrying additional fuel, and the captain was not hesitant to do so.

For Air France flights, the primary alternate is selected by the company's flight planning software based solely on proximity. However, the flight crew must ultimately determine a suitable alternate after assessing the weather and any other operational factors. The ease with which flight plans can be modified ensures that flight crews are not under any undue pressure to automatically accept the closest airport.

While en route, although the pilots were not receiving updated TAF information for their destination or alternates, the forecast weather did not change appreciably. Therefore, it is unlikely that they would have altered their decision making, even if they had received the updated TAF information.

As they came closer to Toronto, the flight crew members were concerned about the thundershower activity at destination. Initially, their concern was focused more on the approach delays caused by the thundershowers than on the potential for the thundershower activity to adversely affect the flight during the approach. They were not alone in this thinking, as several other aircraft were making the same assessments and judgments about the delays and weather conditions. Some pilots chose to divert, while others decided to continue. To preserve the option of a diversion, the AFR358 pilots were closely monitoring their fuel to ensure that they had enough to divert to CYOW.

In preparation for landing, the pilots gave extra attention to monitoring the weather and calculating diversion fuel requirements. Neither of these activities was unusual, and there is no indication that these activities kept the pilots from effectively completing other piloting activities, with one exception: the non-formal completion of the pre-landing checklist. All checklist items were completed, but not through the normal challenge and response process. There is no indication that they became so focused on weather and fuel considerations that they lost their ability to assess the big picture.

There is no indication that the pilots determined the landing distance required for a landing at CYYZ for any of the possible runway conditions that they could have faced. The Air France procedures did not require a determination of landing distance required.

As the approach continued, the pilots knew that the weather near the runway would be affected by the nearby CB clouds. However, they assessed that their margin of safety was not unduly compromised. They briefed the windshear procedure and were prepared to initiate an immediate go-around in the event that they received a windshear alert. Their decision to continue with the approach was consistent with normal industry practice, in that they could continue with the intent to land while maintaining the option to break off the approach if they assessed that the conditions were becoming unsafe. Until the decision height of 200 feet, the aircraft was stabilized, although an airspeed increase and a deviation above the glideslope were beginning to occur around this height. From then on, the deviations were below the threshold at which the PNF was required to make a call regarding the deviations.

The point at which the situation changed from normal and manageable to abnormal and critical was near the runway threshold when the aircraft entered the perimeter of the cell activity. At this time, a number of circumstances combined, leading directly to the accident.

The PF was monitoring the airspeed trend vector and responded to an indication of decreasing airspeed by adding power; however, he kept it there too long. Had the autothrust been engaged, the engine power would have been adjusted to maintain the proper airspeed, and it would have been more likely that the aircraft would have been landed closer to the target touchdown point. At that very time, both pilots became preoccupied with the reduced forward visibility, and airspeed scanning rate decreased. Without the airspeed control provided through the autothrust, the increase in energy from the extra thrust increased the airspeed and groundspeed.

As they crossed the runway threshold, with the heavy rain, low visibility, lightning, and shifting winds, the flight crew members became overwhelmed by the severe weather conditions and became task saturated, making a normal landing difficult. The pilots, who were by this time both focusing primarily outside the aircraft, were not aware that a wind shift was also occurring. While they were in the flare and the initial float, the pilots did not appreciate how much of the runway was being used up. The tailwind component contributed to the aircraft going above the glideslope and to the overall landing distance required.

The heavy rain obscured vision through the windshield and severely reduced the forward visibility. Both pilots were relying heavily on the side windows to try to determine the position of the aircraft, laterally and vertically. This caused the additional problem in that both of them were now fully concentrating on trying to determine the position of the aircraft. This might partially account for the slow reaction time of the PF to reduce power to idle. In such circumstances, it can be difficult to keep a trajectory toward, or even distinguish, the normal aiming point on the runway.

The FDR readout shows that, at touchdown, the aircraft was not aligned with the runway and it was not on the centreline. During this part of the landing, the PF was fully occupied in dealing with aligning the aircraft and keeping it on the runway in the crosswind conditions.

The delay in deploying the thrust reversers can be attributed to pilot task overload during the touchdown phase. During the confusion, the standard "Spoilers" and "Reverse verts" calls were not made by the PNF. Had the required calls been made, the PF may have used the reversers earlier. The PF was completely engaged in keeping control of the aircraft to avoid drifting off the edge of the runway. In view of the reduced visibility, it would have been difficult for him to rapidly correct for deviations from the centreline. Even if the thrust reversers had been deployed, it is unlikely that the PF would have selected full reverse in the early stages of the rollout because Air France procedures, in accordance with the FCOM, call for reverse thrust to be reduced if the aircraft is not aligned and/or is drifting off the centreline in crosswind conditions.

The delay in the selection of the thrust reversers and the subsequent delay in the application of full reverse thrust added to the landing distance needed. The condition of the runway reduced the braking action available to bring the aircraft to a stop on the remaining runway. Due to the rapidly shifting winds, the crosswind limitation for a contaminated runway was exceeded; this factor increased the difficulty faced by the crew in maintaining the runway centreline. At the point where the aircraft touched down, for contaminated runway conditions, there was not enough runway remaining to bring the aircraft to a stop. According to the second chart in Section 1.6.4, with the 10-knot tailwind prevailing at the time of landing, the aircraft would not have stopped in the runway remaining, even if the runway had been wet instead of contaminated.

Air France Airbus A340 crews have the option of conducting a go-around during an approach when it becomes evident that it is unsafe to land. In theory, the decision to go around can be made as late as when the aircraft is on the ground, as long as reversers are not yet selected. Under normal conditions, this is not a problem.

When the aircraft was near the threshold, there were ominous thunderstorms with lightning strikes on the missed approach path. At this point, the crew members became committed to landing and believed that their option to go around no longer existed.

2.5.3 Autopilot and Autothrust Use

Air France provides no specific direction to its pilots as to when to disconnect the autopilot while conducting a Category I approach. Similarly, Airbus makes no recommendation on this issue. The autopilot is certified for use down to 160 feet agl for Category I approaches, but the crew disengaged the autopilot at about 350 feet. It would be beneficial to study the advantages of keeping the autopilot engaged down to the lowest altitude authorized during approaches when weather is on the limits for the approach and/or in poor visibility conditions. This would reduce the pilots' workload and allow them to concentrate on other tasks.

Air France's practice as to when to disconnect the autothrust differs from the Airbus recommendation and from the practice of the other operators who were surveyed. There appears to be much more consensus from Airbus pilots about following the Airbus recommendation to leave the autothrust engaged throughout the approach because its use reduces the workload of the PF. As well, the autothrust can generally react faster and more accurately than a pilot to control airspeed. The results of the simulator testing support the use of autothrust throughout the approach.

The glideslope and airspeed deviations on short final, following a normal, stabilized approach, can be attributed directly to the severe and unexpected weather conditions. However, analysis of this accident has shown that keeping the autothrust engaged would have significantly reduced the crew's work level.

2.5.4 Approaches in Convective Weather

Thunderstorms can present a significant risk to the safe operation of an aircraft, and the ability of flight crews to assess the risks associated with these hazards in a timely manner is critical to flight safety. Despite the risks associated with these hazards, both research and previous accident investigations have shown that the penetration of convective weather in terminal areas during approach to landing is an industry-wide practice. The same research shows that aircraft most often deviate around convective weather outside the terminal area where there are more options available. Therefore, pilots are aware of the hazards presented by convective weather but regularly determine that the risk associated with flight into convective weather is acceptable to facilitate landing at destination.

The nature of convective weather and the quality of information available to crews to assist in assessing the risks associated with convective weather make it difficult to obtain a clear picture of the actual level of risk associated with a particular storm. In fact, convective weather has all the factors associated with an increased probability of decision errors in previous studies of pilot decision making. Convective weather is dynamic, and many of the most significant hazards described above occur rapidly and with little warning (for example, rapid changes in wind speed or direction, in visibility, in runway conditions).

Further, much of the information available to a flight crew is ambiguous in that it only provides indirect information with respect to the individual hazard. While heavy precipitation returns are associated with all the hazards of convective weather, one can often see heavy precipitation returns without experiencing any hazards. Therefore, multiple sources of information must be combined to make a judgment about the actual risk at the time and to project what the weather will be like in the future. This judgment can easily result in an underestimation of the risks. The likelihood of underestimating the risk associated with convective weather increases with each successive encounter with convective weather that does not produce adverse consequences. Furthermore, such decisions are made in the face of competing goals; making a decision to divert based on ambiguous information in a highly changeable situation may be difficult for a crew to justify.

The crew members were well aware of the presence of thunderstorms in the Toronto area. They had been forecast to occur, and the crew had elected to carry extra fuel to increase their available options on arrival at Toronto. During the descent and approach, the crew members were actively seeking additional information about the weather and examining the viability of various alternates. They had been receiving regular updates on the conditions in Toronto, having made multiple requests for the METAR and having received the active SIGMET through the ATIS broadcast. During the approach, they were receiving information that clearly indicated that there was significant weather over the airport: the weather radar was showing red areas close to the runway, there were pilot reports of poor braking action, the crew could see lightning in the vicinity of the airport, and several pilot reports indicated that the winds were increasing and changing direction. In spite of all these cues, the crew members determined that there was no clear indication that the approach should be discontinued, and they became committed to land. They had briefed for a diversion and were ready to go around.

It was not until very short final that there were clear indications available to the crew that the flight had progressed to a point where landing was not advisable - the aircraft had departed the glideslope and entered an area of intense precipitation and reduced visibility. The crew had two courses of action with potentially undesirable outcomes: proceed with an approach that was becoming increasingly difficult, or conduct a missed approach into potentially dangerous conditions. At that moment, although Air France procedures called for a go-around anytime the ideal trajectory is not maintained up to thrust reverser deployment, the captain, doubting that a go-around could be conducted safely, committed to continue with the landing.

Air France had identified the potential for a weather-related landing accident and had made addressing this risk a focus of its flight safety program before the accident. The primary action taken in this regard by Air France was to practice and encourage a go-around anytime up to thrust reverser deployment. While this goes some way toward addressing the risk of this type of accident, it does not completely address the problem faced by a crew approaching into convective weather; the hazards particular to convective weather, including windshear and microburst, may increase the risks associated with a low-energy go-around. Further, these hazards may present themselves with little warning. While these phenomena are possible with any thunderstorm, they are not present with all thunderstorms. As was the case in this occurrence, conditions can change very quickly, with one aircraft encountering manageable conditions on approach and the next experiencing quite different conditions.

For the cruise portion of the flight, Air France, like other airlines, has clear guidelines as to how far the aircraft should be operated from convective weather. Although crews are still required to exercise some judgment in these situations, they have some clearly established best practices to follow. However, for the approach and landing portions of the flight, no such guidelines exist at Air France and many other airlines. Following Air France's 1999 accident at Pointe-à-Pitre, the company reviewed the feasibility of incorporating such guidelines into its MANEX. Although the company's internal accident report clearly identified the difficulty involved in being able to assess the risks associated with convective weather, the review concluded that such guidelines were contrary to the goal of enabling crews to make decisions based upon each specific situation.

However, some companies do provide such guidelines and, in some cases, directives related to approaches around thunderstorms. Previous accident investigations have recognized their value to assist crews in making decisions in situations where the choices before them are less than obvious. These guidelines and directives have a direct effect in minimizing the impact of operational pressures, stress, and fatigue on such decisions. In the absence of clear guidelines with respect to the conduct of approaches into convective weather, there is a greater likelihood that crews will continue with approaches into such conditions.

2.5.5 Weather Information for Predicting Convective Weather

The ability of flight crews to develop an accurate assessment of the current and future state of the weather is critical to effective decision making. Due to increasing time pressure nearing top of descent and during approach and landing, information should be presented in a format that minimizes the amount of synthesis and interpretation required of the user. Given the aim of developing situational awareness, the weather information presented should also allow the user to project into the future and anticipate the future state of the weather.

This occurrence clearly demonstrates how the changeable, unpredictable nature of convective weather makes it difficult to achieve these aims. In this occurrence, although the crew made a concerted effort to gather information with respect to the current weather conditions and although they were offered additional information with respect to wind and runway condition by the tower before landing, they were very surprised by the intensity of the weather encountered as they approached the threshold.

The perception of the crew during the approach was in contrast to the perception of many who were in a position to view the intensity of the storm from the ground in the minutes before the accident. The difference in perception of the storm was not limited to the accident flight crew in that they were one in a line of aircraft on approach for landing. Aircraft landed on Runway 24L approximately 9, 6, 4, and 2 minutes before the landing of AFR358 and there was at least one additional aircraft on approach behind the occurrence flight. It is noteworthy that all these crews had also elected to conduct their approaches in conditions similar to those encountered by AFR358.

Therefore, when dealing with convective weather, the information available to a flight crew on approach does not optimally assist the crew in developing a clear idea of the weather that may be encountered later in the approach. Given the localized, changeable nature of thunderstorms, the weather experienced by those close to or under the storm may not be anticipated by those approaching the storm.

2.5.6 Landing on Contaminated Runways

For the Airbus A340-300, the maximum crosswind limit is 10 or 15 knots if the runway is contaminated. The flight crew was aware that heavy rain was occurring over the landing runway. During the approach, they observed the runway to be shiny, like the surface of a lake. These indications suggest that there would likely be more than 3 mm of water on the runway; however, the flight crew members either did not take this into account or realize this when they continued with the approach and landing, although they knew that the crosswind exceeded 10 knots.

The flight crew members were aware of the landing distance available when using Runway 24L, but there is no indication that they were aware that the MANEX full-flap landing distance required when using a contaminated runway with a tailwind exceeded the runway length of Runway 24L.

In addition, the flight crew had reports from the two previous landing aircraft that the braking action was poor. Air France procedures that apply to the Airbus A340 for the above statement stipulate that, if no measured coefficient of friction is available, the runway is to be considered as contaminated if the braking action is reported as poor.

During the investigation, a number of pilots, from Air France and other operators, were consulted about operations on water-covered runways. There is widespread consensus that the lack of runway condition information in heavy precipitation is a safety issue; however, there is no consensus as to how reports of braking action from preceding aircraft are interpreted by following aircraft. This is especially the case if the preceding aircraft is relatively small compared to the following aircraft.

Flight crews are expected to adhere to the limitations for their aircraft, including the crosswind limits. However, for operations on wet runways, there is no definitive way for flight crews to determine runway conditions such as water depth before landing. Pilot reports about braking are not consistently given sufficient consideration in decision making.

2.5.7 Crew Resource Management / Threat and Error Management

The principal threat to which AFR358 was exposed was the forecast convective weather at the planned time of arrival at destination and at the alternate. This threat was mitigated by the crew by the addition of three tonnes of additional fuel, which would allow the aircraft to hold for approximately 23 additional minutes. Given the normally transitory nature of thunderstorms, the crew felt that this was an adequate measure.

At 1950, the crew members observed red on their radar display near their intended approach flight path and decided to continue the approach with caution. This may be seen as an operational decision error through the framework provided by the TEM model; the decision error increased the risk to which the flight was exposed. However, the continuation of approaches into convective weather is widespread throughout the industry and the crew members took action to mitigate the threat by reviewing the windshear recovery procedure and discussing their flight path in the event a missed approach was required. They discussed where the cells were located, and planned to turn left and go in between the two cells if they had to overshoot. The above is an indication that, at 1950, the crew still believed that an aborted approach could be safely conducted at anytime during the approach.

During the late stages of the approach, the general threat of convective weather, which the crew had been anticipating and taking action to mitigate throughout the flight, began to manifest itself as more specific hazards. At the time, although the combination of these hazards was ominous, it was not sufficiently compelling to the crew to warrant breaking off the approach. Specifically, the threats were a significant crosswind, reports of poor braking action, and reduced visibility due to heavy rain and lightning. The crew took action to address two of these items individually: the autobrakes were set to medium to account for the runway surface condition; the captain discussed the need for a positive touchdown on the wet runway; and the PNF was monitoring the winds and advising the PF.

The crew coordination throughout the flight and the initial part of the approach was reasonably effective. Significant threat management behaviour was observed on the part of the crew, and errors observed were trapped or inconsequential. The overall risk to which the flight was exposed increased during the late stages, when the crew elected to continue their approach in proximity to convective weather. This led the aircraft to be exposed to the threats of reduced visibility and a crosswind-tailwind component. Cues received earlier in the approach were not sufficiently compelling to the crew to cause them to abandon the approach. The inability of the crew to anticipate and then respond to the threats that occurred late in the approach led to several proficiency errors and ultimately to the aircraft's departure from the glide path. The crew's underestimation of the hazards associated with the thunderstorm at the airport cannot be attributed to inadequate interaction and communication.

2.5.8 Use of Rain Repellent

At Air France, the rain repellent capability of the aircraft had been put back into operational service in 2002, but the occurrence crew was unaware that this capability had been reinstated. A survey among other pilots flying aircraft that have this system revealed that many of them either do not use or do not know under what conditions it would be advantageous to use it. The industry would benefit from more definitive information about the efficiency of rain repellent systems and more guidance on their use, to include the timing of the application.

2.5.9 Captain-Only Missed Approach Call

At Air France, the decision on whether to initiate a go-around, a missed approach, or a balked landing (hereinafter called a missed approach) is made by the captain, regardless of who is flying the aircraft. However, the first officer has a responsibility to suggest a missed approach if he or she deems it necessary. Having more than one pilot responsible for making the call about a missed approach can increase the likelihood that an unsafe condition will be recognized early and decrease the time it might otherwise take to initiate the missed approach.

2.5.10 Decision-Making Training for Difficult Approaches

This accident has a large number of factors in common with many similar accidents. These accidents happened during day and night approaches and involved well-trained crews. The crews had landed their aircraft in difficult conditions before and prided themselves in their ability and professionalism. Thorough accident investigations into accidents similar to this one, along with very well thought-out conclusions, findings, and recommendations, have not made much of a dent in the number of such accidents, which continue to happen around the world. In fact, 20 such accidents to large commercial operators have occurred in the last five years. Furthermore, a number of recent incidents, with similar factors involved, clearly had the potential for catastrophic results. If this trend continues, the resultant risk of loss of life and damage to property and the environment will increase considerably. This is worrisome because it is a clear indication that, in spite of the efforts of all concerned, and although we are learning from these accidents or the experiences of others, we seem unable to develop adequate tools to mitigate this specific risk.

Some or all of the following conditions were present in all of these accidents:

• the crews were on approach behind or in front of other aircraft that were landing or intending to land;
  
• a CB cloud or monsoon storm was approaching or was over the landing area at the time of landing;
  
• heavy rainfall was occurring;
  
• the runway was contaminated by water;
  
• poor braking action was either reported by previous aircraft or was experienced by the crew of the accident aircraft;
  
• there was a strong crosswind, tailwind, or combination of both;
  
• the aircraft deviated from the target speed and glideslope on short final;
  
• there was a windshear, perhaps associated with downdrafts;
  
• a missed approach or balked landing was not considered or attempted;
  
• the aircraft landed long;
  
• the after-touchdown actions by the crews were non-standard; and
  
• most often present, the accident crew members were subjected to sudden reduced visibility, which they had not anticipated properly and which they were not prepared to deal with.

In spite of all the warning signs evidenced by the above conditions, the crews of the accident aircraft were confident in their ability to perform a safe landing. The decision to continue the landing after the runway environment was lost was most often the final condition leading to the accident.

Crews need to be more acutely aware that an approach near convective weather is a hazardous situation to begin with. They must acquire a better understanding of all the conditions that they may expect to be faced with on final approach. They must be ready to conduct a missed approach at anytime one of these conditions escapes their control or understanding. They must not get themselves into a situation where the missed approach option is no longer available.

In this accident, a number of the developing conditions discussed above escaped the understanding, and therefore control, of the crew early enough on the approach. These conditions warranted a decision to go to the alternate before it was felt by the captain that an overshoot was no longer an option.

When a crew arrives at the DH on a precision approach, there are two options to consider: continue and land or go around. The go-around decision is the easiest because every pilot trains for such a possibility or eventuality. The aim of recurrent and annual simulator training rides is to confirm that crews will indeed conduct a missed approach when the visibility criteria are not met at the DH.

On the other hand, a decision to continue and land when the visible cues are very faint at best at DH is a stressful one for a pilot. Should visual cues then diminish or disappear after the decision to land has been made, the first feeling or impression on the part of pilots is one of incomprehension, followed by a period of inaction, where they wonder what just happened, and where they wish that things will get back to normal soon. This lack of reaction while waiting for the runway environment to re-appear is because the brain becomes task saturated at that very moment, unless the pilot has been trained to react instinctively and immediately to the threat. Naturally, the correct action must be an immediate go-around. The Board believes that, if more training could be done in this respect, the rate of these types of accidents would decrease.

2.6 Survivability

2.6.1 General

The evacuation was successful due to the training and actions of the whole cabin crew. With few exceptions, the performance of the cabin crew was exemplary and professional, and was a significant factor in the successful evacuation of the accident. There was effective communication between the flight crew and the cabin crew. Because the cabin crew were advised of the possibility of a missed approach, they were in a state of heightened awareness during the landing phase and were, therefore, prepared to respond immediately in the event of an emergency.

The availability of three supplemental cabin crew members on AFR358 undoubtedly contributed to the success of the evacuation, as evidenced by the roles they played during the evacuation. Two were in command of passenger evacuations at emergency exits and the third played a pivotal role in opening an emergency exit and subsequently assisted passengers at the foot of the R4 slide.

2.6.2 Fire

The indications are that the integrity of the fuel tanks was compromised once the aircraft crossed Convair Drive. Once the fuel started leaking, the inboard engines or sparks from metal-to-metal contact could have ignited the fuel. Alternately, hydraulic fluid leaking from the landing gear may have provided the initial fuel and the overheated brakes, the ignition source. There was no significant fire before the aircraft reached the ravine, and when the aircraft stopped, the fire intensified. The leaking and pooling fuel provided an abundant supply to feed the fire. Initially, the fire in the wing roots did not directly involve the fuselage. The intensity of the fire grew while the evacuation was in progress, and shortly after the completion of the evacuation, the fuselage was engulfed in flames. The cabin furnishing, carry-on luggage, and cargo hold contents sustained the fire. The dilution of the firefighting foam agent by the heavy downpour reduced its efficiency in dousing the fire.

2.6.3 Aircraft Seats

In October 1989, the Joint Aviation Authorities (JAA) issued Change 13 to JAR 25. In the case of the Emergency Landing Conditions (JAR 25.561 and 25.562), the new provisions were very similar to FAR Amendment 25-64, with identical static load factors and dynamic tests. The principal difference was that, in the JAR change, the dynamic test requirements were to apply only to passenger seating whereas, in FAR Amendment 25-64, the dynamic test requirements applied both to passenger and to crew seating. The cockpit seats of AFR358 were therefore certified to JAR 25.561. The design documents indicated that the cockpit seats exceeded the requirements of JAR 25.561, but did not meet the dynamic load requirements of JAR 25.562, the requirement for the passenger seats. The EASA certification standards exempt the flight deck crew seats from having to comply with the requirements of Certification Standard 25.562. The investigation could not determine the maximum +g (positive) forces attained in the accident because the FDR stopped recording sometime before the aircraft came to rest. However, the passenger seats did not fail. It was not possible to determine whether the failure of the captain's seat alleviated the impact loading on his body, or added to his injuries.

2.6.4 Passenger Safety and Evacuation

2.6.4.1 Cockpit Safety Briefing Checklist

A safety briefing checklist for passengers travelling in the cockpit did not exist, and the briefing given from memory to the passenger seated there did not contain all the required information. The level of oversight exercised by the regulatory authority with respect to safety information cards did not facilitate identification of cards being used by air carriers that were missing safety information.

2.6.4.2 Pre-Landing Safety Briefings

In the event of an emergency evacuation on landing following a long flight, there is a risk that passengers may have forgotten critical safety information presented some hours earlier during the pre-departure safety briefing. Passengers could obtain and review the information they require from the safety information card; however, the passenger survey revealed that less than one-third of the passengers surveyed reported reading the safety information card. Including additional important information, such as the location of emergency exits and the dangers of retrieving carry-on baggage in an emergency evacuation in the pre-landing safety briefing would be beneficial. This would mitigate the aforementioned risk and enhance passenger safety. At the present time, Canadian regulations state, with regard to flights over four hours' duration, that the pre-landing briefing contain, in addition to non-emergency instructions, the location of emergency exits but do not reference carry-on items.

It is mandatory to inform passengers of the appropriate actions to take when expecting or preparing for an emergency situation; however, Air France emergency procedures as well as French regulations do not require cabin crew to direct passengers to brace in the event of a sudden, unexpected accident, thus increasing the probability of impact injuries to passengers in these circumstances.

2.6.4.3 Brace Position

The upright brace position illustrated on Air France safety information cards is not a recommended brace position in the United States and Canada nor is it recommended by a number of respected aviation regulatory authorities. Safety studies show that it does not provide adequate protection against flailing or secondary impact injuries. Moreover, depending on the occurrence circumstances, passengers bracing in this manner may be at greater risk of incurring spinal injuries. Injuries, even minor ones, impede passengers' abilities to evacuate successfully. Impediments to egress present a particularly significant risk to passenger safety in aircraft accidents involving post-crash fires.

2.6.4.4 Passenger Cabin and Baggage

Because fire consumed most of the aircraft, investigators were unable to examine the latches on the overhead stowage compartments, the galley doors, and the curtain rods that detached. Further, the amount of g forces experienced could not be determined for reasons stated earlier. Consequently, the exact g forces required for the door latches to release and the curtain rods to detach could not be clearly established. Some of these door latches and curtain rods opened or detached during the impact sequence. Carry-on baggage and other items spilled into the cabin, potentially injuring passengers and creating debris in the aisles leading to the emergency exits, thereby impeding emergency egress.

Although Commercial Air Services Standard 725.43 requires a number of items to be briefed for the safety of passengers before take-off and landing, this standard makes no mention of any requirement to warn the passengers about the dangers of attempting to take their carry-on baggage with them should an emergency evacuation be required. Research has shown that, during evacuations, the safety of passengers and crew continues to be jeopardized by passengers (approximately 50 per cent) who retrieve their carry-on baggage before evacuating. There are at least two factors that influence passengers' behaviour with respect to retrieval of carry-on baggage. The first is human's propensity for affiliative behaviour in emergency situations. Affiliative behaviour manifests itself as passenger movement toward the familiar, most commonly displayed as passengers collecting carry-on baggage from overhead bins (trains, aircraft) or by returning to their cabin (trains, cruise ships, ferries) to collect valuables before evacuating. A second contributing factor is inadequate provision of safety information. Many passengers may not know that they are not to evacuate an aircraft with their carry-on baggage. Less than half of passengers look at or read safety information cards, and under present regulations, this is the only means by which such information is provided to them before departure.

Although cabin crew shout to passengers to leave their carry-on baggage behind during emergency evacuations, this information is provided at a time when passengers are highly stressed and the noise level in the cabin is likely fairly high - not an optimal time for understanding or adhering to critical safety information. Reminding or briefing passengers during a pre-landing briefing to leave their personal effects behind should an evacuation be required on landing would likely help expedite an eventual evacuation. Furthermore, an internationally developed and implemented passenger education program aimed at decreasing the probability of such hazardous behaviour would be beneficial.

2.6.4.5 Evacuation Slides

There are no clear visual cues that indicate that some dual-lane slides actually have two lanes. In emergency evacuations where cabin crew are not available at each emergency exit equipped with a dual-lane slide, there is a risk that passengers will use the slide as a single-lane slide and slow the evacuation process.

2.6.4.6 Cabin Crew Actions and Communications

The lack of emergency power rendered the PA system inoperable, introducing the risk that the onset of the evacuations would be delayed, jeopardizing passenger safety. This risk was particularly significant because the aircraft was on fire. Given that the PA system and the evacuation alert system were supplied by the same emergency power source, the evacuation alert system also did not activate. A different source of emergency power for each system, and a less vulnerable emergency power system would increase the chances that the PA and the emergency evacuation alert systems would continue to operate after a survivable crash.

Although the protective breathing units (smoke hoods) provided for cabin crew were certified in accordance with TSO-C116, the one cabin crew who donned a smoke hood for personal protection was unable to communicate in an intelligible manner. While wearing the smoke hood, she was unable to communicate emergency instructions, directions, and commands to passengers in a manner that could be understood. There was no megaphone by her station, and she removed the smoke hood to make herself understood. A megaphone at each cabin crew station would enhance the crew's ability to make themselves heard by passengers while wearing the smoke hood.

Overall, there was effective communication among the cabin crew during the emergency situation. The PA made by the aft purser stating that there was a fire and that she was commencing an evacuation at R4 facilitated a coordinated emergency response by the cabin crew. In addition, the PA provided direction to those passengers who understood French.

There was effective risk assessment and decision making. The aft purser effectively assessed the risks to passenger safety, given the presence of fire, and did not hesitate to take the decision to immediately initiate an emergency evacuation. Other cabin crew also exhibited effective risk assessment and decision making as evidenced by the actions of the R1 and the R2 cabin crews. They had initially correctly determined that their emergency exits were unusable given the creek flowing just outside the aircraft; however, as the amount of smoke in the cabin worsened, they quickly reassessed the overall risk to passenger safety and concluded that the risk presented by the creek was not as great as the immediate threat presented by the smoke in the cabin. Both crew members took actions to commence evacuation at their respective exits. When the R3 cabin crew saw that passengers were not following his emergency instructions to not use that exit, he quickly assumed a much more assertive manner, resulting in passengers responding quickly and appropriately to his commands. In spite of the fact that the L2 door opened while the aircraft was still moving and the fact that its associated slide did not deploy, the evacuation was successful, primarily due to the training and actions of the whole cabin crew.

3.1 Findings as to Causes and Contributing Factors

1. The crew conducted an approach and landing in the midst of a severe and rapidly changing thunderstorm. There were no procedures within Air France related to distance required from thunderstorms during approaches and landing, nor were these required by regulations.
   
2. After the autopilot and autothrust systems were disengaged, the pilot flying (PF) increased the thrust in reaction to a decrease in the airspeed and a perception that the aircraft was sinking. The power increase contributed to an increase in aircraft energy and the aircraft deviated above the glide path.
   
3. At about 300 feet above ground level (agl), the surface wind began to shift from a headwind component to a 10-knot tailwind component, increasing the aircraft's groundspeed and effectively changing the flight path. The aircraft crossed the runway threshold about 40 feet above the normal threshold crossing height.
   
4. Approaching the threshold, the aircraft entered an intense downpour, and the forward visibility became severely reduced.
   
5. When the aircraft was near the threshold, the crew members became committed to the landing and believed their go-around option no longer existed.
   
6. The touchdown was long because the aircraft floated due to its excess speed over the threshold and because the intense rain and lightning made visual contact with the runway very difficult.
   
7. The aircraft touched down about 3800 feet from the threshold of Runway 24L, which left about 5100 feet of runway available to stop. The aircraft overran the end of Runway 24L at about 80 knots and was destroyed by fire when it entered the ravine.
   
8. Selection of the thrust reversers was delayed as was the subsequent application of full reverse thrust.
   
9. The pilot not flying (PNF) did not make the standard callouts concerning the spoilers and thrust reversers during the landing roll. This further contributed to the delay in the PF selecting the thrust reversers.
   
10. Because the runway was contaminated by water, the strength of the crosswind at touchdown exceeded the landing limits of the aircraft.
    
11. There were no landing distances indicated on the operational flight plan for a contaminated runway condition at the Toronto/Lester B. Pearson International Airport (CYYZ).
    
12. Despite aviation routine weather reports (METARs) calling for thunderstorms at CYYZ at the expected time of landing, the crew did not calculate the landing distance required for Runway 24L. Consequently, they were not aware of the margin of error available for the landing runway nor that it was eliminated once the tailwind was experienced.
    
13. Although the area up to 150 m beyond the end of Runway 24L was compliant with Aerodrome Standards and Recommended Practices (TP 312E), the topography of the terrain beyond this point, along the extended runway centreline, contributed to aircraft damage and to the injuries to crew and passengers.
    
14. The downpour diluted the firefighting foam agent and reduced its efficiency in dousing the fuel-fed fire, which eventually destroyed most of the aircraft.

3.2 Findings as to Risk

1. In the absence of clear guidelines with respect to the conduct of approaches into convective weather, there is a greater likelihood that crews will continue to conduct approaches into such conditions, increasing the risk of an approach and landing accident.
   
2. A policy where only the captain can make the decision to conduct a missed approach can increase the likelihood that an unsafe condition will not be recognized early and, therefore, increase the time it might otherwise take to initiate a missed approach.
   
3. Although it could not be determined whether the use of the rain repellent system would have improved the forward visibility in the downpour, the crew did not have adequate information about the capabilities and operation of the rain repellent system and did not consider using it.
   
4. The information available to flight crews on initial approach in convective weather does not optimally assist them in developing a clear idea of the weather that may be encountered later in the approach.
   
5. During approaches in convective weather, crews may falsely rely on air traffic control (ATC) to provide them with suggestions and directions as to whether to land or not.
   
6. Some pilots have the impression that ATC will close the airport if weather conditions make landings unsafe; ATC has no such mandate.
   
7. Wind information from ground-based measuring systems (anemometers) is critical to the safe landing of aircraft. Redundancy of the system should prevent a single-point failure from causing a total loss of relevant wind information.
   
8. The emergency power for both the public address (PA) and EVAC alert systems are located in the avionics bay. A less vulnerable system and/or location would reduce the risk of these systems failing during a survivable crash.
   
9. Brace commands were not given by the cabin crew during this unexpected emergency condition. Although it could not be determined if some of the passengers were injured as a result, research shows that the risk of injury is reduced if passengers brace properly.
   
10. Safety information cards given to passengers travelling in the flight decks of Air France Airbus A340-313 aircraft do not include illustrations depicting emergency exit windows, descent ropes or the evacuation panel in the flight deck doors.
    
11. There are no clear visual cues to indicate that some dual-lane slides actually have two lanes. As a result, these slides were used mostly as single-lane slides. This likely slowed the evacuation, but this fact was not seen as a contributing factor to the injuries suffered by the passengers.
    
12. Although all passengers managed to evacuate, the evacuation was impeded because nearly 50 per cent of the passengers retrieved carry-on baggage.

3.3 Other Findings

1. There is no indication that the captain's medical condition or fatigue played a role in this occurrence.
   
2. The crew did not request long aerodrome forecast (TAF) information while en route. This did not affect the outcome of this occurrence because the CYYZ forecast did not change appreciably from information the flight crew members received before departure, and they received updated METARs for CYYZ and Niagara Falls International Airport (KIAG).
   
3. The possibility of a diversion required the flight crew to check the weather for various potential alternates and to complete fuel calculations. Although these activities consumed considerable time and energy, there is no indication that they were unusual for this type of operation or that they overtaxed the flight crew.
   
4. The decision to continue with the approach was consistent with normal industry practice, in that the crew could continue with the intent to land while maintaining the option to discontinue the approach if they assessed that the conditions were becoming unsafe.
   
5. There is no indication that more sophisticated ATC weather radar information, had it been available and communicated to the crew, would have altered their decision to continue to land.
   
6. It could not be determined why door L2 opened before the aircraft came to a stop.
   
7. There is no indication that the aircraft was struck by lightning.
   
8. There is no information to indicate that the aircraft encountered windshear during its approach and landing.
   
9. The flight crew seats are certified to a lower standard than the cabin seats, which may have been a factor in the injuries incurred by the captain.

4.1 Action Taken

4.1.1 Air France

4.1.1.1 Rain Repellent

At the time of the accident, there was no procedure in place with respect to the use of rain repellent, with the exception of checking the fluid quantity and pressure during pre-flight preparation of the cockpit. A new procedure and additional information was added to the Air France operations manual (manuel d'exploitation or MANEX) on 01 September 2005, indicating that the system could be used in moderate to heavy rain. In addition, a technical note was issued to all pilots on 15 September 2005, indicating that there was no restriction with respect to the use of rain repellent in any flight condition.

4.1.1.2 Red Alert

The 29 September 2005 revision to Air France's manuel Généralités Opérations (GEN.OPS) included a procedure for ground operations in the event of a thunderstorm. This procedure outlines the risks (principally lightning strikes) presented to ground operations by thunderstorms and provides three levels of alert that may be declared by the Air France station manager and the actions to be taken for each phase of alert. It indicates that the initiation of an alert is the responsibility of the station manager or his delegate and that the station manager or his delegate will also communicate the alert level to the flight crew by available means.

4.1.1.3 Thunderstorms

To complement the information already published in the MANEX TU (Technique Utilisation) manual charts, the issue of thunderstorms was introduced to Air France's Groupe Normes et Standards (GNS) (Standards Group) in April 2005. A forum discussion took place with respect to proposed changes to the MANEX; the changes were effected within approximately four months. The revised sections of GEN.OPS dealing with thunderstorms came into effect with the 29 September 2005 revision.

4.1.1.4 Captain-Only Missed Approach

Following the accident, Air France amended the policy that states that only the captain can call for a missed approach; either pilot can now make that call.

4.1.2 Transport Canada

After the accident, Transport Canada (TC) publicly stated that it will soon require all airports to build "safety areas" at the ends of runways. TC, with the participation of industry experts, is currently reviewing airport certification standards, which include runway end safety area (RESA) specifications. The decision to shift the international standards in this direction has not been made at this time; however, the issue is currently being assessed by the International Civil Aviation Organization (ICAO) Aerodrome Design Working Group. The team has reviewed the current ICAO specifications as well as the specifications of other states, and currently supports the ICAO RESA specifications of a 90 m length. The working group has yet to provide its final recommendation after completion of its safety analysis. The results of the ICAO working group are expected later this year.

TC has not determined how long the safety areas will be, or how much time airports will have to construct them.

4.1.3 Airbus

As a result of this accident, Airbus flight crew operations manual (FCOM) procedures have been modified and the word "landing" has been replaced by "continue."

4.2 Action Required

4.2.1 Approaches into Convective Weather

Aircraft penetration of thunderstorms on approach occurs throughout the industry and has contributed to a number of accidents worldwide. Many operators, including Air France, do not provide their crews with specific criteria, such as distance-based guidelines, for the avoidance of convective weather during final approach and landing.

Environment Canada advises that thunderstorms can present significant risks to the safe operation of an aircraft. These risks include the following:

• low ceiling and poor visibility due to intense precipitation below the thunderstorm cloud, which often seriously limits visibility;
  
• rapid changes in surface pressure that can lead to altitude errors;
  
• lightning, which increases in frequency proportionally to the storm's intensity and which also affects visibility;
  
• hail, both within and outside the cloud;
  
• icing, particularly in the upper part of a mature cell;
  
• rapid changes in wind speed and direction, which may quickly and suddenly exceed an aircraft's crosswind or other limits;
  
• potentially damaging wind gusts;
  
• downdrafts due to microbursts;
  
• contaminated runway surfaces in rain and/or hail;
  
• turbulence; and
  
• difficulty in conducting a missed approach safely.

The severity of these hazards will vary between thunderstorms and are difficult to predict because the weather around a thunderstorm can change rapidly.

All operators train their crews on the hazards associated with thunderstorms, emphasizing that they are best avoided whenever possible. Regardless, TSB research following this accident has clearly demonstrated that the penetration of convective weather in the terminal area during an approach to land is a practice that is occurring industry-wide. This implies that pilots are either aware of the hazards presented by convective weather on approach but accept the perceived level of risk to facilitate landing at destination, or conversely, that they cannot readily assimilate, comprehend, and react to the hazards created by the rapidly changing nature of a thunderstorm. Consequently, approach and landing accidents due to convective weather occur regularly worldwide.

On the accident flight, the crew had information that clearly indicated that there was significant weather over the airport: the aircraft's weather radar display was painting severe weather close to the runway; there were pilot reports of poor braking action; they could see lightning in the vicinity of the airport; and several pilot and air traffic services (ATS) reports indicated that the winds were increasing and changing direction. However, the knowledge that they would fly in close proximity to a thunderstorm was not sufficiently compelling to justify discontinuing the approach. It should be noted that the acceptance of the risk of approaching in close proximity to convective weather was not limited to the accident aircraft. Other aircraft had landed nine, six, and four minutes before the arrival of Air France Flight 358 (AFR358), and there was at least one additional aircraft on approach behind AFR358 at the time of the accident. Clearly, the danger was not perceived to be ominous enough for those other crews either.

Therefore, there is a need for clear standards for the avoidance of convective weather during approach and landing. This will reduce the ambiguity involved in decision making in the face of a rapidly changing weather phenomenon, and the likelihood that factors such as operational pressures, stress, or fatigue will adversely affect a crew's decision to conduct an approach.

Therefore, the Board recommends that:

These types of approach and landing accidents are not restricted to a specific jurisdiction or geographical area. Rather, they occur on a regular basis worldwide.

Therefore, the Board also recommends that:

4.2.2 Pilot Decision Making

In accordance with standard investigation practice, the accident pilots' decision-making processes, as well as the actions of other pilots involved in similar accidents, were analysed. However, the temptation to judge the quality of a pilot's decisions by the outcome must be guarded against. Fairness to the individual and the advancement of transportation safety require that the actions of the pilots be understood within the context in which they were operating at the time, if we are to reduce the risk of recurrence.

Based on cues perceived or understood, cockpit decisions can be described as having two components: situation assessment and selection of a course of action. Cues, or information about the situation, can vary between clear and ambiguous. Clear cues allow for an easy decision-making process. Ambiguous cues are much more difficult to capture, understand, and assimilate. Therefore, the more ambiguous or complex a cue is, the greater the likelihood of a decision that is less than ideal.

The decision-making process in this occurrence required that the crew assess the situation and choose between continuing to the airport under severe atmospheric conditions or proceeding to the alternate. The second course of action would have entailed some inconvenience for the passengers. Therefore, either solution was less than ideal. However, the mounting cues available to them as they arrived on short final were not compelling enough to change their decision to continue with the landing.

Once individuals select a particular course of action, it takes very compelling cues to alert them to the advisability of changing their plan. Having made their decision to land, the crew members used all their energy to concentrate on this task and missed cues that should have warranted a review of that decision. The cues included the following: the runway looked like a lake; the aircraft deviated above the glide path; the landing was going to be farther down the runway than usual; the wind speed was reportedly increasing and the wind direction was changing; braking action was reported as poor; and the visibility became close to nil near the threshold.

Much has been written on the issue of pilot decision-making processes regarding landing. Nevertheless, this occurrence and others give a clear indication that there are still risks associated with this task. The Board believes that the ability to capture and interpret cues that are essential in the decision-to-land process is inadequate, especially when the cues are ambiguous or not immediately compelling. Consequently, pilots will continue to land in deteriorating weather once the landing decision has been made, in spite of cues that indicate that a go-around or balked approach should be executed.

Therefore, the Board recommends that:

The Board also recommends that:

4.2.3 Landing Distance Considerations

The crew was not aware of the landing distance required to land safely on a contaminated runway. This was due in part to some ambiguities in the landing distance information provided to the crew and an absence of direction by Air France regarding the need for crews to determine landing distances required.

When the aircraft was on departure from Paris, the Air France Octave system provided the crew with a maximum permissible landing weight value for the aircraft's arrival at Toronto. This weight was 190 000 kg, which was the maximum allowable weight based on structural considerations. It appears that this was the only landing performance calculation carried out during the operation of AFR358.

In the latter portions of the approach, the crew actions indicate a concern regarding landing distance when faced with landing on Runway 24L. From the investigation, it is clear that the pilots were aware of the landing distance available for Runway 24L. There is no indication that they had calculated the landing distances required for the arrival, nor are there any direct and specific Air France procedures that would require such calculations by the crew.

A review of the landing performance charts available to the crew revealed some potential problems. For example, the application of some of the corrections such as the use of thrust reversers and other variables were not necessarily intuitive and were sometimes applied incorrectly.

This accident clearly shows the need for pilots to know the landing distance required by their aircraft for the conditions to be encountered at the expected time of landing, and to compare this figure to the length of the runway assigned for the landing. It is essential that both figures be known to enable crews to calculate the margin of error available so that they are better prepared to make the correct decision when they encounter deteriorating conditions. In this occurrence, the crew members realized at some time during the landing sequence that the landing was going to be long. Had they known that the margin for error was slim, or indeed non-existent, the crew would likely have executed a go-around.

On 08 December 2005, a Boeing 737 aircraft slid off the departure end of Runway 31C while landing in snowy conditions at the Chicago Midway International Airport, Illinois, United States. Reports indicated that, on arrival at Chicago, there was poor braking action and there was a tailwind component of greater than 5 knots. At the time of the accident, arrival landing distance assessments were not required by regulations. As a result of this accident and investigation, the National Transportation Safety Board (NTSB), on 04 October 2007, recommended that the Federal Aviation Administration (FAA):

Immediately require all 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to conduct arrival landing distance assessments before every landing based on existing performance data, actual conditions, and incorporating a minimum safety margin of 15 percent (A-07-57) Urgent.

From the Air France MANEX performance information, the predicted landing distance needed for the landing in Toronto on a contaminated runway with zero wind and no thrust reverser was 8780 feet. For Runway 24L, the extra margin was only 220 feet. This very small landing distance margin was eaten up by the long flare during the landing. With a tailwind, there was negative margin, which would mean an overrun. The pilots were not aware that the MANEX-predicted landing distance when landing with a tailwind exceeded the length of Runway 24L. In the absence of knowledge of the required landing distance under varying performance conditions, crews will not be aware of rapidly developing overrun situations. Because of this, there is a high potential that crews will make inadequate go/no-go decisions, thereby increasing the risk of damage to persons, property, and the environment.

Therefore, the Board recommends that:

4.2.4 Runway End Safety Area Requirements

Runway 24L was compliant with Aerodrome Standards and Recommended Practices (TP 312E) in that it was designed with a strip 60 m beyond the end of the runway, free of non-frangible obstacles and graded in order to reduce the risk of damage to aircraft during an overrun situation. Although there is no RESA required or published for Runway 24L, no non-frangible objects existed along the path followed by the occurrence aircraft until a distance 150 m from the end of the runway. This established a de facto RESA that exceeded the standard currently stipulated in TP 312E by 90 m. Regardless, the investigation revealed that it was the terrain beyond this point that largely contributed to the damage incurred by the aircraft and the injuries to the crew and passengers.

There exist other Code 4 runways in Canada for which similar conditions exist. Such runways, while compliant with TP 312E, include hostile terrain beyond the 60 m overrun area required by the standard. The Board believes that all such runways could benefit from a RESA built in accordance with the ICAO Annex 14 recommended practice or the FAA's runway safety area (RSA) standard. This safety action would remove all non-frangible objects and create a surface graded so as to reduce the risk of damage to an aircraft up to a distance 300 m beyond the end of the runway.

The Board is aware that requiring a 300 m RESA may affect many existing Code 4 runways that are located where natural obstacles, local development, and/or environmental constraints make the construction of a RESA of this length impracticable. The Board believes that there exists a requirement for an alternate means of compliance, such as the use of an engineered material arresting system to provide a level of safety that is equivalent to a 300 m RESA.

Therefore, the Board recommends that:

4.2.5 Carry-on Baggage

During the emergency evacuation of AFR358, many passengers took their carry-on baggage with them. In view of the requirement to egress rapidly, this action presented a significant risk to safety. The consequences could include impeding an orderly and timely evacuation, damaging an evacuation slide, and increasing the potential for injury.

Although not required by regulation, Air France safety information cards used on AFR358 included a pictorial that informed the reader that taking carry-on baggage during an evacuation was prohibited. Additionally, in accordance with Air France emergency procedures, during the evacuation, the cabin crew directed passengers to leave their carry-on baggage on board the aircraft.

The effectiveness of these measures is limited, in that existing data suggest that less than half of passengers read safety information cards. Similarly, in the case of AFR358, directing passengers during the evacuation to leave their carry-on baggage behind was less than effective because about half the passengers surveyed indicated that they had attempted to bring their carry-on baggage with them.

Any measure that would assist in raising the passengers' awareness about the hazards of attempting to bring carry-on baggage with them during an emergency evacuation would serve to mitigate the risks. Research has shown that informing passengers during emergency (safety) briefings of the prohibition of evacuating with carry-on items during an emergency would complement existing measures designed to increase the efficiency and effectiveness of an emergency evacuation.

Therefore, the Board recommends that:

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 16 October 2007.

1. Appendix A - Air France Runway 24L Approach Chart
2. Appendix B - Airport Diagram - CYYZ
3. Appendix C - Summary of Weather
4. Appendix D - Airbus A330/A340 Location of Safety Equipment
5. Appendix E - Runway End Safety Areas for Runway 24L
6. Appendix F - Flight Data Recorder Values
7. Appendix G - Landing Distance Required Chart - Contaminated
8. Appendix H - Landing Distance Required Chart - Autobrake Full
9. Appendix I - Glossary

Appendix A - Air France Runway 24L Approach Chart

Appendix B - Airport Diagram - CYYZ

Appendix C - Summary of Weather

Time (UTC)	Time Prior to Landing	CYYZ Weather Information
Pre-Flight		TAF CYYZ 0539 z 06-06 280@10 P6SM SCT 40 FM 17Z VARIABLE@3 P6SM -SHRA BKN 30 PROB 30 17-22 2SM TSRA BKN CB 20 FM 22Z 300@8 P6SM BKN 30 RMK NEXT FCST BY 09Z
1444	5 hr 18 min	METAR 14Z CYYZ Wind 360 @ 4 15SM 35 few 260 few 28/19 30.07 remark cu, ci
1608	3 hr 54 min	AFR358 received ATIS Julliet (with 1600 CYYZ weather) via ACARS. ATIS JULLIET - 16Z 360@5 15SM SCT 45 SCT 120 SCT 260 30/20 30.04
1811	1 hr 51 min	METAR CYYZ 18Z 120@2 8SM -TSRA SCT TCU 35 BKN 90 23/22 30.03 RECENT RAIN RMK TCU3 AC 3 CB ASOCTD
1913	0 hr 49 min	AFR358 inquires if ATC has info about movement of system - believes it is going from north to south. ATC advises weather seems to be moving east
1915	0 hr 47 min	AFR358 told of delays in Toronto - requests heading deviation due weather
1917	0 hr 45 min	METAR CYYZ 19Z 220@07 4SM +TSRA BKN 05TCU BKN 080 24/23 A30.03 RMK TCU 6 AC1 CB ASSOCTD
1922	0 hr 40 min	ATC advises AFR358 traffic is starting to move into Toronto
1933	0 hr 29 min	AFR358 received ATIS Uniform via ACARS. AFR358 received METAR reports for KCLE, CYOW, and KIAG via ACARS.
1940	0 hr 22 min	AFR358 asks ATC if weather is worsening in Toronto ATC advises able to send aircraft in now but not sure about later AFR358 asks to be kept advised as they may have to "deviate".
1944	0 hr 18 min	AFR358 asks to be kept advised of worsening weather - ATC says will advise of weather.
1949	0 hr 13 min	AFR358 requests deviation left to avoid weather.
1953	0 hr 09 min	Controller asks JZA 8677 if they think they will get the field. Aircraft advises the weather is to the north and looking pretty bad.
1959	0 hr 03 min	Tower advises AFR358 that: 2 previous aircraft reported braking action "poor" Wind instruments knocked out by thunderstorm - last report was 230 @ 7 Kt Lightning activity all around the airport
2000	0 hr 02 min	Tower advises aircraft just landed reported wind at 290 @15G20kt Tower advises that RJ in front reported braking action "poor" until slowed below 60 Kt and clears AFR358 to land

Appendix D - Airbus A330/A340 Location of Safety Equipment

Appendix E - Runway End Safety Areas for Runway 24L

Appendix F - Flight Data Recorder Values

Appendix G - Landing Distance Required Chart - Contaminated

Appendix H - Landing Distance Required Chart - Autobrake Full

Appendix I - Glossary

AAIB

Air Accidents Investigation Branch (United Kingdom)

ACARS

aircraft communications addressing and reporting system

ACC

Area Control Centre

ADIRS

air data inertial reference system

AFM

aircraft flight manual

AFR358

Air France Flight 358

agl

above ground level

ALAR

approach and landing accident reduction

AMC

aeromedical centre

AP

autopilot

APU

auxiliary power unit

ARFF

aircraft rescue and fire fighting

ASDA

accelerate-stop distance available

asl

above sea level

ASR

accident safety report

ATC

air traffic control

A/THR

autothrust

ATIS

automated terminal information service

ATS

air traffic services

ATSB

Australian Transportation Safety Board

BEA

Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (France)

BKN

broken cloud

BSCU

brake and steering control unit

CAA

Civil Aviation Authority

CAP

CAA Publication

CARs

Canadian Aviation Regulations

CAST

Commercial Aviation Safety Team

CB

cumulonimbus (clouds)

CLDN

Canadian Lightning Detection Network

cm

centimetres

CMAC-E

Canadian Meteorological Aviation Centre - East

CRM

crew resource management

CS

certification standard

CVR

cockpit voice recorder

CYOW

Ottawa/Macdonald-Cartier International Airport, Ontario (ICAO code)

CYUL

Montréal-Pierre Elliott Trudeau International Airport, Quebec (ICAO code)

CYYZ

Toronto/Lester B. Pearson International Airport, Ontario (ICAO code)

dB

decibels

DGAC

Direction Générale de l'Aviation Civile (France)

DH

decision height

DME

distance measuring equipment

EASA

European Aviation Safety Agency

ECAM

electronic crew alerting and monitoring

ECU

electronic control unit

EFC

expected further clearance

EFIS

electronic flight information system

ELT

emergency locator transmitter

EMAS

engineered material arresting system

EMS

emergency services

EOC

Emergency Operations Centre

EPSU

emergency power supply unit

ETA

estimated time of arrival

EXCDS

extended computer display system

FAA

Federal Aviation Administration (United States)

FAP

flight attendant panel

FARs

Federal Aviation Regulations

FCOM

flight crew operations manual

FCTM

flight crew training manual

FCU

flight control unit

FDR

flight data recorder

FL

flight level

FMA

flight mode annunciator

FMGS

flight management and guidance system

FSF

Flight Safety Foundation

g

force

GA TRK

go-around track (mode)

GEN.OPS

manuel Généralités Opérations (part of the Air France MANEX related to general operating procedures)

GFA

graphic area forecast

GPWS

ground proximity warning system

GS

groundspeed

G/S*

glideslope track

G/S

glideslope capture

GTAA

Greater Toronto Airport Authority

HF

high frequency

HMA

hot-mix asphalt

hPa

hectopascals

IATA

International Air Transport Association

ICAO

International Civil Aviation Organization

ILS

instrument landing system

IMC

instrument meteorological conditions

in. Hg

inches of mercury

IRS

inertial reference system

JAA

Joint Aviation Authorities

JARs

Joint Aviation Requirements

KBOS

Boston-Logan International Airport, Massachusetts, United States

KCLE

Cleveland-Hopkins International Airport, Ohio, United States

KEWR

Newark International Airport, New Jersey, United States

kg

kilogram

KIAG

Niagara Falls International Airport, New York, United States

KIAS

knots indicated airspeed

KJFK

John F. Kennedy International Airport, New York, New York, United States

km

kilometres

KORD

Chicago O'Hare International Airport, Illinois, United States

LAW

landing weight

LFPG

Paris-Foissy-Charles-de-Gaulle Airport, France (IATA Code)

LGCIU

landing gear control interface unit

LLWAS

low-level windshear alert system

LOC

localizer track

LOC*

localizer capture

LOFT

line-oriented flight training

LOSA

line operations safety audit

m

metres

M

magnetic (degrees)

MAC

manuel Aéronautique Complémentaire (manual providing general aeronautical information for Air France crews)

MAC

mean aerodynamic chord

MANEX

manuel d'exploitation (Air France operations manual)

MCC

multi-crew coordination

MCDU

multifunction control and display unit

MDA

minimum descent altitude

METAR

meteorological actual report (aviation routine weather report)

min

minutes

MIT

Massachusetts Institute of Technology

mm

millimetres

MSC

Meteorological Service of Canada

N1

engine compressor speed

N

north

NARDS

NAV CANADA auxiliary radar display system

NASA

National Aeronautics and Space Administration

ND

navigation display

nm

nautical miles

NOTAM

notice to airmen

NPA

Notice of Proposed Amendments

NTO

No Technical Objection

NTSB

National Transportation Safety Board (United States)

NVM

non-volatile memory

OFP

operational flight plan

PA

public address

PAPI

precision approach path indicator

PDU

processor display unit

PF

pilot flying

PFD

primary flight display

PNF

pilot not flying

psi

pounds per square inch

PSR

primary surveillance radar

QRH

quick reference handbook

RAMP

radar modernization program

RDPS

radar data processing system

RESA

runway end safety area

rpm

revolutions per minute

RSA

runway safety area

RSit

radar situational display

RVR

runway visual range

SCT

scattered cloud

SIGMET

significant meteorological information

sm

statute miles

SOPs

standard operating procedures

SPECI

special weather observation

SRS

speed reference system

SSALS

simplified short approach light system

STEADES

safety trend evaluation, analysis, and data exchange system

T

True (degrees)

TAF

terminal aerodrome forecast (aerodrome forecast)

TAS

true airspeed

TAT

Touraine Air Transport

TC

Transport Canada

TCAS

traffic alert and collision avoidance system

TDWR

terminal Doppler weather radar

TEM

Threat and Error Management (model)

TEMPO

termporary change

TODA

take-off distance available

TOGA

take-off and go-around

TORA

take-off run available

TP

Transport Publication

TP 11183

ERS Aircraft Crash Charts

TP 312E

Aerodrome Standards and Recommended Practices

TRACON

terminal radar approach control

TSB

Transportation Safety Board of Canada

TSO

Technical Standard Order

TU

Technique Utilisation (manual part of the Air France MANEX related to technical standards)

UK

United Kingdom

ULB

underwater locator beacon

UTC

Coordinated Universal Time

VAPP

approach speed

VHF

very high frequency

VLS

landing speed

VMC

visual meteorological conditions

VREF

threshold crossing speed

W

west

WADDS

wind and altimeter digital display system

°

degrees

°C

degrees Celsius

′

minutes

″

seconds