Aviation Investigation Report A13A0075

On 03 July 2013, at about 1415 Atlantic Daylight Time, the Government of Newfoundland and Labrador Air Services Division Bombardier CL-415 amphibious aircraft (registration C-FIZU, serial number 2076), operating as Tanker 286, departed Wabush, Newfoundland and Labrador, to fight a nearby forest fire. Shortly after departure, Tanker 286 touched down on Moosehead Lake to scoop a load of water. About 40 seconds later, the captain initiated a left-hand turn and almost immediately lost control of the aircraft. The aircraft water-looped and came to rest upright but partially submerged. The flight crew exited the aircraft and remained on the top of the wing until rescued by boat. There was an insufficient forward impact force to activate the onboard 406-megahertz emergency locator transmitter. There were no injuries to the 2 crew members. The aircraft was destroyed. The accident occurred during daylight hours.

1.1 History of the flight

On the day before the occurrence, the flight crew had completed 53 water-drop flights at a forest fire located northeast of Wabush, Newfoundland and Labrador. Each flight, typically about 3 minutes long, consisted of scooping water from Moosehead Lake,^{Footnote 1} dropping the water on the fire, and then returning for another water scoop. During the scooping runs (Figure 1), the aircraft would typically touch down about 1250 feet (point A) from the eastern shore of the lake.

About 1200 feet (11 seconds) later, the water probes^{Footnote 2} (Photo 1) would retract (point B), and liftoff would occur about 925 feet (10 seconds) after the probes had been retracted^{Footnote 3} (point C). All flights were made with the PROBES AUTO/MANUAL switch in the AUTO selection. The switch was left in this position at the end of these flights.

At about 1400^{Footnote 4} on the day of the accident, the flight crew were deployed to the same forest fire that they had been working on the day before. The captain was the pilot flying (PF) for the occurrence flight and occupied the left seat. The captain removed the centre pedestal cover^{Footnote 5}during the pre-flight preparations. The first officer, who was the pilot not flying (PNF), completed the exterior walk-around and carried out the pre-flight cockpit checks.

The aircraft had 7000 pounds of fuel and 1000 pounds of chemical foam on board. Utilizing this information, the water-drop control computer determined the maximum quantity of water to be scooped.^{Footnote 6} This quantity is displayed on the water status display panel using indicator markers known as “bugs”.

The flight crew considered the wind speed and direction and decided to follow the same practice as the previous day and scoop water from Moosehead Lake.

After take-off, the PNF was required to complete the “After Take-off” checklist, and in preparation for scooping water, to complete the “Water Bombing in Range” and “Pick-up” checklists.

About 4 minutes after take-off, the aircraft touched down about 1250 feet from the eastern shore of the lake (Figure 1), on a heading of 250° true (T). The PF then applied take-off power, and the PNF began adjusting the torque limit stops (herein referred to as soft stops). Throughout the scooping run, the PNF was focused on ensuring that the soft stops were set as per the PF's instructions.

While adjusting the soft stops, the PNF noted that the water tanks were completely full, and advised the PF that the probes were still down and the PROBE AUTO/MANUAL switch was in the MANUAL selection. The PNF then manually selected the probes up. The probes retracted about 3490 feet after touchdown (point D).

The flight crew continued the take-off despite indication by the water status display panel that water quantity was in excess of that allowable for this take-off.

At the time the probes were retracted, the aircraft was about 2500 feet from the departure-end shoreline of the lake. The PF determined that the aircraft would require a greater distance to become airborne and initiated a left turn to follow the lake. About 2 seconds later, the aircraft's hull began to lift out of the water, and the left float contacted the water (point E).

For the next 4 seconds, aileron and rudder control surface deflections commanded a left turn; however, during this time, the aircraft was skidding to the outside of the turn. The float remained in contact with the water, and the aircraft‘s hull was completely out of the water. The PF deflected the elevators up to near full deflection, with no corresponding response in pitch attitude, and then initiated a right turn using ailerons, with no response to this input.

About a second later, the aircraft's hull was about 7 feet above the water, with the float still in contact with the water. The float separated from its pylon, resulting in a sudden pitch-down moment.

The forward section of the hull collided with the water, causing the lower part of the forward fuselage to tear open. The right wing float collided with the water, causing complete separation of the right float and pylon. The aircraft came to rest upright, with the cockpit partially underwater (Photo 2). The flight crew briefly delayed their evacuation until the propellers had stopped rotating.

The PNF retrieved a life vest and evacuated the aircraft through the overhead escape hatch. Once on top of the aircraft, the PNF donned the life vest. The PF could not retrieve a life vest and exited the aircraft through the left-side sliding window.

The flight crew remained on the wing as the aircraft continued to sink. The PNF contacted company personnel by cellular telephone and advised them of the situation. Within about 30 minutes, Department of Natural Resources employees arrived by boat and transported the flight crew to shore.

The aircraft settled on the lake bottom, about 225 feet from the southern shore of the lake.

Neither pilot attempted to remotely activate the emergency locator transmitter (ELT), shut down the engines or select electrical power OFF.

1.2 Injuries to persons

There were no injuries.

1.3 Damage to aircraft

The aircraft was destroyed by impact forces.

1.4 Other damage

Not applicable.

1.5 Pilot information

The flight crew were certified and qualified for the flight in accordance with existing regulations.

This was the second season flying the CL-415 for both pilots. The captain had been flying for Newfoundland and Labrador Government Air Services (NGAS) for 32 years on a variety of different amphibious aircraft, including the CL-215 (1300 hours of flight time). The first officer had also flown the CL-215 (221 hours), and this was the seventh year with NGAS.

1.6 Aircraft information

1.6.1 General

The occurrence aircraft was manufactured in 2010, and had been owned and operated by NGAS since it was new.^{Footnote 7} It had accumulated a total of 461.6 hours at the time of the accident.

Records indicate that the aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. There was no indication of a component or system failure during the scooping run. During the day prior to the accident, no discrepancies were noted with the automatic retraction function of the auto probe system.

The CL-415 is a high-wing, twin-engine turboprop amphibious aircraft built specifically for aerial forest firefighting. It is equipped with a glass cockpit,^{Footnote 8} and has powered flight controls and turbine engines. The aircraft has a 2-tank, 4-compartment, computer-controlled water system. Water is added to the system by 2 extendable probes, which use the ram force developed while the aircraft is planing on the water. Each water tank has an overflow duct that allows scooped water to vent when the tanks are full.

Water scooping and dropping operations are controlled by switches located on the water-drop control (WDC) panel, in the centre pedestal, and on the pilots' control wheels. The WDC computer uses the aircraft's zero-fuel weight^{Footnote 9} and the weight of the onboard fuel and chemical foam to calculate the maximum water that can be scooped without exceeding the aircraft's maximum take-off weight (47 000 pounds). Indication of system status, such as door position, system armed or ready, water quantity, and water probes position, are displayed on the water status display panel (Photo 3). The maximum water weight is indicated on the water status display panel by water quantity bugs. When the water probes are down, 2 DN (i.e., down) lights illuminate. When the probes are up, the 2 lights are extinguished.

The investigation determined that the aircraft's weight and centre of gravity were within the limits for take-off from Wabush and for the initial landing on the lake.

At the time of the occurrence, the aircraft had scooped full tanks of water, which resulted in the aircraft being about 3000 pounds over the maximum take-off weight.^{Footnote 10}

1.6.2 Probe retraction system

The CL-415 standard water probe retraction system includes a 2-position PROBES UP/DOWN selector switch,^{Footnote 11} located on the right side of the centre pedestal. When the switch is moved to the DOWN selection, the probes extend. Moving the switch to the UP position causes the probes to retract. During water scooping, once the water level in the tanks has reached the predetermined quantity, the flight crew must manually move the switch to the UP position to prevent overloading the aircraft.

On request from another customer, Bombardier had designed an auto probe retraction system to eliminate the requirement for the pilots to manually select the probes up during scooping.

The auto probe system includes the addition of a PROBES AUTO/MANUAL switch (Photo 4, item A) and relocation of the original PROBES UP/DOWN switch (item B). When the PROBES AUTO/MANUAL switch is in the AUTO position, the probes will automatically retract once the water level indicators reach the maximum quantity bug on the water status display panel. When this switch is in the MANUAL position, the flight crew must manually select the probes up using the PROBES UP/DOWN switch, when the water quantity has reached the predetermined level.

The PROBES AUTO/MANUAL switch is a 2-position toggle switch designed to lock in one position only. Bombardier used the lock position of the switch for the MANUAL selection. To move the switch from the MANUAL to the AUTO position, the switch lever must be lifted to overcome the locking mechanism. When the switch is in the AUTO position, the lever is not held in place by a locking mechanism.

In 2003, the above-mentioned customer requested a modification to the PROBES AUTO/MANUAL switch so that the switch would now lock in the AUTO selection. This was to avoid an unintentional movement of the switch from the AUTO to the MANUAL position. Although Bombardier reviewed the proposed modification and did not object to the customer undertaking this modification on the customer's fleet of aircraft, the change was not incorporated into the auto probe system installation instructions. At the time of the occurrence, NGAS was unaware of this modification.

In May 2005, Bombardier issued a service bulletin (SB) for the installation of an auto probe retraction system. In August 2010, Bombardier issued an information sheet for this bulletin that revised the effective aircraft serial numbers to include NGAS's fleet of aircraft. In April 2011, this SB was implemented on the occurrence aircraft. NGAS is the only other user of the auto probe system.

TSB investigators examined an NGAS CL-415 and noted that the PROBES AUTO/MANUAL switch moved freely from the AUTO to MANUAL position, and could be made to do so by simply pulling the centre pedestal's cover rearward.

1.6.3 Soft stops

Adjustable soft stop mechanisms are mounted on both power levers to avoid engine overtorquing during the water dropping and water scooping phases of flight.^{Footnote 12} The initial soft stop setting is based on the outside air temperature and the altitude, and is derived using a chart that is placarded in the cockpit.

To obtain the maximum engine torque, in accordance with the Bombardier 415 Model Cl-215-6b11 Airplane Flight Manual (AFM), the soft stops may have to be readjusted.

1.6.4 Emergency locator transmitter

The aircraft was equipped with a TechTest Ltd. 406- megahertz ELT. The ELT was installed on the right side of the rear fuselage, aft and opposite of the rear cargo door. It was in the ARMED position at the time of the impact.

The ELT can be activated either by a remote switch in the cockpit, automatically by impact forces, or manually by selecting the switch to ON. The ELT is designed to automatically activate when the forward acceleration value is a minimum of 2.0 g. During the impact sequence, the maximum forward acceleration attained was 1.1 g, which was insufficient to activate the ELT.

1.6.5 Serviceability assurance check

A daily serviceability assurance check is carried out by the aircraft maintenance engineer at the end of each flying day. This check was carried out on the occurrence aircraft during the evening of 02 July 2013, and no discrepancies were noted. During this check, the centre pedestal cover was not removed, nor was any specific work carried out in the area of the PROBES AUTO/MANUAL switch.

1.7 Meteorological information

The aviation routine weather report (METAR) issued at 1400 for the Wabush Airport reported winds 240°T at 16 knots, gusting to 22 knots, visibility 3 statute miles in smoke, a broken layer of clouds at 3000 feet above ground level (agl), an overcast layer at 16 000 feet agl, temperature of 24°C, dew point at 7°C and an altimeter setting of 29.89 inches of mercury.

1.8 Aids to navigation

Not applicable.

1.9 Communications

Not applicable.

1.10 Aerodrome information

Not applicable.

1.11 Flight recorders

The aircraft was equipped with a cockpit voice recorder (CVR), which was capable of storing the last 120 minutes of cockpit sounds, and a flight data recorder (FDR), which was capable of storing 150 hours of flight data. The CVR and the FDR were forwarded to the TSB Laboratory with the occurrence data intact.

1.12 Wreckage and impact information

The aircraft came to rest facing west in about 15 feet of water. The left wing float sustained compression damage and had separated rearwards from its pylon. The right wing float and pylon assembly had collapsed inboard and separated from the wing. The right propeller blades were destroyed due to impact with water.

The right nose landing gear door had multiple fractures and had been forced into the nose gear wheel well. The left nose landing gear door was deformed and had been forced open beyond its normal range of travel. Major deformation had occurred in the nose wheel well, and its aft bulkhead structure had been torn and forced rearward. The fuselage hull bulkheads, from the nosewheel well rearward to the suppression foam tanks, sustained multiple fractures and tears, and the cabin floor aft of the cockpit had been forced upwards and was torn apart.

The left side of the fuselage had multiple cracks. Both sides of the fuselage had multiple creases, and the no. 4 water tank door had been torn free and was not recovered. The forward fuselage and the tail had been forced to the left.

1.13 Medical and pathological information

The PF was experiencing a personal situation that was causing an increased level of stress. The situation had been going on for several years and had reached a conclusion at the beginning of that particular flying season, leading to significant upheaval in the PF's personal life. The PF had considered taking leave due to the level of distraction the situation was causing, but chose not to do so, given, in part, that the flight crew were in the process of fighting a forest fire that was threatening the properties of many local residences. Other company personnel, including the PNF and the chief pilot, were aware of the PF's ongoing personal situation. The PNF had noticed that the PF appeared distracted, but did not consider the situation sufficient to warrant taking action.

On the morning of the occurrence, the PF had received a particularly distressing phone call related to the personal situation.

1.14 Fire

Not applicable.

1.15 Survival aspects

In 2011, NGAS provided flight crews with underwater escape training through the Fisheries Marine Institute of Memorial University of Newfoundland. This was a one-time opportunity, and there was no plan to incorporate this type of training on a recurring basis. The PNF recalled this training and used it during this accident.

The flight crew's life vests were loosely placed in storage containers adjacent to each crew seat. After the aircraft came to rest, the PF's life vest floated away and could not be retrieved.

The life raft was located in the rear of the fuselage, on the right side, opposite the rear cargo door (Photo 5). The raft was held in place by a ratcheting-type mechanism, which was not conducive for ease of removal. This mechanism had informally been identified by NGAS flight crew as a concern both in 2011 and again in 2012, at which time an alternate method of securing the raft in place was proposed. The ratcheting-type method of securing the life raft was still being used during the 2013 firefighting season.

The rear portion of the fuselage was partially submerged, and due to the difficulty gaining access to the life raft, the flight crew determined that it was unsafe to retrieve it.

According to NGAS's Operations Manual, pilots are to receive instructions on the location and operation of all emergency equipment on an annual basis. Training aids, such as life preservers and life rafts, shall be available and relevant to the training program being presented. Where practical training is required, it is to be done during initial training and every 3 years thereafter. NGAS had not provided specific training on the operation of the life vests or the life raft, or on how to enter the life raft while in the water.

1.16 Tests and research

Not applicable.

1.17 Organizational and management information

1.17.1 Newfoundland and Labrador Department of Transportation and Works

The Newfoundland and Labrador Department of Transportation and Works (DTW) is responsible for operation and maintenance of the provincial government air ambulances and water bombers, as well as a range of other transportation services. The DTW employs approximately 1800 staff and is divided into 4 branches.

1.17.2 Government of Newfoundland and Labrador Air Services Division

NGAS operates under the Road and Air Transportation Branch and is responsible for managing provincial air services and for operation and maintenance of the government forest fire protection service (water bombing operation). The division also administers contract and charter aircraft for government, and manages the operation and maintenance of the government air ambulance service. The main office is located in Gander, Newfoundland and Labrador, where 15 staff provide support for the division. The main water bombing operation is also in Gander, where there are 20 pilots and 16 maintenance personnel. During the firefighting season, there are satellite bases at St. John's, Deer Lake, Goose Bay, and Wabush. The air ambulance section operates 2 aircraft in St. John's and 1 in Goose Bay, and has 14 pilots and 9 maintenance personnel.

NGAS conducts Canadian Aviation Regulations (CARs) Subpart 703 air taxi operations, and CARs Subpart 702 aerial work operation for water bombing operations, air ambulance operations, and transfer of company personnel. The operating certificate covers aerial work, and domestic and non-scheduled international operations.

1.17.3 Water bombing operation

In 2010, the CL-215 was being replaced by the CL-415 aircraft, with the last CL-415 delivered in 2012. At the time of the occurrence, NGAS was operating a fleet of 4 CL-415 and 1 CL-215. One additional CL-215 had been put into storage and was not being used.

Day-to-day operations were the responsibility of the operations manager. The operations manager reports to the Assistant Deputy Minister of the DTW, who in turn reports to the Deputy Minister, NGAS's Accountable Executive. In addition to government air ambulances and water bombing operations, these individuals are responsible for construction and maintenance of the provincial highways, provision of provincial ferry services, management of the provincial government fleet of light vehicles and heavy equipment, and construction and management of provincial government buildings.

At the time of the occurrence, many of the key senior positions were not permanently staffed:

• The operations manager position was being filled temporarily by the chief pilot.
• The training pilot position was being filled temporarily by a senior pilot.
• The chief inspector^{Footnote 13} position was being filled temporarily by the deputy chief inspector.

These individuals were carrying out the duties of the temporary position as well as their regular duties.

Many of the employees and managers had been with the company in excess of 15 years, and some for as long as 40 years.

1.18 Additional information

1.18.1 Training

1.18.1.1 Aerial firefighting training

Of the 4 Canadian provinces that operate the CL-415, only 1 has a ground training syllabus for aerial firefighting. The syllabus covers topics such as:

• fire fuel types;^{Footnote 14}
• strategies and tactics to combat fire;
• target identification; and
• factors affecting safety, including visibility, fatigue, and manoeuvrability.

At NGAS, training specific to firefighting techniques is passed on by senior captains to first officers while flying together, such that knowledge is imparted with on-the-job training. NGAS did not provide any specific ground training syllabus for aerial firefighting.

Executing an aircraft turn while scooping is sometimes required to conform to the shape of the water body. Bombardier recommends that the wings remain level during this type of manoeuvre. The NGAS practice was to maintain a wings-level attitude during turns on the water. It is not uncommon for a float to touch the water while the hull is on the water.

1.18.2 Checklists

1.18.2.1 PROBES AUTO/MANUAL switch

The PROBES AUTO/MANUAL switch position check is identified in the Bombardier AFM “Normal Water Pick-up” checklist, and includes the following note:

• System must be monitored to ensure that probes retract automatically at the pre-selected bug levels. If auto-retraction is delayed or ceases to function, the probes must be selected UP manually^{Footnote 15}.

After NGAS incorporated the auto probe system modification, the PROBES AUTO/MANUAL switch position check was not included on the NGAS checklist. This omission had been identified by flight crews during informal discussions, but at the time of the occurrence, the checklist had not been amended. Since 2012, flight crew were relying on their memory to ensure that the PROBES AUTO/MANUAL switch position was checked at the appropriate time.

1.18.2.2 Briefings

NGAS standard operating procedures (SOP) stipulate which briefings must be completed at a particular phase of flight. The first flight of the day requires a departure briefing, which is identified in the “Pre Take-off” checklist. A water-pickup briefing is required prior to the first scooping run. This briefing is not identified on the checklists, but is identified in the SOPs as a requirement.

On the day of the occurrence, neither of these briefings was carried out.

1.18.2.3 Checklist use

According to National Aeronautics and Space Administration:^{Footnote 16}

The various ways of conducting a checklist are not only limited to the device in use, but they also pertain to the concept of using a checklist—sometimes referred to as the “checklist philosophy of use.” […]

In most cases, the checklist philosophy-of-use is the outgrowth of the company's corporate “culture.” This term includes many factors that contribute to the overall operational concept of the organization, including management style, supervision concepts, delegation of responsibilities in the chain of command, punitive actions, etc. …The airline's culture is an important factor because it is mirrored in the manner in which flight management and training departments establish, direct, and oversee flight operations and related procedures.

NGAS SOPs require the aircraft checklists to be implemented using different methods during different phases of flight. Two of these methods are the read-and-do (RD) method and the vital action (VA) method. The SOPs describe the procedures for an RD checklist, but do not provide any guidance for a VA checklist. In some cases, flight crews were unaware of what was meant by a VA checklist.

According to the SOPs, any checklist can be done silently if that is more desirable; however, the PNF must state that the checklist has been completed and must identify which checklist is next.

During the occurrence flight, there was no verbal confirmation that the “After Take-off” and “Water Bombing in Range” checklists were completed, nor was there an indication as to what checklist was next.

The occurrence flight crew would typically use hand signals to communicate that the “Pick-up” checklist was completed and that the aircraft was configured for water pick-up. The SOPs state that hand signals are not to be used.

1.18.3 Take-off performance

Aircraft take-off performance is based on utilizing maximum engine torque. According to Bombardier and NGAS SOPs, the take-off is to be conducted using maximum engine torque, which is derived using the “Engine Take-off Torque Setting” chart in the AFM. For the occurrence flight, the maximum engine torque should have been 98%.^{Footnote 17}

NGAS's practice was that, during the first flight of the day,^{Footnote 18} after touching down on the water, the PF would set the engine torque for the take-off. The PNF would then make the fine adjustments of the soft stops to limit the travel of the power lever to this torque setting. On the day of the occurrence, the soft stops were being fine-tuned to obtain a maximum engine torque of about 93%. It was common practice for pilots to set the maximum engine torque to about 92%–95%.

1.18.4 Overweight take-off

According to CARs 602.07 (Aircraft Operating Limitations), aircraft are to be operated within the limitations specified in the aircraft flight manual, which include the maximum take-off weight.

The Transport Canada (TC) Flight Training Manual 4th Edition – Aeroplane states that weight and balance limitations are imposed for the following reasons:

• The effect of the disposition of weight (and subsequently balance) on the flight characteristics of the aircraft, particularly on stall and spin recoveries, slow flight and stability.
• The effect of the weight on primary and secondary structures of the aircraft.
• The effect of weight on take-off and landing performance.^{Footnote 19}

The Pilot's Handbook of Aeronautical Knowledge, in Chapter 4: Aerodynamics of Flight, states:

The takeoff/climb and landing performance of an aircraft are determined on the basis of its maximum allowable takeoff and landing weights. A heavier gross weight results in a longer takeoff run and shallower climb…

Even a minor overload may make it impossible for the aircraft to clear an obstacle that normally would not be a problem during take-off under more favorable conditions.^{Footnote 20}

In Chapter 9: Weight and Balance, it states:

An overloaded aircraft may not be able to leave the ground, or if it does become airborne, it may exhibit unexpected and unusually poor flight characteristics. If not properly loaded, the initial indication of poor performance usually takes place during take-off.

Excessive weight reduces the flight performance in almost every respect. For example, the most important performance deficiencies of an overloaded aircraft are:

• Higher take-off speed
• Longer take-off run
• Reduced rate and angle of climb
  […]
• Reduced maneuverability
  […]^{Footnote 21}

According to Bombardier, when an aircraft is overweight after scooping, the take-off should be aborted. However, it has also indicated that flight crews may consider not aborting the take-off, since the CL-415's performance is not degraded significantly. Further, once the aircraft is airborne, the flight crew has the option to jettison the water load rapidly and reduce aircraft weight well below maximum take-off weight.

Some NGAS pilots had previously experienced a situation where the aircraft was likely overweight while taking off from the water. None considered aborting the take-off, and all felt that it was not a safety issue, since the aircraft would only require a bit more distance to take off.

Bombardier expects that operators will report all instances in which the aircraft is operated overweight, and has received reports of CL-415 overweight take-offs. All of the aircraft involved were equipped with the auto probe system. Based on the information provided in these reports, Bombardier could not determine what position the PROBES AUTO/MANUAL switch was in when each case occurred.

NGAS does not have documented procedures for recording or reporting an overweight take-off, nor has their practice been to do so.

1.18.5 Maintenance test flights

NGAS does not have documented procedures for carrying out a maintenance test flight. The maintenance department relies on CARs 571.10(4)^{Footnote 22} to provide guidance.

On the day prior to the occurrence, a maintenance test flight consisting of a number of scooping and water dropping runs was carried out with 2 maintenance personnel on board. The flight was not identified as a maintenance test flight in the aircraft log book.

The aircraft is equipped with a removable jump seat that folds down into the cockpit entrance area and bench-type seating along both sides in the forward fuselage area. All of these seats are equipped with restraint devices. During the maintenance test-flight scooping runs, 1 maintenance personnel member was standing in the cockpit entrance area, and the other was walking within the aft fuselage.

NGAS's practice was to scoop sufficient water so that the aircraft was at its maximum take-off weight after scooping. Because no consideration was given to the additional weight of the 2 individuals, the aircraft would have been overweight by the combined weight of the 2 individuals.

1.18.6 Safety management

1.18.6.1 Newfoundland and Labrador Government Air Services flight safety program

According to the NGAS operations manual, the operations manager was responsible for flight safety, and the chief pilot was responsible for the professional standards of the flight crew under his/her authority.

As part of the 10.5-hour indoctrination training program, each newly hired pilot is to receive some training related to the company's flight safety program. Although the specific reference to the flight safety program in the operations manual was dated 23 May 1997, there was no flight safety program at NGAS at the time of the occurrence; the approach used by NGAS was to follow the CARs.

There was no documented process for reporting safety concerns, nor was there a defined process for following up on safety concerns (such as carrying out a risk assessment and identifying what, if any, mitigation measures were taken). Operational incidents were reviewed using an approach to safety management that relied primarily on regulatory compliance and on reacting to undesirable events by prescribing specific measures to prevent their recurrence.

Managers relied on an informal open-door policy, which had been a long-time practice, and presumed that individuals would bring any safety-related concerns to their attention. Managers also assumed that individuals would bring forward any potential safety concerns during the annual spring recurrent training for aircrew. Under this informal method, if no concerns were brought forward, then the expectation was that there were no safety-related issues.

Staff awareness of safety management at NGAS was typically accomplished over time, through verbal exchange with more experienced staff members.

Accident investigations within the DTW are carried out by the human resources (HR) department, with the sole purpose of determining culpability.^{Footnote 23} The chief pilot (acting operations manager) participated in the HR department's investigation of this occurrence; however, NGAS did not carry out an independent review for the purpose of identifying areas where safety improvements could be made. NGAS has indicated that the HR department's investigation is waiting for the TSB's final report before a final decision is made as to what the outcome will be for the 2 pilots in this occurrence.

1.18.6.2 Organizational safety culture

Safety culture can be described as “the way we do things around here”^{Footnote 24} or “what people at all levels in an organisation do and say when their commitment to safety is not being scrutinized.”^{Footnote 25} According to the International Civil Aviation Organization (ICAO), “Organizational safety culture sets the boundaries for accepted operational performance in the workplace by establishing the norms and limits” and “provides a cornerstone for managerial and employee decision-making.”^{Footnote 26} Culture is deeply ingrained, and its impact on safety may not be readily apparent to those working within those cultures.

One of the largest influences on safety culture is management commitment and style. ICAO has described the role of management in creating a “good” organizational safety culture as follows:

Those in the best position to effect accident prevention by eliminating unacceptable risks are those who can introduce changes in the organization, its structure, corporate culture, policies and procedures, etc. No one is in a better position to produce these changes than management.^{Footnote 27}

Organizations must strike a balance between safety and production by managing risks present in their operations. The challenge for an organization is to operate efficiently while minimizing safety risks. The reality within many organizations is that production and operational concerns may at times seem more pressing, since they are more measurable and provide immediate feedback in terms of results. Therefore, operational concerns may be more salient in the minds of decision makers than concerns dealing with safety. In this context, organizations may unwittingly introduce risk into their operations.

Organizations differ considerably in the level of risk they tolerate within their operations. Those organizations which take proactive steps to identify and mitigate risks are considered to have good safety cultures, while other organizations with poor safety cultures knowingly or unknowingly operate with higher levels of risk. An organization that operates with significant risk faces a greater potential for an accident.

The traditional approach to safety management is based on compliance with regulations and a reactive response to incidents and accidents. According to the ICAO Safety Management Manual (SMM), follow-up action may generate safety recommendations aimed at the specific, immediate safety concern identified as causing the occurrence. Little emphasis is placed on other hazardous conditions that, although present, are not causal in the occurrence, even though they hold damaging potential for aviation operations under different circumstances.^{Footnote 28} While this perspective is quite effective in identifying what happened, it is considerably less effective in disclosing why it happened, which is essential to correcting the underlying safety deficiency.^{Footnote 29} Further, the manual states:

Although compliance with safety regulations is fundamental to the development of sound safety practices, … organizations that simply comply with the minimum standards set by the regulations are not well situated to identify emerging safety problems.^{Footnote 30}

[…]

As global aviation activity and complexity continue to grow, …traditional methods of managing safety to an acceptable level [become] less effective and inefficient. Different, evolved methods of understanding and managing safety are necessary.^{Footnote 31}

Modern safety management principles promote a proactive search for hazards, identification of risks, and the best defences to reduce risk to an acceptable level. These principles must be embedded within an organization's management system, so that safety policies, planning, procedures, and performance measurement are integrated into day-to-day operations.^{Footnote 32} This necessity led to the development of formal safety management systems (SMS).

1.18.6.3 Safety management systems

NGAS did not have an SMS, nor were they required by regulation to have one.

TC defines an SMS as “[a] documented process for managing risks that integrates operations and technical systems with the management of financial and human resources to ensure aviation safety or the safety of the public.”^{Footnote 33}

In 2001, TC published Introduction to Safety Management Systems, which describes an SMS in the following way:

A safety management system is a businesslike approach to safety. It is a systematic, explicit and comprehensive process for managing safety risks. As with all management systems, a safety management system provides for goal setting, planning, and measuring performance. A safety management system is woven into the fabric of an organization. It becomes part of the culture, the way people do their jobs.^{Footnote 34}

CAR 107.03 identifies the specific requirements for an SMS and states that it shall include items such as:

(a) a safety policy on which the system is based;

(b) a process for setting goals for the improvement of aviation safety and for measuring the attainment of those goals;

(c) a process for identifying hazards to aviation safety and for evaluating and managing the associated risks;

[…]

(e) a process for the internal reporting and analyzing of hazards, incidents and accidents and for taking corrective actions to prevent their recurrence;/

(f) a document containing all safety management system processes and a process for making personnel aware of their responsibilities with respect to them.^{Footnote 35}

[…]

In 2008, the operations manager arranged for an external contractor to carry out a gap analysis for the purpose of implementing SMS within NGAS. The project assessed 77 individual SMS required components. While some of the components required a review to ensure that they met the specific SMS requirements, the majority were nonexistent. These component gaps included the following:

• The current safety policy would not be suitable for the SMS.
• There was no policy in place that provides immunity from disciplinary action for employees that report hazards, incidents or accidents;
• There was no formal process for disseminating safety information throughout the organization;
• There was no process in place so that hazards, incidents, and accidents are analyzed to identify contributing and root causes; and
• No person was responsible and accountable for managing the operation of the SMS.

Although the gap analysis identified that there was a safety policy, the only safety policy that NGAS could provide was specific to occupational health and safety. NGAS had no documented risk analysis process and no formal risk assessments, and analyses were not conducted for significant operational changes, such as the introduction of the CL-415 as a new type of aircraft.

In 2010, NGAS began work on a draft SMS manual. This manual was not completed, nor was it submitted to TC.

In March 2012, NGAS hired an occupational health and safety officer. The primary duty of this position was described as follows:

This position is responsible for highly technical and administrative work in the development, implementation, and management of the Department's Air Safety Management System.^{Footnote 36}

The qualifications for this position indicated that the candidate should possess knowledge of the aviation industry, as well as the applicable provincial and federal safety legislation, and that these qualifications would normally be acquired through the completion of a diploma or university coursework in occupational health and safety (or) safety engineering technology.

Occupational health and safety and safety engineering technology are oriented toward the technical and management aspects of occupational health and safety. Although the course curriculum includes risk management and systemic safety management, the focus is the health and safety of individuals on the job.

The position qualifications did not identify that the individual was required to have any SMS knowledge or experience, or required to be familiar with the TC requirements for implementing an SMS.

Since March 2012, additional work has been undertaken on the draft SMS manual. However, progress has been very limited, as the focus has been on NGAS's occupational health and safety program.

NGAS has indicated that the implementation of SMS will not likely be undertaken until doing so is required by regulation.

1.18.6.4 Safety management systems on the Transportation Safety Board Watchlist

The TSB has identified SMS implementation as a Watchlist item, stating: “Transport Canada does not always provide effective oversight of aviation companies transitioning to safety management systems, while some companies are not even required to have one.”^{Footnote 37} This position is explained in the following way:

Implemented properly, safety management systems (SMS) allow aviation companies on their own to identify hazards, manage risks, and develop and follow effective safety processes. Canada's large commercial carriers have been required to have an SMS since 2005. However, for smaller operators, such as those which do aerial work or provide air taxi or commuter services, implementation has been delayed.

Until SMS are more broadly implemented within the aviation industry, the TSB remains concerned regarding the risks to Canadians, and will continue to monitor progress in this area.^{Footnote 38}

1.18.7 Stress

1.18.7.1 Effects of chronic stress on performance

Stress can be defined as a “mismatch between how an individual perceives the demands of a situation, and how he perceives his ability to meet these demands”^{Footnote 39} and can be acute (related to a short-term situation) or chronic (related to ongoing life events). Stress has been shown to have a negative impact on human performance in the areas of working memory (increasing difficulty retaining and assimilating information), attention (increased channelized attention) and communication (decreased verbal communication).^{Footnote 40}

The effects of stressors are cumulative,^{Footnote 41} such that life events that contribute to chronic stress reduce an individual's capacity to manage acute stressors encountered in the performance of their day-to-day tasks. Early recognition and intervention to manage stress is critical to reducing the potential impact of stressors on performance in safety-critical positions.^{Footnote 42}

1.18.7.2 Means to manage performance effects of stress

The knowledge requirements to obtain a private^{Footnote 43} or commercial^{Footnote 44} pilot licence now include the effect of stress on performance. Documentation developed by TC provides information on the nature and sources of stress in addition to means of assessing and managing acute and chronic stress for pilots.^{Footnote 45}

Although it was not required by regulation, the company provided a 1-day crew resource management (CRM) training program. The training was provided by a third-party instructor, as part of annual recurrent training. The effects of stress on performance and means to recognize and mitigate these effects were not addressed as part of this training.

The Government of Newfoundland and Labrador offers an employee assistance program (EAP).

The purpose of the program is to provide distressed employees with an opportunity for help when unsatisfactory job performance has been identified. Such deteriorated work performance may be the result of physical, mental or emotional illness, family or marital distress, legal or financial difficulties, or from problems related to alcohol or other drugs.^{Footnote 46}

Information gathered in the course of the investigation indicated that NGAS employees were uncertain of procedures for contacting EAP, that they were inclined to manage the situation themselves and avoid contacting EAP, and that they were not aware of the capability to take oneself out of service. The program is intended for all employees of the Government of Newfoundland and Labrador and is not specific to NGAS.

Management of chronic stress involves crew and management being aware of the effects of chronic stress on performance and aware of the means to mitigate those effects. It also involves having a supportive work environment that encourages non-punitive means for individuals who are unfit for work to be removed from service and for affected individuals to be assisted in recovering and returning to normal functioning quickly.

1.19 Useful or effective investigation techniques

Not applicable.

2.1 General

The aircraft had no known deficiencies before the occurrence flight. Weather was not considered a factor in the occurrence. In an effort to understand why the accident happened, this analysis will focus on the events, conditions and underlying factors that caused or contributed to the accident. In addition, the effectiveness of the Newfoundland and Labrador Government Air Services' (NGAS's) management of safety will be reviewed, and systemic risks to the transportation system will be analyzed with the objective of improving aviation safety.

2.2 Accident sequence

By the time the water probes were retracted during the scooping run, the aircraft had travelled considerably farther down the lake than on the previous day's runs: 3490 feet versus 1200 feet after touchdown. This travel distance placed the aircraft much closer to the departure-end shoreline. The pilot flying (PF) elected to turn the aircraft to the left to allow for a longer departure path along the lake. The initiation of the left turn by the PF resulted in the left float contacting the water while the hull became airborne. This result created a downward force on the left float, which acted as a pivot point around which the aircraft rotated. When the PF attempted to counteract the tightening left turn by applying opposite control inputs, there was no corresponding response.

2.3 Auto probe system

There is no adverse effect if the PROBES AUTO/MANUAL switch is inadvertently moved from the MANUAL to the AUTO selection, because the water probes will be automatically retracted when the predetermined quantity is reached.

Because the PROBES AUTO/MANUAL switch locks in the MANUAL position, an inadvertent movement of the switch from the MANUAL selection would be unlikely. However, the switch can be easily moved from the AUTO to MANUAL selection by simply pulling the centre pedestal cover rearward during removal.

At the end of the previous day, the aircraft was shut down and the switch was left in the AUTO position. The centre pedestal cover was installed and remained there until the following day, when it was removed by the PF. Neither of the pilots purposely repositioned the switch during the occurrence flight. Therefore, it is likely that the PROBES AUTO/MANUAL switch was inadvertently moved from the AUTO to MANUAL position when the centre pedestal cover was removed.

An inadvertent movement from the AUTO to the MANUAL selection can lead to the aircraft being in an overweight situation if the flight crew does not monitor the water quantity. When a flight crew is operating with the switch in the AUTO selection, there is an expectation that the probes will always automatically retract at the predetermined water quantity, as was the case on the 53 flights of the previous day. When the flight crew expects the system to work properly, it is likely that less priority is given to the importance of monitoring the water quantity.

The aircraft flight manual (AFM) instructs flight crews to monitor the water quantity even when the PROBES AUTO/MANUAL switch is in the AUTO selection. At the time of the occurrence, the flight crew was occupied during the scooping run with other flight activities, and did not notice that the water quantity exceeded the predetermined limit until after the tanks had filled to capacity. This situation resulted in the aircraft being over the maximum take-off weight.

2.4 Overweight take-off

Among other factors, the take-off performance of an aircraft will be affected when the maximum allowable take-off weight has been exceeded. Therefore, when an overweight take-off is carried out, there may be an adverse effect on the aircraft's performance that could jeopardize the safety of the flight. It was not NGAS practice to report overweight take-offs. If flight crews do not report an overweight take-off, then the overall condition of the aircraft's structures will not be accurately known, which could jeopardize the safety of flight.

2.5 Survivability

In this accident, the raft was submerged in a section of the fuselage that the crew decided was too dangerous to risk entering. In an emergency, the raft might have been difficult to retrieve due to the manner in which it was secured. If safety equipment is installed in a manner that hampers its access and removal, there is an increased risk that occupants may not be able to retrieve the safety equipment in a timely manner to ensure their survival.

NGAS did not use actual life jackets and life rafts as training aids. If individuals are not trained on safety equipment installed on the aircraft, then there is an increased risk that the individuals may not be aware of how to effectively use the equipment to ensure their survival.

During a scooping run, the aircraft can be exposed to a number of potentially dangerous situations, such as crosswinds, waves, collision with a log or other item, or loss of control. If a person is not restrained and the aircraft either makes an abrupt manoeuvre or loses control, then that person is at a much greater risk of injury or death.

2.6 Use of standard operating procedures and checklists

When NGAS incorporated the auto probe modification, their checklist was not amended to check the position of the PROBES AUTO/MANUAL switch position. If a checklist does not include a critical item and flight crews are expected to rely on their memory, there is a risk that that item will be missed, which could jeopardize the safety of the flight.

Briefings are an integral part of crew communication. The purpose of a briefing is to ensure that both flight crew members are aware of the other's intentions for a particular phase of flight. If a required briefing is not conducted, there is a risk that deviations from intentions will not be identified, which may jeopardize the safety of flight.

Some aspects of the standard operating procedures (SOPs) were modified or not followed. The crew did not verbally confirm that the “After Take-off” and “Water Bombing in Range” checklists were completed, and used hand signals in the cockpit. Additionally, the crew used a reduced torque setting on the scooping run, whereas the SOP specifies maximum torque use for every take-off. This use of reduced engine torque was normal practice at NGAS, and was likely accepted due to the performance capabilities of the aircraft.

If flight crews do not adhere to SOPs, there is a risk that errors and omissions can be introduced which could jeopardize the safety of flight.

2.7 Firefighting training

Aerial firefighting is a specialized operation that not only requires the flight crew to be competent in their aircraft operation skills but also to be familiar with the specialized techniques associated with using the aircraft to fight fires. This familiarity allows crews to better adapt to difficult flying situations under intense workload. NGAS did not provide any specific ground training syllabus for aerial firefighting.

2.8 Safety management

An effective safety management system (SMS) assists an operator to proactively identify unsafe conditions in its operation and put mitigations in place with an eye to a continual improvement of safety. A comprehensive risk assessment conducted under an SMS affords some foresight of hazards and risks, which is necessary for the company to prevent accidents. If a formal risk assessment is not carried out, there is a risk that systemic safety deficiencies will not be identified and appropriate mitigation strategies developed.

Safety management at NGAS was informal, undocumented, and focused on meeting regulatory requirements. There was no system in place for employees to raise operational safety concerns and receive feedback on their resolution. Similarly there was no documented method to conduct a risk assessment, no proactive identification of potential safety issues, nor was consideration given to what impact on safety major changes within the company would have, such as acquiring the CL-415 aircraft.

Several examples of known conditions were identified in the course of the investigation that were either identified but not communicated to management, or communicated to management but not acted upon, indicating that the informal approach was not effective in reducing risk.

The traditional reactive approach to safety management has been shown to be ineffective in identifying potential hazards and associated risks. Organizations that comply with the minimum standards and manage safety using the traditional approach are not well placed to identify emerging safety problems. In today's aviation environment, proactive safety management practices must be embedded within an organization's management system so that the management of safety is integrated into day-to-day operations.

Although NGAS had taken some steps toward voluntarily implementing an SMS, the operator's progress in this area had stalled in the vacuum created by the slow replacement of senior personnel and a lack of legislated requirement to implement an SMS.

NGAS had completed a gap analysis toward an SMS. Although an occupational health and safety officer had recently been hired to help with the implementation of an SMS, there was no requirement for this individual to have any SMS knowledge or experience, or to be familiar with Transport Canada (TC) requirements for implementing one. Even though there are no regulatory requirements for Canadian Aviation Regulations (CARs) 702, 703, and 704 operators to have an SMS, nothing prevents those operators from implementing one. However, NGAS has indicated that it is likely that an SMS will not be implemented until doing so is required by regulation.

The NGAS division is one of many portfolios under the responsibility of the Deputy Minister of Transportation and Works. The amount of time and the extent of resources and financial commitment allotted to this department has to be weighed against the requirements of all of the other departments. Implementing effective safety management practices is a long-term commitment that requires consistency in commitment by senior management as well as in resource allocation and financial support.

If organizations do not use formal and documented processes to manage operational risks, there is an increased risk that hazards will not be identified and mitigated.

2.9 Managing the effects of chronic stress

Over the past several years, the PF had been dealing with a stressful personal situation, and on the morning of the occurrence had received a distressing call. The PF had considered taking a leave of absence, but in light of the current operational demands presented by the forest fire, had continued working. The PF's level of distraction due to the effects of chronic stress created a situation in which errors were more likely to occur.

The Government of Newfoundland and Labrador employee assistance program (EAP) is primarily focused on assisting individuals whose job performance has already been affected. Although individual employees can contact the EAP for assistance on their own initiative, doing so is acknowledged to be a significant and potentially intimidating step for an individual to take. NGAS employees were generally aware of the existence of the EAP, but were unaware of how to access its services or of the option to take oneself out of service.

If organizations do not have measures in place to raise awareness of the potential impact of stress on performance or to promote the early recognition and mitigation of this impact, there is an increased risk that errors will occur when an individual is affected by a chronic stress situation.

3.1 Findings as to causes and contributing factors

1. It is likely that the PROBES AUTO/MANUAL switch was inadvertently moved from the AUTO to the MANUAL selection when the centre pedestal cover was removed.
2. The PROBES AUTO/MANUAL switch position check was not included on the Newfoundland and Labrador Government Air Services CL-415 checklist.
3. The flight crew was occupied with other flight activities during the scooping run and did not notice that the water quantity exceeded the predetermined limit until after the tanks had filled to capacity.
4. The flight crew decided to continue the take-off with the aircraft in an overweight condition.
5. The extended period with the probes deployed on the water resulted in a longer take-off run, and the pilot flying decided to alter the departure path to the left.
6. The left float contacted the surface of the lake during initiation of the left turn. Aircraft control was lost and resulted in collision with the water.

3.2 Findings as to risk

1. If safety equipment is installed in a manner that hampers its access and removal, then there is an increased risk that occupants may not be able to retrieve the safety equipment in a timely manner to ensure their survival.
2. If individuals are not trained on safety equipment installed on the aircraft, then there is an increased risk that the individuals may not be aware of how to effectively use the equipment.
3. If a checklist does not include a critical item, and flight crews are expected to rely on their memory, then there is a risk that that item will be missed, which could jeopardize the safety of flight.
4. If flight crews do not adhere to standard operating procedures, then there is a risk that errors and omissions can be introduced, which could jeopardize the safety of flight.
5. If a person is not restrained during flight and the aircraft either makes an abrupt manoeuvre or loses control, then that person is at a much greater risk of injury or death.
6. If an overweight take-off is carried out, there may be an adverse effect on the aircraft's performance, which could jeopardize the safety of flight.
7. If companies do not have procedures for recording overweight take-offs and flight crews do not report them, then the overall condition of the aircraft's structures will not be accurately known, which could jeopardize the safety of flight.
8. If organizations do not use formal and documented processes to manage operational risks, there is an increased risk that hazards will not be identified and mitigated.
9. If organizations do not have measures in place to raise awareness of the potential impact of stress on performance or to promote the early recognition and mitigation of these situations, then there is an increased risk that errors will occur when an individual is affected by a chronic stress situation.

3.3 Other findings

1. Utilizing the locking position of the PROBES AUTO/MANUAL switch for the MANUAL selection allows the switch to be inadvertently moved from the AUTO to the MANUAL position.

4.1 Action taken

4.1.1 Government of Newfoundland and Labrador Air Services Division

4.1.1.1 Aircraft changes

The Government of Newfoundland and Labrador Air Services Division (NGAS) has made the following aircraft-related changes:

• The life vests are now secured in the cockpit and cabin.
• The life raft is now installed in a manner that provides ease of removal.
• Storage cases and cargo straps are now used to secure cargo and loose items.
• Each aircraft is now equipped with a portable satellite telephone.

4.1.1.2 Training

The following training-related actions have been taken:

• Within the next 2 years, all waterbomber pilots and maintenance personnel are required to complete water egress training, life-vest training and life-raft training.
• The water bombing pilot-training syllabus has been revised to include an updated standard operating procedure and additional simulator training; flight management system training; a review of power-setting performance graphs, checklist changes and procedures; and water-bombing flying techniques (i.e., soft stops, aborted take-offs, step turns, and rain covers).
• A presentation on the Employee Assistance Program is scheduled for mid-May 2014.
• Fatigue management and stress management is now included in the crew resource management training.
• Flight crews are to conduct training flights every 4 days during the fire season to maintain proficiency.
• The Department of Natural Resources provided a presentation on forest fire management and control techniques during annual training.

4.1.1.3 Procedures

NGAS has also made the following procedural changes:

• The checklist has been amended to include PROBES AUTO/MANUAL switch verification.
• An employee suggestion form has been developed, whereby employees can identifiy safety-related concerns. A procedure for the dissemination of the collected information has also been developed.
• Test-flight procedures have been changed to comply with the aircraft flight manual.

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 25 June 2014 . It was officially released on 28 August 2014 .

The following TSB Laboratory reports were completed:

• LP 134/2103 – FDR Download
• LP 137/2013 – SkyTrac ISAT-200R

These reports are available from the Transportation Safety Board of Canada upon request.