Aviation Investigation Report A08O0233

On the night of 31 August 2008, a private pilot rented a Cessna 172P (registration C-GHSQ, serial number 17276106). The pilot and two passengers flew from Brampton Airport to Toronto/Buttonville Municipal Airport, then to Barrie–Orillia (Lake Simcoe Regional) Airport, then to Wiarton Airport, Ontario, stopping briefly at each of these locations before beginning a return flight to Brampton Airport. At approximately 0432 eastern daylight time on 01 September 2008, the aeroplane struck the ground at 44° 03′ N, 080°21′ W, approximately 7 nm west of Shelburne, Ontario, and was destroyed. There was no fire. Impact damage rendered the emergency locator transmitter inoperative. The rear-seat passenger notified emergency services by cellular telephone of the accident, but emergency services were unable to locate the accident site until approximately 0630 when a local resident found and reported it. The rear-seat passenger was taken by ambulance to a local hospital, examined, and released. The pilot and front-seat passenger were airlifted to a Toronto hospital where the front-seat passenger succumbed to his injuries four days later.

The flight was authorized on a Brampton Flight Centre flight sheet as a less than five-hour rental ^{Footnote 1} to Toronto/Buttonville Municipal Airport (CYKZ), Ontario, and return to the Brampton Airport (CNC3), Ontario, to be back on the ramp at 0400. ^{Footnote 2} The flight carried two passengers, although only one was authorized on the flight sheet. The second passenger occupied the right rear seat. No flight plan or flight itinerary was filed. ^{Footnote 3}

C-GHSQ departed CNC3 at 2311 and proceeded to CYKZ, landing at 2341. The pilot and his passengers entered the Seneca College flight simulator facility at 2357 and used the flight simulators for about an hour. At 0127, C-GHSQ took off and flew to the Barrie–Orillia (Lake Simcoe Regional) Airport (CNB9), Ontario, where it landed and spent about 30 minutes on the ground. It then flew to Wiarton Airport (CYVV), Ontario, landed, and spent a short time on the ground. C‑GHSQ departed CYVV at approximately 0350. The crash site was just past the half-way point along the track from CYVV to CNC3 (see Figure 1).

Image

The flight was flown under visual flight rules (VFR), which require visual references. Toronto and Wiarton VORs (very high frequency omnidirectional ranges) were functioning and within range. The Wiarton non-directional beacon, 326 kHz, was also available and functioning. Based on aviation weather reports from Toronto and Wiarton, weather at the time of the accident was winds light (less than 5 knots), sky condition clear, visibility 15 miles, temperature 13°C, dew point 11°C, altimeter setting 30.22 inches of mercury.

The pilot held a private pilot licence and was certified and qualified for the flight in accordance with existing regulations. He was enrolled in a full-time program to obtain a commercial multi‑engine pilot licence and instrument rating. He had accumulated 191.5 hours of flying time including 135.3 hours in the Cessna 172. His work/rest schedule during the 72 hours before the accident could not be established. He arose the day before the accident at approximately 0630. Although his activity during the day is not known, he did telephone the Brampton Flying Club at 1630 to reserve the aeroplane and arrived there at 2030.

The front-seat passenger was also a licensed private pilot who had accumulated 102 hours of flying time. His sleep schedule during the 72 hours before the accident could not be established, but his normal routine was to sleep at night. On the day before the accident, he arrived at the Brampton Flying Club at 1430 and worked as dispatcher until 2200.

The rear-seat passenger had recently begun private pilot training and was at the early pre-solo stage. His normal routine was also to sleep at night.

The aeroplane was a Cessna 172P high-wing monoplane that was certified for a maximum gross take-off weight of 2400 pounds. The aeroplane had conventional three-axis manual controls with trim capability for the pitch axis only. It was not equipped with an automatic pilot or other automated control device such as a wing-leveller. Records indicate that the aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. The aeroplane was not equipped with a flight data recorder or cockpit voice recorder, nor was either required by regulation.

The latest weight and balance report indicated an empty weight of 1544 pounds ^{Footnote 4} resulting in a useful load of 856 pounds. A weight and balance work sheet prepared by the pilot for the accident flight indicated that the load was 940 pounds, which included the three occupants, fuel, and baggage compartment weight resulting in a planned ramp weight of 2484 pounds and a take-off weight of 2477 pounds. The worksheet indicated that the aircraft was within limits. However, the worksheet used for flight planning was for a Cessna 172R, which is certified for a higher maximum gross weight of 2550 pounds compared to 2400 pounds for the Cessna 172P.

Based on actual pilot and passenger weights, the load was 1085 pounds resulting in a ramp weight of 2629 pounds and a take-off weight of 2622 pounds at departure from CNC3. Based on an estimated fuel consumption of 10 US gallons per hour, the weight at the time of the accident was 2429 pounds. Calculations indicate that the centre of gravity was within the prescribed limits, but the weight was outside the maximum gross weight limits. ^{Footnote 5}

There was normal communication between C-GHSQ and Toronto Terminal Control while en route between CNC3 and CYKZ and on departure from CYKZ. At 0133, C-GHSQ reported leaving the CYKZ control zone to the north. No destination was stated. This was the last recorded radio communication received from the aircraft.

On arrival and departure at CYVV, C-GHSQ made transmissions on the mandatory frequency. These transmissions were normal except for referring to Runway 23 as Runway 28. The initial part of the leg from CYVV to CNC3 was below radar coverage. When the aircraft was observed on radar, it was at an altitude of 4400 to 4500 feet above sea level (asl) and generally on a steady track toward CNC3 from 0415 until 0425. At 0425, the aeroplane began to turn to the right. Four minutes later, after turning through approximately 540 degrees (1 ½ complete circles), C‑GHSQ disappeared from radar at an altitude of 4000 feet asl.

The aeroplane struck the ground on an easterly heading, approximately 45° right bank, pitch angle 7° to 8° nose down, airspeed 140 knots. Ground scars indicate that the aircraft’s right wing touched the ground first followed by the right main wheel and then the nose wheel. The aeroplane cartwheeled and began to break up. The left wing separated from the fuselage approximately 200 feet from the first point of contact. The main wreckage, consisting of the fuselage and right wing, was found about 430 feet from the initial point of contact. Various items from the cockpit, wing components, doors, and landing gear were found along the impact path. The aeroplane was destroyed (see Photo 1).

Image

The wreckage indicated that flaps were up, and the engine was producing power at time of impact. Control continuity was established except for aileron controls, which were severed as a result of the left wing impact damage. A fuel odour existed at the crash site indicating fuel availability, but the amount of fuel remaining at the time of impact could not be determined due to post-impact leakage. The automatic direction finder was found tuned to 326 kHz. Other radio frequencies could not be determined. A TSB Laboratory examination of the dial faces and the mechanisms of cockpit instruments did not reveal any information as to their indications at the time of impact.

The emergency locator transmitter (ELT) was an ACK Technologies Inc., model E-01, serial number 018828, which was mounted on a bracket in the rear fuselage. The ELT was installed in accordance with CARs Airworthiness Manual subsection 551.104, ^{Footnote 6} which specifies performance and installation standards. The ELT was found in the wreckage beneath the engine free of its mounting bracket. The ELT case had fractured, most likely by contact with the engine, which detached the batteries from the transmitter unit. The antenna cable was torn from the unit.

When the batteries were connected at the TSB Laboratory, the transmitter and its activation circuitry worked as designed. It was equipped with a ball and spring type inertia switch that is sensitive to forces in one direction along a single axis, in this case, the aircraft’s direction of flight. If there had been sufficient force along the inertia switch’s axis of sensitivity, it is likely that the ELT would have activated. However, the aircraft hit the ground at a shallow angle and then cartwheeled. While impact forces were significant, it was inconclusive whether they were sufficient along the axis of sensitivity to activate the ELT.

The ELT bracket holds the ELT by two retaining straps that incorporate quick-release over‑centre type latches that do not incorporate a mechanical device to hold them in the closed position. The retaining straps were found unlatched in the aeroplane wreckage, and there was damage at the front strap hook that indicated twisting toward the front. The bracket and retaining straps were examined at the TSB Laboratory. The retaining strap strength exceeded the required 100 g in either direction individually along each of the three principal axes of the installation. The standard does not address an impact force acting directly on the latch that could move it over centre and allow the ELT to twist out of the bracket.

A mathematical analysis of the final moments of the flight path was carried out to develop a model of the trajectory from the point at which it disappeared below radar coverage until it struck the ground.

The flight path data from the radar recording showed that the aeroplane was in essentially straight and level flight between CYVV and CNC3 until 0424:30 when there was a distinct change in the flight path (see Figure 2). The remaining radar data showed a turn to the right and the beginning of a descent. The flight path from that point to impact was then reconstructed assuming no change to the aircraft trim condition (that is, no change of engine power and no change to control forces) and fine-tuning for wind and initial flight path angle. The resulting flight path is shown in Figure 3.

Image

Image

The pilot was retained in his seat in the aeroplane by the three-point harness. He suffered serious injuries including internal and head injuries as well as memory loss. He remained in hospital for several weeks after the accident. There was no indication of a pre‑existing medical condition relevant to this accident.

The front-seat passenger was thrown clear of the aeroplane as a result of the break-up of the right-hand side of the aeroplane. He suffered multiple traumatic blunt force injuries. Complications arising from his internal injuries resulted in his death four days after the accident. Toxicology studies did not detect the presence of any alcohol, and the level of carbon monoxide was within the normal range reported in adults.

The rear-seat passenger was retained in the aeroplane by his lap belt. He suffered only minor superficial injury. He was taken to hospital where he was examined and released. Shortly after take-off from Wiarton on the last leg of the flight, he went to sleep and was asleep at the time of impact.

The body has a natural biological clock that controls various chemical and neurological systems that affect sleep, eating, digestion, alertness, and other essential functions. Many of these systems run on a 24-hour clock or cycle and are referred to as circadian rhythms. Circadian rhythms are influenced by the daily cycle of light and dark and result in a biological predisposition to be awake during the day and to sleep at night. The period between 0300 and 0500 has been identified as being a particularly low point of alertness in the 24-hour daily cycle.

Regulators and investigative agencies around the world recognize fatigue as a contributor to many transportation occurrences. Among other factors, fatigue can result from prolonged wakefulness and can occur during low points in the natural circadian rhythm of alertness. Environmental factors such as constant and unchanging low-frequency noise and constant unchanging vibration can contribute to relaxation and allow a fatigued person to fall asleep more readily.

Increases in fatigue associated with periods of prolonged wakefulness have been well documented. In general, when periods of wakefulness exceed 16 consecutive hours, the risk of fatigue is increased. One laboratory study of fatigue demonstrated that 17 hours of sustained wakefulness produces impairments in psychomotor functioning (hand-eye coordination) equivalent to a blood alcohol concentration (BAC) of 0.05 per cent, and 24 hours of sustained wakefulness produces impairments equivalent to a BAC of 0.10 per cent. ^{Footnote 7}

Fatigue has an adverse effect on most types of human performance including manual dexterity, mental arithmetic, reaction time, and cognitive reasoning. It can result in a willingness to take risks and a laxity toward safety that would not normally be tolerated. The most extreme form of fatigue results in “state instability” that is, falling asleep involuntarily. State instability usually begins at 22 hours of prolonged wakefulness. ^{Footnote 8} In addition, the risk of involuntary sleep is especially high when performing tasks that demand sustained attention and involve monotony. It has been shown that, during civil air operations, fatigue and sleepiness may rise to unacceptably high levels as a result of long duty periods and the circadian low of alertness. ^{Footnote 9} Sleep-wake regulation in the body is comprised of a homeostatic process and a circadian process. ^{Footnote 10} The homeostatic process results in a drive for sleep that increases progressively during wakefulness: the longer the duration of wakefulness, the stronger the propensity for sleep. The circadian process represents a drive for wakefulness that varies according to a 24‑hour rhythm and is lowest between 0300 and 0500.

Transport Canada has published a series of documents dealing with fatigue management, mainly directed to the managers and employees of commercial establishments. ^{Footnote 11} These documents suggest that there is no objective way to measure fatigue levels or propensity to sleep. As to subjective recognition of fatigue, fatigued individuals are poor judges of their fatigue level, and their judgment becomes less reliable the more fatigued they become. Detection of fatigue is addressed mainly through observation by supervisors and co-workers. Countermeasures are aimed at managing the risk through management policies governing practices such as shift scheduling and work or flying hour limitations. Apart from recognizing one’s own symptoms, there are no countermeasures available to the individual who is already fatigued.

In this occurrence, weather was suitable for the flight and was not considered a factor. There was no indication of a mechanical failure of the aeroplane or of onboard navigation equipment or facilities external to the aeroplane that may have influenced the events. Therefore, the investigation focused on the pilot and passengers.

The occurrence took place at the lowest point of circadian alertness and after the pilot had likely been awake for 22 consecutive hours. The pilot was therefore at high risk of falling asleep involuntarily: he was very high on the homeostatic scale of propensity for sleep, and he was at the lowest point of the circadian cycle for alertness. The pilot was tasked with maintaining the aeroplane in a constant direction and altitude at night, a task that is both monotonous and that requires sustained attention. The cockpit environment was one of sustained low-frequency noise and constant consistent vibration.

All on board were accustomed to sleeping at night and were experiencing the lowest point on the circadian rhythm of alertness making them all susceptible to the effects of fatigue. The rear‑seat passenger was asleep after leaving Wiarton.

The flight path change that was detected by analysis is consistent with the pilot ceasing to maintain the lateral-directional control input required to maintain the heading of the aeroplane. As the aeroplane deviated from its initial azimuth and bank condition, its natural stability would result in a rate of descent that increased as the bank increased, characteristic of spiral mode stability without pilot intervention. The flight path analysis determined that, without any pilot control input, the aeroplane would continue to fly a descending spiral flight path from last recorded position on radar to the point where it struck the ground. Furthermore, the analysis predicted accurately the location, heading, and attitude of the aeroplane at impact.

The flight path study cannot prove that the persons on board were all asleep, only that they did not intervene in the flight of the aeroplane during the last seven minutes of flight. However, the investigation concluded that, as a result of fatigue, both passengers were sleeping and the pilot involuntarily fell asleep while performing the monotonous task of maintaining straight-and-level flight, after which the aeroplane reverted to its trimmed condition and continued to fly until it struck the ground.

In the absence of any direct method of measuring an individual’s level of fatigue or propensity for sleep, the defence against fatigue-related accidents is to avoid placing the operation at risk in the first place. In commercial operations, this is accomplished by means of regulatory and operational measures that limit the flight and duty time of flight crews. For individual owners and rental pilots, the sole defence against fatigue is their own judgment, which has been acknowledged to be unreliable since fatigued individuals are typically the poorest judges of their condition. There is no regulatory requirement for flight training units, flying clubs, or rental operations to exercise the same operational control measures that apply to commercial operations, even though such measures could help reduce risks for affected individuals.

There was a delay in locating the accident site. The pilot did not file a flight plan or flight itinerary; therefore, there was no indication that the aeroplane was overdue. Although impact forces were of sufficient magnitude, it is possible that the force component along the axis of sensitivity was insufficient to trigger the single-axis inertia switch and activate the ELT. Moreover, the ELT was released from its mounting bracket during impact, and the power source detached, which would have caused the ELT to stop transmitting. As a result, no ELT signals were detected. The physical installation standards for these ELTs do not preclude use of the mechanism by which the retaining strap released the ELT. The design of the over-centre retaining strap for ELTs creates a risk that the ELT will not function in a similar accident.

The take-off gross weight of the aeroplane exceeded the limitations published in the AFM. As a result, the structural integrity of the aeroplane and its performance capabilities were not reflected in the AFM. Although these elements did not contribute to the accident, operating an aeroplane outside its certified limitations incurs a risk that the operator cannot assess.

The following TSB Laboratory reports were completed:

• LP 119/2008 – ELT Analysis – Cessna 172P C-GHSQ
• LP 120/2008 – Instrumentation Examination – Cessna 172P C-GHSQ
• LP 137/2008 – Flight Path Analysis – Cessna 172P C-GHSQ
• LP 009/2009 – ELT Bracket Analysis – Cessna 172P C-GHSQ

These reports are available from the Transportation Safety Board of Canada upon request.

Findings as to causes and contributing factors

1. Due to fatigue, the pilot involuntarily fell asleep resulting in the aeroplane continuing to fly in its trimmed condition until it struck the ground.
2. The two passengers, both with flying experience, were asleep and did not identify the developing situation and, therefore, could not alert the pilot.

Findings as to risk

1. Reliance on a pilot’s own judgment to prevent fatigue-related accidents is an ineffective defence mechanism.
2. The pilot did not file a flight plan or flight itinerary. As a result, there was no alert that the aeroplane was overdue, which could delay the initiation of search and rescue efforts.
3. The pilot utilized a weight and balance work sheet for a different aeroplane model. As a result, the flight was flown at a gross weight that exceeded the limitations set out in the aircraft flight manual.
4. Although it complies with existing standards, the over-centre retaining strap that mounts the emergency locator transmitter (ELT) to the aeroplane can release the ELT when subjected to the right combination of impact forces, rendering it inoperable and increasing the risk of delay in locating a crash site.
5. Although it complies with existing standards, an ELT with a single-axis inertia switch may not be triggered by impact forces in some instances, increasing the risk of delay in locating a crash site.

This report concludes the Transportation Safety Board’s investigation into this occurrence. Consequently, the Board authorized the release of this report on 26 January 2010.