Aviation Investigation Report A13W0120

On 19 August 2013, a Buffalo Airways Ltd. Douglas DC-3C (registration C-GWIR, serial number 9371) was operating as a scheduled passenger flight from Yellowknife, Northwest Territories, to Hay River, Northwest Territories. After lift-off from Runway 16 at 1708 Mountain Daylight Time, there was a fire in the right engine. The crew performed an emergency engine shutdown and made a low-altitude right turn towards Runway 10. The aircraft struck a stand of trees southwest of the threshold of Runway 10 and touched down south of the runway with the landing gear retracted. An aircraft evacuation was accomplished and there were no injuries to the 3 crew members or the 21 passengers. There was no post-impact fire and the 406 MHz emergency locator transmitter did not activate.

History of the flight

Buffalo Airways Ltd. (Buffalo Airways) has a walk-in / on-demand system whereby passengers can arrive to board a plane without having to pre-book a seat on the flight. If the passenger/cargo load exceeds the capacity of 1 aircraft, an additional aircraft can be dispatched. On 19 August 2013, the occurrence flight, Buffalo 168 (BFL168), was supplemented by another DC-3C (DC-3) for the flight from Yellowknife, Northwest Territories (CYZF), to Hay River, Northwest Territories (CYHY).

Prior to departure, BFL168 was loaded with cargo and 17 passengers at the Buffalo Airways hangar. Passengers were processed through the Buffalo Airways terminal, where they checked in and dropped off their checked luggage. Passengers and their baggage were not weighed at the check-in counter. After the aircraft had been loaded, 4 last-minute passengers were boarded along with their luggage.

At the time of departure, the operational flight plan (OFP) was partially completed and did not reflect the number of passengers on board or the weight of the cargo. The crew did not receive a cargo manifest prior to departure.

At 1708,^{Footnote 1} BFL168 received take-off clearance from the Yellowknife tower controller and initiated the take-off run from Runway 16 at the intersection of Runways 16/34 and 10/28 (Appendix A ). The runway distance available from the intersection was approximately 5956 feet.

At 1710, the tower controller observed heavy torching and smoke from the right engine and called to advise BFL168 of this observation. The tower controller received no response from BFL168. The crew of BFL168 was in the process of retracting the landing gear when a fire was observed in the right engine. An emergency engine shut down was performed, which included feathering the right propeller. As the right propeller was moving towards a feathered condition, it stopped feathering before reaching the full feathered position and returned to windmilling. BFL168 made a low-altitude right turn in an attempt to reach Runway 10 (Appendix B). The maximum height achieved by BFL168 was approximately 180 feet above ground level (agl).^{Footnote 2}

While manoeuvring, BFL168 struck a stand of trees, about 30 feet in height, 690 feet southwest from the threshold of Runway 10. The initial point of ground contact was 400 feet beyond the trees. BFL168′s wreckage trail was parallel to and south of Runway 10 and was about 330 feet in length. The landing gear and the flaps were in the retracted position. Due to the relatively low-energy impact, the emergency locator transmitter (ELT) did not activate.

Airport rescue and fire-fighting (ARFF) personnel were positioned south of Runway 10 due to an unrelated ground vehicle recovery operation. The tower controller directed ARFF to the occurrence site at approximately 1718. Once the aircraft came to a complete stop, the flight attendant initiated the evacuation of the 21 passengers through the left-aft door. The flight attendant returned to the aircraft and moved some galley drawers that were blocking the cockpit, and confirmed that the flight crew was safe. The 3 crew members subsequently evacuated the aircraft. ARFF sprayed the aircraft with fire retardant foam as a precaution. The crew and passengers, none of whom were injured, remained at the site under the supervision of ARFF for approximately 60 minutes. They were subsequently transported back to the Buffalo Airways terminal building.

Weather

The aviation routine weather report (METAR) for Yellowknife at 1700 was wind 230° true (T) at 5 knots, visibility 15 statute miles (sm) with showers in the vicinity of the airport, few clouds at 1000 feet agl, scattered cloud at 4000 feet agl (with associated cumulonimbus), broken clouds at 15 000 and 24 000 feet agl, temperature 17°C, dewpoint 13°C, and the altimeter setting was 29.28 inches of mercury. The elevation of the Yellowknife Airport is 675 feet above sea level. The calculated density altitude was 1800 feet.

Flight crew and cabin crew

Records indicate that the flight crew was certified and qualified for the flight in accordance with existing regulations.

The captain held a valid airline transport pilot licence and, during the occurrence, occupied the left seat as pilot flying (PF). The captain had accumulated approximately 13 000 hours of flight time, of which 4300 hours were on the DC-3.

The first officer (FO) held a valid commercial pilot licence and occupied the right seat as pilot not flying (PNF). The FO had accumulated approximately 500 hours of flight time, of which about 125 hours were on the DC-3.

As the aircraft was being operated under the Canadian Aviation Regulations (CARs) Subpart 705, there was a requirement for a flight attendant. The flight attendant had received company training in June 2013; however, the crew resource management (CRM) component had not been completed as per company requirements. The flight attendant also held a commercial pilot licence.

There was no indication that fatigue was a factor in this occurrence. The crew was on a schedule that provided the required rest and time away from duties.

Aircraft

The aircraft was originally delivered as a military transport C-47B (Dakota) manufactured in 1942 with serial number 42-23509. The conversion from military designation to civil required modifications as outlined in Federal Aviation Administration (FAA) Type Certificate Aircraft Specification No. A669. These modifications were accomplished in February 1975 by Field Aviation Ltd. designating it as a DC-3C-S1C3G, serial number 9371. Buffalo Airways has been the registered owner since 1994.

Two flight crew members are required to operate the aircraft. The aircraft was not equipped with a flight data recorder (FDR) or a cockpit voice recorder (CVR), nor were these required by regulation. CARs subsection 605.33 (1) mandates the requirement for FDRs on all multi-engine turbine-powered aircraft in respect of which a type certificate has been issued authorizing the transport of 30 or fewer passengers, and configured for 20 to 30 passenger seats. CARs subsection 605.33 (2) mandates the requirement for CVRs on all multi-engine turbine-powered aircraft that are configured for 6 or more passenger seats and for which 2 pilots are required by type certificate. Multi-engine piston-powered aircraft were not included in the application of these regulations. Transport Canada (TC) indicated modern recorders are based on digital technology and installation of the required sensors would not be feasible. The complexity of retrofitting piston-powered aircraft was not seen as worthwhile, especially since the number of these aircraft in service was predicted to decline.

The lack of an FDR and/or CVR adds to the complexity of investigations and deprives the investigators of information that is essential to an understanding of how and why certain accidents happened. As a result, safety deficiencies that represent a risk to persons, property and the environment may not be identified.

Post-accident analysis of the material recorded by CVRs has confirmed on numerous occasions the value of the CVR in furthering commercial aviation safety. If cockpit or data recordings are not available to an investigation, this may preclude the identification and communication of safety deficiencies to advance transportation safety.

Weight and balance

CARs Subpart 625 Appendix C requires all large aircraft to be reweighed, and weight and balance reports updated every 5 years except as otherwise provided for in an approved fleet empty weight and balance control program. Buffalo Airways' approved maintenance organization (AMO) Maintenance Control Policy Manual (MCPM) Section 4.13 – Weight and Balance Control was approved by TC to record aircraft weight and balance amendments by computation whenever a change to empty weight occurred. There were no weighing frequency intervals listed or used in the MCPM. The applicable CARs Standard 726 Appendix A - Fleet Empty Weight and Balance Control Program does not contain any regulatory guidance. The TC-authorized weight and balance control program at Buffalo Airways was in accordance with CARs Subpart 625 Appendix C and did not require the company to complete the 5-year reweigh and report updates as required for large aircraft. The last recorded weighing of C-GWIR was in 1990.

The aircraft has a maximum certified take-off weight (MCTOW) of 26 200 pounds in the passenger configuration. On the day of the occurrence, the aircraft was configured for 28 passengers, which is the maximum allowed. In addition to the 2 crew members in the cockpit, there were 21 passengers and 1 flight attendant in the main cabin. Additionally, the flight was loaded with cargo. Departure fuel was listed as 2707 pounds, which equates to 1702 litres.

The OFP has a weight and balance section. The calculation for the occurrence flight had been started by the FO, but not completed prior to departure. It was common practice to complete the OFP and weight and balance enroute. The OFP reflected a crew of 2, weight of 400 pounds, passenger seats weight of 546 pounds and the departure fuel load of 2707 pounds. Data from the incomplete OFP indicated a take-off weight of 21 844.2 pounds. An actual take-off weight was not determined. The passenger manifest did not include the weights of the passengers or of their carry-on baggage. Passengers and their luggage were not weighed when they checked in, which was in contravention of company procedures. A separate cargo manifest, which was not available to the crew of BFL168, indicated a cargo weight of 1071 pounds. A review of previously completed OFPs from other flights indicated the use of passenger weights that were adjusted to facilitate and maintain the weight and balance calculation within limits.

Using the applicable standard passenger weights as prescribed by the Company Operations Manual (COM), the data from the OFP and the actual cargo weight, the operational take-off weight for the occurrence flight was determined to have been 27 435 pounds, 1235 pounds over the MCTOW. The centre of gravity of 25% of mean aerodynamic chord (MAC) was within the limits prescribed by the manufacturer.

Aircraft performance

The minimum climb speed at maximum except take-off (METO) power at 26 200 pounds should not be lower than 90 knots indicated airspeed (KIAS).^{Footnote 4}

The DC-3 aircraft flight manual (AFM) indicates that with 1 engine inoperative and METO power or less on the operative engine, the minimum control speed – air (V_MCA) is 73 KIAS. At the take-off power setting, V_MCA will be 76 KIAS.

According to the AFM single-engine climb performance chart,^{Footnote 5} the DC-3 at the MCTOW of 26 200 pounds with the inoperative engine feathered, landing gear and flaps in the retracted position, should be able to achieve a rate of climb of 330 feet per minute (fpm). The performance charts do not differentiate between whether it is the critical engine^{Footnote 6} or non-critical engine that is inoperative. If the engine were idling under the same configuration, a single-engine rate of climb of 210 fpm could be achieved.

An Australian accident investigation (report number 9401043) conducted by the Department of Transportation, Bureau of Air Safety Investigation, in 1994, referenced testing the climb performance of the Dakota C47B. The tests were conducted to determine whether an increase in the MCTOW of 26 200 pounds would affect the single-engine climb performance. With the left engine inoperative and windmilling, the rates of climb for different weights were as follows:

It should be noted that the performance figures in Table 1 are predicated on the most adverse engine inoperative condition. Failure of the left (i.e., critical) engine will produce the more pronounced yaw/roll condition, which would require greater flight control inputs to counteract these forces. As a result of these control inputs, the aircraft will be exposed to greater drag, which will in turn negatively affect the aircraft's performance. Conversely, failure of the non-critical engine may not result in as great a decrease in performance, but a loss in climb performance will still be experienced. Appendix C illustrates the relationship between airspeed and altitude on the occurrence flight after the failure of the right engine and subsequent unfeathering of the right propeller.

CARs Subpart 705 requires the operator to calculate the net take-off flight path (NTOFP). CARs 705.57 (1) states:

No person shall conduct a take-off in an aeroplane if the weight of the aeroplane is greater than the weight specified in the aircraft flight manual as allowing a net take-off flight path that clears all obstacles by at least 35 feet vertically or at least 200 feet horizontally within the aerodrome boundaries, and by at least 300 feet horizontally outside those boundaries.

In addition, TC's Advisory Circular on regulations and standards for engine-inoperative obstacle avoidance states :

The net take-off flight path is the gross take-off path diminished by the required margins (0.8% for two-engine Transport Category aeroplanes) or the equivalent reduction in acceleration along that part of the take-off flight path at which the aeroplane is accelerated in level flight. The net take-off flight path must clear all obstacles within a prescribed area by at least 35 feet vertically.^{Footnote 7}

While the COM indicated a requirement to determine the NTOFP, these performance calculations had not been determined.

Engine and propeller examination

The Pratt and Whitney R1830-92 Twin Wasp 14-cylinder radial engine was air-cooled and had a single-speed supercharged induction system. The propeller was driven by a planetary reduction gear assembly reducing propeller rpm by a 16:9 ratio. The R1830-92 is rated for 1200 horsepower (HP) at takeoff, and 1050 HP at maximum continuous power operation.

The 14 cylinders were each composed of 2 main parts, a barrel and a head. The cylinder barrel was forged from steel alloy and included a flange for attachment to the crankcase and an externally threaded portion for mating with the head. The cylinder head was machined from aluminium casting and housed the intake and exhaust valves as well as 2 spark plug inserts. For assembly to the cylinder barrel, the cylinder head was heated then threaded onto the barrel while hot; it shrank while cooling creating a cylinder choke, a narrowing of approximately .015 inches.

Image

C-GWIR right engine number 1 cylinder head and barrel were found separated due to a fracture of the barrel at the threaded joint with the head assembly (Photo 1). The cylinder head, barrel and piston were forwarded to the TSB laboratory for examination. A pre-existing fatigue crack was discovered in a thread groove on the outer mating surface of the barrel assembly. The cause of the fatigue crack could not be determined due to post-separation damage in the area of the point of origin.

The time between overhaul (TBO) cycles for the R1830-92 was 1400 hours; the occurrence engine had accumulated 98.7 hours since overhaul at the time of the failure of the number 1 cylinder assembly. The overhaul inspection of the cylinder assembly consisted of visual and dimensional checks followed by non-destructive test (NDT) inspection. Dye penetrant or Magnaflux methods are used for the detection of cracks in the barrel or head components. The overhaul inspections determine if the assembly will remain in service or will be scrapped. Cylinder assembly life cycle is unlimited subject to passing inspection criteria. Company experience with these overhauled cylinders was to expect 3 to 4 cylinder failures per overhaul cycle. Most defects were discovered by maintenance inspections and pressure tests.

In the event of an engine failure or shut down on a multi-engine aircraft, feathering the propeller of the inoperative engine is critical to minimize the drag induced during flight. The DC-3 propeller feathering system provides a method to move the propeller blades to 88° pitch angle, which stops the rotation (windmilling) of the propeller. The system consists of an oil pump driven by an electric motor, which supplies pressure oil to the propeller dome via the propeller governor. A feathering button (located in the cockpit) energizes the pump, and pressure oil is applied to the aft side of a piston in the pitch change mechanism, which drives the blades towards feather. An electrical latch is created and controlled by the propeller governor pressure-sensitive cut-out switch assembly, which energizes a solenoid holding the button in. When the piston reaches its maximum stop (i.e., full feather position), the pressure increases to above 600 pounds per square inch (psi) where the cut-out switch releases the latch, de-energizing the solenoid, which releases the button and removes power from the pump motor. This completes the feathering cycle. If the trip pressure of 600 psi is not reached, the pump continues to run until it fails. There is no back-up pump.

A failure of the pump motor before full feather blade angle is achieved will result in the propeller blades moving towards fine pitch due to the centrifugal force of the rotating propeller and pitch change mechanism spring tension. Oil pressure is required to overcome these forces. There are no visual indications to warn the flight crew of pump operation. Monitoring the propeller rotation and the feathering button position are the only procedures to ensure proper operation has occurred.

The feathering system is also designed to unfeather the propeller. In normal procedures, a propeller may be unfeathered by holding the feathering button in. The propeller governor pressure-sensitive cut-out switch is overridden, enabling the pump pressure to rise above the pre-set dome distributor valve setting, which shuttles oil pressure to the opposite side of the piston in the pitch change mechanism and drives the blades towards fine pitch. In flight, this would cause the propeller to rotate due to airflow assisting in a restart procedure.

On the occurrence flight, the engine was shut down and the propeller feathering system activated. The propeller rotation slowed, but the propeller was then observed windmilling for the remainder of the flight. Impact marks on the bevel gears of the pitch change mechanism and rotating cam stop position indicate approximately 46° blade pitch angle at impact. The design of the propeller pitch change mechanism allows for normal constant speed blade angle operation between 18° and 48°. Feathering system pressure is required to overcome mechanical resistance above 49° to prevent inadvertent propeller feathering.

Feathering system components were inspected and an anomaly was found in the electric pump motor. Subsequent system tests indicated that the motor was not operational post impact. The motor, pump, propeller governor, and associated relay were removed and sent to the TSB laboratory for analysis. Some system component failures will result in the pump continuing to run and cycling the propeller blade angle through feather and back towards fine pitch. The excessive and changing drag status of the aircraft with a windmilling propeller would make it difficult to control the aircraft.

The Douglas Products Division (DPD) of Boeing Aircraft Company issued a Flight Operations Bulletin^{Footnote 8} applicable to DC-3 Engine Feathering Procedure following a DC-3 accident in the Netherlands^{Footnote 9} in which the propeller failed to feather. The bulletin advised operators to make flight crews aware of the details of the accident and advise them that it is possible to interrupt a malfunction of the feathering system and fully feather the propeller. This can be accomplished by pulling the feathering button out when the propeller reaches full feather. Buffalo Airways DC-3 flight crews were aware of this procedure.

Company

General

The company has been in operation since 1970 and operates under the authority of a TC-issued air operator certificate (AOC) 6576 to conduct 703 (Air Taxi) and 705 (Airline) operations. Buffalo Airways has approximately 10 aircraft within its 705 fleet and provides passenger and cargo services throughout the Canadian Arctic. The occurrence flight was operating under CARs 705 on a regularly scheduled flight.

Operational control

As a CARs Subpart 705 (Airline) operation, the company maintains a COM. The COM provides guidance to employees with regards to the company's normal and emergency procedures. The COM is approved by TC. The Buffalo Airways COM has a section that describes the procedures to be undertaken with regards to checking in passengers and cargo. Passengers are to be queried as to the amount of carry-on baggage they are bringing onboard. If it is in excess of 8 pounds, then it is to be weighed. Standard passenger weights are to be employed unless it is apparent that the passenger does not fit the standard weight as follows:

A weight and balance calculation is to be determined for each flight, and the weight must be within the aircraft's maximum weight limits and meet the performance requirements determined in the AFM.

Commercial flights are also required to have prepared an OFP prior to departure. Additionally, the NTOFP calculation is to be determined.

As of March 2010, Buffalo Airways was recognized by TC as a safety management system (SMS)-compliant company. TC describes an SMS as “an explicit, comprehensive and proactive process for managing risks that integrates operations and technical systems with financial and human resource management, for all activities related to a CAD [Civil Aviation Document].”^{Footnote 10}

The company employs a Pro-Active and a Re-Active Risk Assessment reporting systems. These systems allow the company to identify issues that may expose the company to risk. Once identified, these issues are assessed and an internal corrective action plan may be implemented to address and correct them. In the year leading up to the occurrence, neither the Pro-Active nor the Re-Active Risk Assessment programs identified issues relating to operational control, weight and balance, or calculated aircraft performance to have been of concern.

Transport Canada oversight

Transport Canada Civil Aviation (TCCA) is responsible for the regulatory oversight of the civil aviation industry in Canada. In 2005, the CARs were amended to require the holders of certain CADs, including an AOC issued under subsection 705.07 of the CARs, to establish, maintain, and adhere to an SMS. Buffalo Airways received an initial SMS assessment by TC in July/August 2009 to confirm that Buffalo Airways had developed and implemented an SMS. TC employs a variety of mechanisms to ensure that certificate holders' SMS are compliant with the CARs (Appendix D).

TC carries out surveillance activities at 2 levels: systems and process levels.^{Footnote 11}

Systems level surveillance is conducted using assessments and/or PVIs (program validation inspections). During these activities, a surveillance team reviews an enterprise's systems to develop an understanding of how they comply with regulatory requirements. Based on this understanding, a sampling plan is developed and executed to determine whether an enterprise is in compliance with its regulatory requirements and the degree to which they can effectively continue to remain in compliance. The output of a systems level surveillance activity is findings of either compliance or non-compliance. Findings of non-compliance are at the systems level and are meant to have enterprises correct their systems in such a way that they return to compliance and maintain that state.

TC also carries out process level surveillance utilizing process inspections.

Process level surveillance is far more focused than systems level surveillance. During these activities, TCCA inspectors review an enterprise's process to develop an understanding of the process. Inspectors can then trace an output from the process to determine if it functions yes or no (ie. does the process achieve what it is intended to achieve.) The output of a process level surveillance activity can be findings of compliance (and termination of the process inspection) or non-compliance or the initiation of a systems level surveillance activity.

Surveillance activities at Buffalo Airways

Prior to the implementation of SMS, TC used a combination of inspections and audits to carry out its oversight of operators. The audit and inspection cycle for Buffalo Airways during that period was a cycle of repeated inspection findings during which inspections would identify unsafe conditions, the company would take action to address them and, sometime later, the conditions would recur.

TC conducted its first SMS assessment at Buffalo Airways in 2009. During its investigation into this occurrence, the TSB reviewed the surveillance activities carried out by TC and the company's responses for the 3 years leading up to the occurrence (Appendix E). During this period, TC carried out 4 surveillance activities consisting of 1 SMS assessment, 1 process inspection (PI) and 2 program validation inspections (PVI). All 4 of these surveillance activities were focused on various required elements of the SMS.

Operators are required to submit corrective action plans (CAP) to TC for any findings arising from a TC surveillance activity. CAPs are expected to provide the operator's analysis of the reasons underlying the deficiency and provide an action plan to address them. TC inspectors are responsible for assessing the CAP. Accepted CAPs are assessed for either administrative or on-site follow-up^{Footnote 12} by TC whereas rejected CAPs can be returned to the operator for revision or form the basis for a notice of suspension of the AOC.

The TSB also reviewed CAPs submitted by Buffalo Airways. In the initial CAP submissions for the December 2011 PVI, the operator took exception to multiple findings, requesting clarification as to the regulatory basis for the deficiencies identified by TC, and explicitly questioning the competence and motivation of TC inspectors. TC rejected these initial CAPs noting that the CAP process was not the appropriate venue for “repeated diatribes against Transport Canada.”^{Footnote 13} Buffalo Airways revised the CAPs and they were accepted by TC. The picture presented by the TSB review was one of an operator at odds with the regulator.

Following the occurrence, TC conducted 2 additional surveillance activities: a PI examining processes related to operational control and technical dispatch, followed by a PVI focused on the operational control system, due to the issues identified during the PI (Appendix E). These surveillance activities identified and documented the weight and balance control issues described previously in this report.

To examine the company's operational control system following the occurrence, TC inspectors adapted surveillance worksheets intended for use for Subpart 703 and 704 operations, which are not yet required to have an SMS. When conducting surveillance on these operators, TC employs PVIs and PIs, but focuses on operational control and other systems these operators are required to have in place.

Organizational safety culture and safety management system

Safety culture can be defined as “Shared values (what is important) and beliefs (how things work) that interact with an organization's structures and control systems to produce behavioral norms (how we do things around here).”^{Footnote 14} Relating safety culture to an organization's ability to manage risks, organizations are understood to exist on a continuum from ‘extremely discouraging' to ‘extremely supportive' of effective safety communication.^{Footnote 15}

Documentation provided by TC to assist operators with the transition to SMS emphasizes the importance of safety culture to the effective implementation of SMS:

An effective implementation strategy for SMS will involve changes in processes and procedures and will almost certainly involve a shift in the corporate culture. […] Every organization has a culture, good or bad, safe or unsafe, the corporate culture is reflected in the mode of operation throughout the organisation. Typically, the tone of the culture is established from the top down. If the accountable executive is committed to managing safety risks then the way that organization operates will reflect this philosophy.^{Footnote 16}

Office of the Auditor General report

In the spring of 2012, the Office of the Auditor General (OAG) published the report of an audit it conducted to determine whether TC has adequately managed the risks associated with overseeing its civil aviation safety program.

Overall, the OAG concluded that TC has made real progress transitioning to an oversight methodology suited to SMS. It also concluded there was more work to be done:

Senior management now needs to concentrate its efforts on ensuring that staff apply the approved methodology consistently and rigorously, that managers provide the necessary review and supervision, and that an effective continuous improvement program is put in place. Otherwise, Transport Canada will not have the assurance it needs that the industry is operating in compliance with the regulatory framework for civil aviation safety in Canada.^{Footnote 17}

The OAG report issued recommendations with respect to the number of surveillance activities conducted, the manner in which surveillance was conducted and documented, and management oversight of surveillance activities. The report did not comment on the focus of surveillance activities except to note that in moving to SMS, the role of inspectors was changing from being auditors of regulatory compliance to taking on the role of system evaluators while conducting traditional audits as necessary.^{Footnote 18}

Transportation Safety Board of Canada Watchlist

Safety management and oversight are included in the 2014 TSB Watchlist of issues which pose the greatest risk to Canada's transportation system. The problem is stated as “Some transportation companies are not effectively managing their safety risks, and Transport Canada oversight and intervention has not always proven effective at changing companies' unsafe operating practices.”

The Watchlist called for a number of actions to address these deficiencies. Those companies that do have an SMS must demonstrate that it is working—that hazards are being identified and effective risk mitigation measures are being implemented. When companies are unable to effectively manage safety, Transport Canada must not only intervene, but do so in a manner that succeeds in changing unsafe operating practices.

TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP 158/2013 – Examination of Failed Cylinder
• LP 161/2013 – Feathering System Examination

The aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. The flight crew was certified and qualified for the flight in accordance with existing regulations. Fatigue was not considered a contributing factor. The analysis will therefore focus on the mechanical aspects of the engine failure, the company's operating practices, safety management system, safety culture, and Transport Canada (TC) oversight.

Cylinder failure and propeller feathering mechanism

The right engine number 1 cylinder failed as a result of a pre-existing fatigue crack located in a thread groove on the outer mating surface of the barrel assembly. The resulting separation of the head assembly and induction pipe would have allowed supercharged air/fuel mixture and engine oil to be discharged into the engine compartment where spark ignition of the failed cylinder or hot exhaust pipes in the immediate area caused the engine fire.

The location of the fatigue crack point of origin on the failed cylinder was not readily accessible for any direct inspection prior to the occurrence. The fatigue crack had not progressed through the barrel wall, and disassembly of the cylinder would have been required to inspect the inner surface. Cylinder differential pressure checks would also not have detected this crack as the surrounding cylinder head would have prevented the crack from opening. Fatigue is the mode of failure not the reason for failure. Due to post-separation surface damage of the fatigue crack point of origin, the cause could not be determined.

Feathering the propeller of an inoperative engine is critical to the performance of a multi-engine aircraft as it reduces parasite drag by moving the propeller blades towards a coarser pitch angle relative to the flight path of the aircraft. In most cases, the propeller will stop spinning. A non-feathered, or windmilling, propeller will induce a high parasite drag penalty on aircraft performance.

In order to maintain airspeed at or above the minimum airspeed of 90 knots indicated airspeed (KIAS), Buffalo 168 (BFL168) sacrificed climb performance and was barely able to maintain a constant altitude. Manoeuvring the aircraft to return to the airport led to a loss of altitude, which ultimately resulted in the collision with terrain.

After the right propeller's feathering mechanism was activated, the propeller never achieved a fully feathered condition due to a system failure. Post-occurrence testing of the propeller feathering system indicated the oil pump motor failed likely due to a seized bearing. Activation of the feathering system results in the pump motor running until sufficient oil pressure develops to trip the pressure-sensitive cut-out switch, set for 600 pounds per square inch (psi), which occurs when full feather position is reached. The compromised bearing likely slowed the motor speed resulting in decreased oil pressure. The pump will continue to run until it fails if the trip pressure is not reached and system operation is not monitored. There is no back-up pump.

Aircraft performance and weight and balance

The company procedure for maintaining accurate weight and balance data on its fleet by using calculations was ineffective. Inconsistencies between the weight and balance report at the last weighing in 1990 with subsequent amendments did not reflect actual aircraft configuration. The TC-authorized weight and balance control program at Buffalo Airways did not require the company to complete a 5-year reweigh, which was in accordance with an exception permitted under Canadian Aviation Regulations (CARs) 625 Appendix C.

Aircraft performance, as indicated in the aircraft flight manual (AFM), is predicated on the weight of the aircraft. In this occurrence, a complete and accurate weight and balance report was not calculated prior to takeoff. As the aircraft's weight and balance had not been updated since 1990, using actual passenger and cargo weights may not have produced an accurate take-off weight. As such, the crew would not be able to determine accurately the aircraft's performance capabilities during a normal takeoff. As was determined in the 1994 Australian DC-3 accident report,^{Footnote 19} aircraft operating above the maximum certified take-off weight (MCTOW) experience a serious degradation in climb performance when experiencing an engine failure with a windmilling propeller.

Additionally, the company did not have the capability to demonstrate how its aircraft could meet the CARs net take-off flight path (NTOFP) performance requirements, despite stating this requirement within its operations manual. This put the safety of flights at risk.

If companies do not adhere to operational procedures in their operations manual, there is a risk that the safety of flight cannot be assured.

Company culture and safety management system

A number of conditions contributed to the aircraft's inability to gain altitude, including the practice of operating the aircraft overweight. This portion of the analysis will focus on this practice, how it came to be accepted within the organization, and how the operator's safety management system (SMS) did not identify and address it. In addition, this section will examine how the regulator's approach to oversight of the operator's SMS reduced the likelihood of the regulator identifying this unsafe practice in the course of regulatory surveillance.

SMSs are intended to promote the proactive management of risk by operators. While regulations identify the components and processes required of an SMS, the degree to which these will be effective depends on the safety culture of the organization into which they are introduced. As the collection of values and beliefs that drive individual behaviour, organizational safety culture will determine the extent to which the mandated processes and components are used. In particular, a safety culture that does not support a thriving SMS is unlikely to have effective processes for reporting hazards.

In this occurrence, the aircraft departed without a completed weight and balance calculation and was later determined to weigh in excess of the MCTOW at the time of departure. The investigation found that it was common to operate in this manner, and that weight and balance forms were normally completed enroute without the benefit of accurate information and without using standard or actual passenger weights as required by the Company Operations Manual (COM). The risks associated with operating the aircraft overweight may not have been fully appreciated by the crews since NTOFP performance calculations required by the Canadian Aviation Regulations (CARs) and specified in the COM were not being conducted. As a result, no assessment of obstacle clearance in the event of an engine failure during takeoff had been carried out. Successful adaptations from procedures tend to reinforce that activity. Therefore, previous success in operating the aircraft overweight was likely taken as assurance of future performance without consideration being given to aircraft performance in the event of an emergency. Given that neither the Pro-Active nor the Re-Active Risk Assessment programs identified issues relating to operational control, weight and balance or calculated aircraft performance, and that the practice of adjusting weight and balance calculations to maintain them within limits after departure was well known and accepted by senior management, it was highly unlikely that these unsafe practices would be reported through, or addressed by, the company's SMS.

There were other indications that the organizational culture at Buffalo Airways was not supportive of a system that required the organization to take a proactive role in identifying hazards and reducing risks. The company's response to deficiencies identified during TC surveillance activities demonstrated an adversarial relationship between the company and the regulator. The company refuted the regulatory basis of findings, questioned the competence of TC inspectors, and initially did not take responsibility for the issues identified. The overall picture that emerged from this investigation is of an organization that met the basic requirements of regulations and then only when pushed by the regulator. An SMS introduced into a culture motivated merely to comply with regulations is unlikely to be effective. The operator's SMS was ineffective at identifying and correcting unsafe operating practices.

Transport Canada oversight

TC must oversee operators across the full spectrum of safety cultures. As such, a flexible approach to providing oversight is required. It should allow for less frequent validation of programs and processes for those operators that have shown themselves to be proactively managing risk while providing for more frequent oversight aimed at ensuring at least a minimum level of compliance with regulations for those operators at the other end of the spectrum.

Recognizing this, TC has adopted a risk-based approach to planning surveillance activities, which provides for more frequent oversight of those companies that TC assesses as posing the greatest risk. In this approach, it is the frequency of the surveillance that is modified based upon the profile of the operator while the focus of the surveillance activities remains the same. In the 3 years leading up to this occurrence, TC conducted 4 surveillance activities at Buffalo Airways, all 4 of which were focused on various components of the required SMS. The unsafe practices observed in this occurrence (operating overweight and not performing required performance calculations) were not identified, and there was no record of any surveillance activity that specifically examined compliance with other sections of the CARs or Commercial Air Service Standards (CASS). While the version of SUR-001^{Footnote 20} in place for most of the period examined in the investigation into this occurrence provided for the conduct of direct checks of compliance, including ramp and flight checks, these were not employed during this period, and the description of such additional surveillance activities is not included in the latest edition of SUR-001.

In principle, any process required by regulation may be the focus for a process inspection (PI) or a process validation inspection (PVI). Targeted PIs across a range of areas have the potential to identify a lack of compliance with regulations requiring those processes. For example, there is nothing preventing TC from performing a PI focused on the operator's operational control system or load control system. However, in the case of Buffalo Airways, the focus of all surveillance activities conducted in the 3 years leading up to the occurrence was on processes related to the SMS. TC's surveillance activities did not identify the operator's unsafe operating practices related to weight and balance and net take-off flight path calculations. Consequently, these unsafe practices persisted.

Following the occurrence, TC conducted 2 surveillance activities that clearly identified deficiencies in operational control. For the purposes of these surveillance activities, TC inspectors modified their approach, borrowing a tool intended to verify compliance with regulations through an examination of the company's operational control system. This approach is targeted towards companies not yet required to have an SMS.

While a move towards SMS has great potential to enhance safety by encouraging operators to put in place a systemic approach to proactively manage safety, the regulator must also have assurances of compliance with existing regulations, particularly for operators that have demonstrated a reluctance to exceed minimum regulatory compliance. In order to assess regulatory compliance, and hence whether risks are sufficiently mitigated, inspectors must have appropriate processes and carry out detailed inspections of actual operating procedures and practices.

The current approach to regulatory oversight, which focuses on an operator's SMS processes almost to the exclusion of verifying compliance with the regulations, is at risk of failing to address unsafe practices and conditions. If TC does not adopt a balanced approach that combines inspections for compliance with audits of safety management processes, unsafe operating practices may not be identified, thereby increasing the risk of accidents.

Findings as to causes and contributing factors

1. An accurate take-off weight and balance calculation was not completed prior to departure, resulting in an aircraft weight that exceeded its maximum certified take-off weight.
2. The right engine number 1 cylinder failed during the take-off sequence due to a pre-existing fatigue crack, resulting in an engine fire.
3. After the right propeller's feathering mechanism was activated, the propeller never achieved a fully feathered condition likely due to a seized bearing in the feathering pump.
4. The windmilling right propeller caused an increase in drag which, combined with the overweight condition, contributed to the aircraft's inability to maintain altitude, and the aircraft collided with terrain short of the runway.
5. The operator's safety management system was ineffective at identifying and correcting unsafe operating practices.
6. Transport Canada's surveillance activities did not identify the operator's unsafe operating practices related to weight and balance and net take-off flight path calculations. Consequently, these unsafe practices persisted.

Findings as to risk

1. If companies do not adhere to operational procedures in their operations manual, there is a risk that the safety of flight cannot be assured.
2. If Transport Canada does not adopt a balanced approach that combines inspections for compliance with audits of safety management processes, unsafe operating practices may not be identified, thereby increasing the risk of accidents.
3. If cockpit or data recordings are not available to an investigation, this may preclude the identification and communication of safety deficiencies to advance transportation safety.

Other findings

1. Current Canadian Aviation Regulations permit a transport category piston-powered aircraft to carry passengers without a flight data recorder or cockpit voice recorder.
2. The crew resource management component of the flight attendant's training had not been completed.

Safety action taken

Buffalo Airways

The company has begun to enforce the practice of weighing individual passengers and baggage in order to calculate a weight and balance prior to departure. The company has also contracted the development of net take-off flight path charts for its flights.

On 25 February 2015, Transport Canada approved a revised Company Operations Manual for Buffalo Airways. As a result of this occurrence, the company made the following changes:

• complete revision and re-issuance of a new Company Operations Manual;
• structural re-organization of the roles and responsibilities of management personnel; the safety management system (SMS) manager now has a reporting line direct to the accountable executive; and
• the appointment of new staff, including a new accountable executive, a new operations manager assistant, and a new director of maintenance.

Additionally, Buffalo Airways has completed

• comprehensive re-training of the operations manager;
• hiring of an operations consultant to assist with regulatory compliance;
• re-alignment of the operations manager's responsibilities to identify and address more effectively non-compliance with regulatory requirements; and
• development of policies and procedures by the accountable executive and the operations manager to ensure regulatory compliance.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 22 April 2015. It was officially released on 27 April 2015.

Appendix A – Yellowknife aerodrome chart

Image

Source: NAV CANADA, Canada Air Pilot (CAP 1)

Appendix B – C-GWIR flight path

Image

Source: Google Earth, with TSB annotations

Appendix C - Derived indicated airspeed vs altitude

Image

Appendix D – Transport Canada Civil Aviation definitions

Appendix E – Summary of Transport Canada surveillance activity

Surveillance activities carried out by Transport Canada at Buffalo Airways in the 3 years leading up to the occurrence

Occurrence 19 August 2013