Aviation Investigation Report A16O0016

On 30 January 2016, the Air Canada Embraer 190-100IGW (registration C-FNAW, serial number 19000149) was operating as flight 726 (ACA726) on a scheduled flight from Toronto/Lester B. Pearson International Airport, Ontario, to LaGuardia Airport, New York, United States. ACA726 taxied over the hold line and onto Runway 24R without authorization at the same time that an Air Canada Airbus 320-214 (registration C-FZQS, serial number 2145) operating as flight 1259 (ACA1259), was on final approach for landing on the same runway. At 2101:38 Eastern Standard Time, as ACA726 was turning onto the runway centreline, the flight crew of ACA1259, which was now 0.41 nautical miles from the Runway 24R threshold and at 270 feet above ground level (AGL), reported to the airport controller that there was an aircraft on the runway and that they were overshooting the runway. ACA1259 was climbing through 580 feet AGL when it flew over ACA726. Air traffic control had not been aware of the runway incursion before being notified by ACA1259 that there was an aircraft on the runway. The incursion occurred during hours of darkness.

This report is also available in English.

History of the flight

On 30 January 2016, runways 23 and 24R at the Toronto/Lester B. Pearson International Airport (CYYZ), Ontario, were being used for arriving and departing aircraft.

Air Canada flight 726 (ACA726), an Embraer 190 aircraft, was operating on a scheduled flight from CYYZ to LaGuardia Airport (KLGA), New York, United States, with 4 crew members and 50 passengers on board. ACA726's scheduled departure time was 2035.^{Footnote 1}

At approximately 2025, while ACA726 was parked at Gate 168A, the flight crew consulted with company dispatch regarding flight performance data that was required prior to takeoff. After receiving the data and entering it into the aircraft's flight management system (FMS),^{Footnote 2} ACA726 requested authorization to push back from the gate at 2044:38. After pushback was completed and the engines were started, the flight crew received an FMS data error message that needed to be corrected before takeoff.

ACA726 was authorized to remain where it was on the apron (pushed back from the gate) until it was advised by the apron management unit^{Footnote 3} (apron control) that it would have to move. The captain requested authorization to taxi to a location that was out of the way, and at 2056:20, ACA726 was authorized to taxi on the apron to Taxiway DV, as it would be departing from Runway 24R (Figure 1). The captain taxied the aircraft while the first officer (FO) worked with company dispatch to correct the FMS data error.

At 2058:40, the FMS data error was corrected, just as ACA726 arrived at Taxiway DV. Based on their close proximity to Runway 24R, the flight crew completed the pre-takeoff checks while on the apron before requesting further taxi instructions to Runway 24R.

At 2059:16, ACA726 then contacted ground control to request taxi instructions. The ground controller^{Footnote 4} completed a scan of the NAV CANADA Extended Computer Display System (EXCDS),^{Footnote 5} but since apron control had not yet forwarded the flight data entry (FDE)^{Footnote 6} for ACA726 to ground control, there was no indication on the ground controller's EXCDS display screen that ACA726 was ready to taxi.

At the same time, Air Georgian flight 7286 (GGN7286)—a Beech 1900 also taxiing for departure on Runway 24R—was under the control of the ground controller. Because call signs of 726 and 7286 sounded similar, the ground controller believed that the transmission had originated from GGN7286 and asked GGN7286's flight crew to repeat their transmission. GGN7286 replied that it was on Taxiway C. Shortly afterward, ACA726 requested taxi instructions a second time because its first call had not been addressed. The ground controller then coordinated the transfer of control of ACA726 with apron control.

At 2059:58, the ground controller issued taxi instructions to ACA726 to taxi from the apron to Runway 24R, stating, "seven two six, two four right for you, ATIS^{Footnote 7} Zulu, altimeter two niner six niner, you're gonna give way to that Georgian and taxi into the holding bay."^{Footnote 8}

While ACA726 was taxiing, Air Canada flight 1259 (ACA1259), an Airbus 320, was on final approach for Runway 24R. ACA1259 was operating on a scheduled flight from Licenciado Gustavo Díaz Ordaz International Airport, Puerto Vallarta (MMPR), Mexico, to CYYZ, with 5 crew members and 143 passengers on board. At 2100:24, the airport controller^{Footnote 9} cleared ACA1259 to land on Runway 24R.

The ACA726 flight crew were not aware that ACA1259 had been cleared to land on Runway 24R because the landing clearance was issued on the tower frequency, while ACA726 was monitoring the ground frequency.

At 2100:42, the ground controller asked the ACA726 flight crew if they were ready to go, and the FO replied, "I think that we finally got everything all sorted out here, so yeah, we are ready." The ground controller replied, "OK, the nineteen hundred [GGN7286] is still waiting for their video player to finish so he is not ready; you can go to the right side and [switch to frequency] eighteen thirty-five" (Figure 2). This transmission was interpreted by ACA726's flight crew as authorization to go to the right runway (i.e., Runway 24R). ACA726 subsequently read back, "Over to the right side, eighteen thirty-five. Thanks for the help, Air Canada seven two six." The ground controller then forwarded the EXCDS FDE to the airport controller as per procedure.

While ACA726 was taxiing, both the captain and FO observed an aircraft on final approach and believed it to be landing on Runway 24L, which is parallel to Runway 24R (Figure 2).

While planning to release ACA726, the airport controller observed the aircraft on the advanced surface movement guidance and control system (A-SMGCS)^{Footnote 10} display as it approached the hold line. The airport controller then looked toward the final approach of Runway 24R to ensure that ACA726 could be taxied into position onto the runway in preparation for takeoff between ACA1259 and a second aircraft, both of which were on final approach to land on the same runway.

At 2101:33, while the airport controller's attention was directed away from ACA726 and toward the aircraft that was on final approach to Runway 24R, ACA726 taxied over the hold line. At 2101:45, when ACA726 crossed the edge of Runway 24R, the runway incursion monitoring and conflict alert system (RIMCAS)^{Footnote 11} stage 1 visual alert displayed on the tower A-SMGCS display. The RIMCAS stage 1 visual alert went unnoticed on the A-SMGCS display.

Approximately 5 seconds later, as ACA726 was turning onto the Runway 24R centreline, the flight crew of ACA1259, which was 0.41 nautical miles (nm) from the Runway 24R threshold and 270 feet above ground level (AGL), reported to the airport controller that there was an aircraft on the runway and that they were overshooting the runway. The stage 2 aural alert on the tower RIMCAS sounded in the tower at the same time as ACA1259 reported that it was overshooting the runway. ACA1259 was climbing through 580 feet AGL when it flew over ACA726 on the runway.

The airport controller could not visually see ACA726 on the runway from the south tower controller work position. When asked by the airport controller, ACA726 reported that it was on Runway 24R. The airport controller advised ACA726 that it had not been given authorization to line up on Runway 24R and requested that it hold its position.

At 2103:00, ACA726 was cleared for takeoff on Runway 24R and departed for KLGA. ACA1259 subsequently landed safely following its second approach.

Following the flight, both the captain and the FO of ACA726 overnighted in KLGA. The next morning, the captain discussed the occurrence with the chief pilot and it was agreed to continue with flight operations for that day.

When the captain returned to CYYZ that evening, an aviation safety report was submitted. This type of report is used to capture aviation occurrences for analysis by the flight safety department under Air Canada's safety management system.

Weather

The CYYZ aerodrome routine meteorological report (METAR) issued at 2000 was as follows: wind 230° true (T) at 6 knots, visibility 15 statute miles (sm), broken ceiling at 14 000 feet AGL, broken ceiling at 19 000  AGL, temperature 4°C, dew point −1°C, and altimeter 29.69 inches of mercury.

Operator

Air Canada conducted an internal safety investigation, which included a round-table discussion with the captain, FO, chief pilot, fleet specialist, and a representative from the Air Canada Pilots Association. The occurrence was discussed, and the captain and FO were debriefed and acknowledged an understanding of their error. Threat-and-error management (TEM)^{Footnote 12} techniques were also discussed, and the discussion included a review of similar accidents and incidents, as well as their causes, to emphasize the severity of these situations.

Flight crew

Records indicated that the ACA726 flight crew were certified and qualified for the flight in accordance with existing regulations.

Air Canada 726 captain

The captain had approximately 10 000 hours total flying time, including 1250 hours on the Embraer 190. The captain's duty day began at 1920, with a scheduled departure time of 2035, and ended at 2221, for a duty day of 3 hours and 1 minute.

Air Canada 726 first officer

The FO had approximately 8200 hours total flying time, including 2500 hours as first officer on the Embraer 190. The FO's duty day began at 1255, with a scheduled departure time of 1410. The FO operated a flight from CYYZ to CYOW and return, followed by a 3-hour layover prior to working the occurrence flight. The FO's duty day ended at 2221, for a duty day of 9 hours and 26 minutes, which is within regulations.

Toronto/Lester B. Pearson International Airport

The CYYZ airport has 5 runways: 05/23, 15L/33R, 15R/33L, 06L/24R and 06R/24L. Runways 24L and 24R are parallel and their centrelines are separated by approximately 1000 feet (Appendix A).

Air traffic services

Staffing

The air traffic controllers working in the tower during the occurrence were licensed and qualified for the operation.

The airport controller, who was also the shift supervisor responsible for the tower operation, had been a controller at CYYZ since 2005, and a shift supervisor since 2008. The ground controller had been a controller at CYYZ since 2008.

Air traffic control procedures

There are 2 airport controller positions in the CYYZ tower. The north tower controller is responsible for arriving and departing aircraft on runways 05/23 and runways 15L/33R, and the south tower controller is responsible for arriving and departing aircraft on runways 06L/24R, runways 06R/24L and runways 15R/33L. Local operating procedures allow one airport controller to assume responsibility for both the north and south positions in a combined position operation during periods of light traffic at the airport.

There are also a clearance delivery controller position and 3 ground controller positions: north, central, and south. A south tower monitor position is opened when parallel runways 06L and 06R or parallel runways 24L and 24R are used simultaneously.

On the evening of the occurrence, Runway 23 was initially used for departing aircraft and Runway 24R for arriving aircraft. One airport controller was working a combined position operation, as the traffic at the airport was considered light.

Just prior to the occurrence, air traffic control decided that Runway 23 and Runway 24R would be used for both arriving and departing aircraft, which now required 2 airport controllers: one to assume the responsibility of the north tower position and Runway 23, and the shift supervisor to assume the responsibility of the south tower position and Runway 24R. The north and south ground positions, including the clearance delivery position, were also open.

Automatic terminal information service

According to Transport Canada's Aeronautical Information Manual,

ATIS is the continuous broadcasting of recorded information for arriving and departing aircraft on a discrete VHF/UHF frequency. Its purpose is to improve controller … effectiveness and to relieve frequency congestion by automating the repetitive transmission of essential but routine information.

[…]

Each recording will be identified by a phonetic alphabet code letter, beginning with ALFA. Succeeding letters will be used for each subsequent message.^{Footnote 13}

The CYYZ ATIS message X-ray, issued at 2009, stated that Runway 23 was being used for departing aircraft and Runway 24R was being used for arriving aircraft. ATIS message Yankee, issued at 2030, stated that runways 23 and 24R were both being used for arriving and departing aircraft. ATIS message Zulu, issued at 2033, also stated that runways 23 and 24R were both being used for arriving and departing aircraft. ATIS message Zulu was the current ATIS message when ACA726 was issued taxi instructions from the apron to Runway 24R.

The investigation was unable to determine which ATIS message the ACA726 flight crew had received.

Air traffic control phraseology

The sequence for issuing taxi instructions to aircraft that are taxiing for departure is provided in the NAV CANADA Air Traffic Control Manual of Operations (ATC MANOPS).

At the end of the sequence, the air traffic controller can instruct the flight crew to contact the tower on a specific frequency "now," at a specific location and time, or holding short of the runway that will be used for take-off. The flight crew can also be instructed to monitor the tower on a specific frequency either "now" or at a specific location and time.^{Footnote 14}

While the manual permits the use of the phraseology "contact the tower holding short" of the runway that will be used for takeoff, the use of "holding short" is optional. The use of "holding short" when issuing taxi instructions is not considered a restriction to hold short of the runway at the hold line; therefore, a readback from the flight crew is not required. In this scenario, holding short refers to the location where the flight crew is to change from the ground frequency to the tower frequency and to contact the tower controller.^{Footnote 15} However, an instruction to hold short of a runway or taxiway requires the air traffic controller to obtain a readback.^{Footnote 16}

ATC MANOPS also allows controllers to "issue taxi authorizations and instructions in plain, concise language to aircraft taxiing on the manoeuvring area."^{Footnote 17}

ATC MANOPS requires an air traffic controller "to instruct an aircraft to taxi, cross or hold short of any runway/taxiway it will cross while taxiing."^{Footnote 18} However, ATC MANOPS does not require an air traffic controller to instruct an aircraft taxiing for departure to hold short at the departure end of a runway that will be used for takeoff. In this scenario, flight crews are not permitted to taxi across a hold line on a taxiway leading to a departure runway that will be used for takeoff unless they have received either an authorization to line up on the runway in preparation for takeoff, or an authorization to take off. Under normal circumstances, an airport controller, not a ground controller, will authorize an aircraft to line up on the runway in preparation for takeoff.

The investigation determined that ground controllers at CYYZ use differing phraseology when issuing taxi instructions into a holding bay. Some controllers use "go to the right" or "go to the left," others use "stay to the right" or "stay to the left," and still others use "stay west" or "stay east."^{Footnote 19}

Airport ground lighting system

The CYYZ airport ground lighting system is equipped with stop bars collocated with a hold line across a taxiway leading to a runway. As described in the Transport Canada Aeronautical Information Manual (TC AIM), stop bars "consist of [in-pavement] lights spaced at intervals of 3 m across the taxiway. They appear showing red in the intended direction of approach to the intersection or taxi-holding position."^{Footnote 20} Flight crews and vehicle operators are not allowed to cross an illuminated stop bar. An authorization from air traffic control, in conjunction with an extinguished red stop bar, is always required before entering an active runway.

Transport Canada publication TP 312 is the authoritative document that dictates airport requirements in Canada. It specifies, in part, that "a stop bar is provided at every runway‑holding position serving a runway operating in visibility conditions below RVR 1200 (¼ SM)."^{Footnote 21}

At CYYZ, stop bar lights are illuminated at the hold line across taxiways that cross an active runway. However, one exception is that they are not illuminated at the hold line across a taxiway or in a holding bay at the departure end of an active runway unless the airport is operating under reduced visibility operations.^{Footnote 22}

Annex 14 to the Convention on International Civil Aviation, Volume 1, specifies, in part, that runway incursions "may take place in all visibility or weather conditions. The provision of stop bars at runway-holding positions and their use at night and in visibility conditions greater than 550 m [1800 feet] runway visual range can form part of effective runway incursion prevention measures."^{Footnote 23}

NAV CANADA also published this information^{Footnote 24} in a Runway Safety and Incursion Prevention Panel News Flash on runway safety and the use of stop bars.^{Footnote 25}

Some controllers reported that turning the stop bar lights on and off was cumbersome and time consuming, and that their use at the departure end of a runway could impede airport operations.

Advanced surface movement guidance and control system and runway incursion monitoring and conflict alert system

When an airport ground lighting stop bar is illuminated using the lighting panel, it is displayed on the tower A-SMGCS display as a red line and appears just beyond the physical hold line across the taxiway or in the holding bay, which is displayed in light blue.

At CYYZ, the A-SMGCS consist of a runway incursion monitoring and conflict alert system (RIMCAS), described by NAV CANADA as a system that monitors aircraft and vehicle target position reports to continuously assess the traffic situation. Once a potentially hazardous situation is detected according to a configurable set of rules, the RIMCAS will send an alert message to the air traffic controller giving information on the identity and location of the involved targets and the severity of the situation.^{Footnote 26}

Alerts are presented in 2 stages. A stage 1 alert is a visual alert displayed on the tower A‑SMGCS display that cautions the air traffic controller that a situation has occurred that needs special attention. A stage 2 alert is a visual alert displayed on the tower A-SMGCS display with an aural alarm sounded in the tower that warns the air traffic controller that a critical situation may occur.^{Footnote 27}

Stop bar overrun monitoring and runway incursion monitoring are functions of the RIMCAS.

The stop bar overrun monitoring function of the RIMCAS assesses aircraft and vehicle target position reports and generates an aural alert to the air traffic controller whenever any target reported by the A-SMGCS crosses an illuminated stop bar that is associated with a hold line and that has not been disabled first.^{Footnote 28} Aircraft that have landed or vehicles and aircraft that are on the runway and exit will not trigger an alarm.

The runway incursion monitoring function of the RIMCAS assesses aircraft and vehicle target position reports from the A-SMGCS in order to warn the air traffic controller of a runway area incursion by aircraft or vehicles when an aircraft is due to land or take off on an active runway.^{Footnote 29} The runway area normally comprises the entire active runway and associated sensitive areas.^{Footnote 30}

These functions of the RIMCAS are designed to inform an air traffic controller that a runway incursion has occurred and allow for alternate instructions to be issued by the air traffic controller to the aircraft or vehicles involved.

RIMCAS-generated alerts and alarms are provided only to the air traffic controllers; they are not provided directly to flight crews on board aircraft.

Advanced surface movement guidance and control system and runway incursion monitoring and conflict alert system at Toronto/Lester B. Pearson International Airport

Given the good visibility at the time of the occurrence, there was no requirement to have the stop bar collocated with the hold line in the holding bay leading to Runway 24R illuminated. Therefore, the stop bar overrun monitoring function of the RIMCAS did not detect ACA726 taxiing over the disabled stop bar.

The RIMCAS runway incursion monitoring function was configured to monitor the approach area of Runway 24R, ahead of an aircraft on final approach and landing. It was configured to provide a stage 1 visual alert to the controller in the event of a conflict 30 seconds ahead of the landing aircraft, and a stage 2 visual alert and aural alarm for a conflict 20 seconds ahead of the landing aircraft. Under these conditions, a conflict is defined as another aircraft or vehicle crossing the runway edge.

During this occurrence, when the runway incursion monitoring function of the RIMCAS detected that ACA726 had crossed the edge of the runway, ACA1259 was less than 30 seconds from the Runway 24R threshold. Therefore, the RIMCAS stage 1 visual alert was displayed on the tower A-SMGCS display as ACA726 crossed the edge of Runway 24R. The stage 2 aural alarm sounded approximately 5 seconds later, as ACA726 was turning onto the runway centreline.

Visibility to the Runway 24R threshold from the tower

The threshold of Runway 24R is approximately 1.4 nm from the tower and, in darkness, the view is saturated with various lights from Terminal 1 (Figure 3). Because it is difficult to see aircraft in this area, controllers use the A-SMGCS display to confirm the positions of aircraft.

The airport controller observed on the A-SMGCS display that ACA726 was taxiing toward the hold line in the holding bay, but never saw the aircraft when looking outside of the tower toward the threshold of Runway 24R. ACA1259 reported that there was an aircraft on the runway, and the ACA726 FO confirmed when asked by the airport controller that they were on the runway. From the south tower controller work position, the airport controller was unable to see ACA726 on the runway given the light saturation at night.

Human factors

Work and sleep history of the flight crew

Air Canada 726 captain

The captain was based in and lived in the Toronto area. The captain had been off duty for 2 consecutive days prior to the occurrence day and recalled being rested and having slept well the night before. The captain had not been diagnosed with a sleep disorder or a medical condition that would interfere with obtaining quality sleep. Fatigue was not considered a factor for the captain.

Air Canada 726 first officer

The FO was based in Toronto and lived in Winnipeg, Manitoba. The occurrence took place on the FO's 6th consecutive day of work. Following 5 days off duty, the FO began a work rotation on 23 January 2016, was off duty on 24 January, then worked each day until the morning of 29 January. During this rotation, the FO stayed in a variety of accommodations, including a shared apartment in Toronto and various layover hotels. On the morning of 29 January, after operating a flight from St. John's International Airport, Newfoundland and Labrador, to CYYZ, the FO travelled home to Winnipeg, Manitoba, as a passenger. That evening, the FO was requested to work the following day (30 January) and accepted. Air Canada reserved a seat on a flight from Winnipeg, Manitoba, to CYYZ for the FO the following morning to ensure that the FO would arrive at CYYZ at the appropriate time. The commuting time from Winnipeg to CYYZ was not included in the FO's duty day.

On the morning of the occurrence, the FO woke at approximately 0615 (0515 Central Standard Time) following a 6.75-hour sleep period that was of good quality. During the preceding nights, between 25 January and 29 January, the FO had obtained between 5 and 6.75 hours of sleep per night. These sleep periods were also of good quality. During the 5 consecutive days off before the occurrence work rotation, the FO had obtained an average of 8 to 9 hours of good-quality sleep per night.

The FO had not been diagnosed with a sleep disorder or a medical condition that would interfere with obtaining quality sleep.

Pilot commuting and fatigue

A duty day begins when a flight crew member is required to report for, or to begin, a duty, and ends when that person is free from all duties. At Air Canada, a duty day is considered to have begun when flight crews report for duty according to the scheduled check-in time. Flight crews are relieved from duty upon completion of their final scheduled flight at the last engines-off, plus 15 minutes for post-flight duties. A duty day does not include the period spent commuting from the pilot's home to the point of reporting for duty. According to the Air Canada Flight Operations Manual, it is the responsibility of the flight crew member to report for duty in an adequately rested condition.^{Footnote 31} However, if a pilot is required to travel from the city where he or she is based to another location to operate a flight, this is considered deadheading and travel time is included as part of the duty day.

Commuting times and patterns can vary significantly among flight crew, and it is not uncommon for pilots to live in a city different from the city in which they are based. In these cases, flight crews will often travel as passengers on a flight from their home city to the city where they are based. To ensure that they are adequately rested, some flight crew members will often commute to the city where they are based on the evening prior to their scheduled flight. In this instance, the FO was unable to commute the evening before, given that the additional flight was scheduled and accepted on the evening of 29 January. Although a crew rest room was available at CYYZ, the FO elected not to use it, having previously experienced difficulty napping in the facility, and believing that a nap would have resulted in feeling more tired.

Research has shown that commute time can be a risk factor for fatigue during duty periods when it results in flight crews being awake for more than 16 hours before the scheduled end of duty.^{Footnote 32} As a result, it has been recommended that flight crews should avoid planning commutes or other pre-duty activities that result in being awake beyond approximately 16 hours before the scheduled end of duty.^{Footnote 33}

The Canadian Aviation Regulations (CARs) specify that no air operator shall assign a flight crew member for flight duty time and no flight crew member shall accept such an assignment when that time exceeds 14 consecutive hours, including 15 minutes for post‑flight duties.^{Footnote 34} At Air Canada, the maximum flight duty time may be extended by up to 3 consecutive hours under unforeseen circumstances.^{Footnote 35}

Expectation and mental models in operational environments

In real-world operational situations, people use their prior experience and knowledge to rapidly categorize the situation they are experiencing and select an appropriate course of action.^{Footnote 36} Therefore, in highly practised situations, attention and expectations are more often driven by one's existing mental model of the situation, since previous experience will dictate what information is important and how the situation will unfold.

Mental models are critical for effective performance in dynamic, time-critical environments, since they reduce the need for time-consuming evaluation of a given situation and enable quick actions. However, they can also lead to errors in how information is perceived. For example, inaccurate mental assessments of a situation can lead operators to rely too heavily on the first piece of information offered; this reliance is referred to as anchoring bias.

Inaccurate situational assessments can also increase the tendency to look for evidence that confirms or matches the current situation or decision, since previous experience will dictate what information to expect at any given time. This tendency is referred to as confirmation bias. These biases can make it less likely that individuals will reassess their initial assessment and update it with new information, or can lead them to hand-pick information that supports their current state of awareness, while dismissing information that is the opposite of what is expected.^{Footnote 37}, ^{Footnote 38} In many circumstances, we hear what we expect to hear and see what we expect to see.

Outstanding Board safety concern

In 2007, the Transportation Safety Board of Canada (TSB) conducted an investigation^{Footnote 39} into a runway incursion at CYYZ between a Learjet 35A taxiing for departure on Runway 05 and an Israel Aircraft Industries (IAI) 1124 Westwind aircraft landing on the same runway. After being instructed to hold short of Runway 05, the Learjet 35A taxied over the hold line and entered the runway at the same time that the IAI 1124 aircraft was landing. The IAI 1124 flight crew observed the Learjet 35A aircraft in front of them and manoeuvred to pass behind it. The two aircraft came within 60 feet of each other.

During the investigation, the TSB found that, until flight crews in aircraft that are taking off or landing receive direct warnings of incursions onto the runway they are using, the risk of high-speed collisions will remain. Given that little progress has been made to date on the implementation of systems in Canada that alert flight crews to runway conflicts, the safety concern remains outstanding.

TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada's transportation system even safer.

Risk of collisions on runways will remain on the TSB Watchlist until

• new technological defences are installed at Canada's major airports to reduce serious runway incursions; and
• the overall number of runway incursions is reduced.

Risk of collisions on runways is a 2016 Watchlist issue.

At airports, aircraft and vehicles have to move between ramps, taxiways, and runways. Sometimes aircraft or vehicles mistakenly occupy an active takeoff or landing area, creating conflicts between aircraft, or between aircraft and vehicles. These conflicts are known as runway incursions. Given the millions of takeoffs and landings each year,^{Footnote 40} incursions are rare, but their consequences can be catastrophic.

Runway incursions have been on the TSB's Watchlist since 2010, and the TSB considers that the risk is still too high. Of particular concern in Canada is the number of serious runway incursions^{Footnote 41} — incursions in which a collision was narrowly avoided or there was a significant potential for collision.

From 2011 to 2015, there were 2041^{Footnote 42} runway incursions at Canadian airports; 27 of them were serious (Table 1).

Table 1. Runway incursions in Canada
Source: NAV CANADA

Year	Total runway incursions	Serious runway incursions
2011	386	10
2012	355	3
2013	422	5
2014	462	3
2015	416	6

Several recent TSB investigations have found a risk of collisions on runways,^{Footnote 43} and the Board remains concerned that serious runway incursions will continue to occur until better defences are put in place.

The United States is testing automated systems that do not require controller or pilot input to maintain runway safety. However, a recent rise in the number of the most serious incursions at U.S. airports has prompted the National Transportation Safety Board (NTSB) to launch a special investigation^{Footnote 44} to identify some of the deeper causes and effects.

Industry and the regulator are taking helpful steps to share data and other information to improve local airport procedures, but few technological defences to alert flight crews and vehicle operators of runway conflicts have been considered or implemented in Canada. More leadership is required from Transport Canada, NAV CANADA, airport authorities, and industry to ensure they are making full use of technologies to maintain runway safety.

The runway incursion occurred during the hours of darkness with a visibility of 15 statute miles. The Air Canada (ACA) 726 flight crew, and the ground and airport controllers, were certified and qualified in accordance with existing regulations. This analysis will focus on the formation of the flight crew's mental model, and how the expectations of both flight crew members, combined with ambiguous phraseology employed by the ground controller, likely contributed to the flight crew's misunderstanding of the taxi instructions.

When the ACA726 flight crew contacted the ground controller, they had already completed their pre-departure preparations, including the pre-takeoff checks, as they anticipated arriving at the departure runway quickly. They confirmed with each other that everything was ready for departure before requesting taxi instructions from the ground controller, and expected to receive an authorization to take off shortly after they had started to taxi to the runway.

The crew's expectation that they would quickly receive an authorization to take off was reinforced when the ground controller asked them whether they were "ready to go."

After confirming that the ACA726 flight crew were ready to go, the ground controller replied with further instructions that they "go to the right side and eighteen thirty-five." The flight crew interpreted this instruction as an authorization to go to the right runway (i.e., Runway 24R) and taxied to position on the runway in preparation for takeoff. This interpretation was consistent with their expectation of what would happen next according to their mental model of the situation.

Although there were available cues that could have alerted the flight crew to the misunderstanding, the cues were either not sufficiently compelling or were considered and explained away. The fact that the perceived instruction to enter the runway would not normally be received from a ground controller was not sufficiently compelling to cause the crew to question their understanding of the situation. Similarly, the aircraft on final approach was perceived by the flight crew to be on approach to the parallel runway.

Although the first officer (FO) read back the instructions, saying "over to the right side, eighteen thirty-five, thanks for the help," the misunderstanding was not detected because the readback consisted of the same plain-language phraseology that had been used by the ground controller.

The plain-language taxi instruction issued by the ground controller was misinterpreted by the flight crew and the flight crew's readback using the same phraseology was ineffective in confirming that the ground controller and the flight crew had a common understanding.

Use of the phrase "holding short" is optional when issuing instructions to taxi to the threshold of a departure runway. In this occurrence, the use of the phrase "contact tower holding short" at the end of the taxi instruction would have communicated to the crew that they were not authorized to enter the runway.

The phrase "holding short" is arguably an unnecessary addition to a taxi instruction, given that flight crews should be aware that they must not taxi over a hold line and enter a runway without either a specific authorization to line up on the runway in preparation for takeoff or an authorization to take off. However, this occurrence demonstrates how errors in communication can happen and why the use of standard phraseology that reinforces the clearance limit has the potential to improve safety. If air traffic controllers are not required to use standard phraseology that reinforces the need to hold short of a departure runway, there is an increased risk of miscommunication leading to runway incursions.

Ground controllers at Toronto/Lester B. Pearson International Airport (CYYZ) use differing phraseology when issuing instructions to taxi into a holding bay. Some controllers use "go to the right" or "go to the left," others use "stay to the right" or "stay to the left," while still others use "stay west" or "stay east." If plain-language phraseology used by air traffic controllers is not explicit, there is a risk of miscommunication between air traffic control and flight crews.

The airport controller observed ACA726 approaching the hold line on the advanced surface movement guidance and control system (A-SMGCS) display. However, from the south tower controller work position, the airport controller never saw the aircraft taxiing. The airport controller expected that ACA726 would stop at the hold line, since an authorization to line up on the runway or to take off had not been issued. Due to a misinterpretation of the taxi instruction, ACA726 taxied across the hold line and onto Runway 24R without an authorization from the airport controller to line up on the runway or take off.

While planning to release ACA726, the airport controller's attention was directed away from ACA726, toward ACA1259 on the final approach to Runway 24R. The airport controller wanted to ensure that ACA726 could be taxied to position on the runway in preparation for takeoff in between ACA1259 and a second arriving aircraft, both of which were on final approach to land on Runway 24R. Given that the airport controller's attention was directed toward the arriving aircraft, the controller did not detect ACA726 crossing the hold line and taxiing onto the runway.

The airport ground-lighting stop bar in the holding bay leading to Runway 24R and the stop bar overrun monitoring function of the runway incursion monitoring and conflict alert system (RIMCAS) were available; however, their use was not required given the level of visibility. Given the obscured view from the tower of the Runway 24R threshold, use of the stop bar and the RIMCAS stop bar overrun monitoring function could have been informative. When ACA726 crossed the hold line, the airport controller would have been notified 17 seconds before the RIMCAS stage 2 aural alarm sounded in the tower that a runway incursion had occurred, which would have provided additional time to issue alternate instructions to the flight crews. If airport lighting system stop bars are not illuminated at a hold line across a taxiway or in a holding bay leading to a departure runway and the RIMCAS stop bar overrun monitoring function is not used, there is an increased risk that an airport controller will not be alerted to an unauthorized movement of an aircraft or vehicle across a hold line.

The RIMCAS runway incursion monitoring function was configured to monitor the approach area of Runway 24R, ahead of an aircraft on final approach and landing, and to provide a stage 1 visual alert on the tower A-SMGCS display in the event of a conflict 30 seconds ahead of the landing aircraft. Under these conditions, a conflict is defined as another aircraft or vehicle crossing the runway edge. When the stage 1 visual alert displayed on the tower A-SMGCS display, ACA1259 was within the 30-second parameter; therefore, the alert was displayed immediately when ACA726 crossed the edge of the runway. However, if an air traffic controller's attention is directed elsewhere and is not on the A‑SMGCS display when the visual alert is displayed, the alert may go undetected. When the RIMCAS stage 1 visual alert appeared on the tower A-SMGCS display, the airport controller's attention was directed toward the aircraft on final approach, resulting in the stage 1 alert being undetected on the A-SMGCS display.

The RIMCAS stage 2 aural alarm, warning the air traffic controller that a critical situation may occur, was configured to provide a RIMCAS stage 2 aural alarm 20 seconds ahead of the landing aircraft. The RIMCAS stage 2 alarm sounded in the tower at the same time that the ACA1259 flight crew reported to the airport controller that there was an aircraft on the runway and that ACA1259 was overshooting the runway. The RIMCAS stage 2 aural alarm did not provide a timely warning to the airport controller to provide alternate instructions to the flight crews.

In the days leading up to the occurrence, the FO experienced mild acute sleep disruption due to the early morning shifts requiring progressively earlier start times. The early start times also resulted in truncated nighttime sleep periods, which meant that the FO was building a chronic sleep debt caused by reduced sleep over the 6 work days preceding the occurrence day. Therefore, it is likely that the FO was fatigued at the time of the occurrence. However, it is unlikely that fatigue contributed to the runway incursion, as both flight crew developed a common understanding of the ground controller's instructions as an authorization to taxi onto the active runway.

In this occurrence, the FO had been awake for approximately 15 hours at the time of the occurrence, and for over 16 hours at the end of the duty day, which lasted 9 hours and 26 minutes. Although it is unlikely that fatigue played a role in this occurrence, it does highlight a risk to aviation safety. According to the Canadian Aviation Regulations restriction that a flight crew member's duty day shall not exceed 14 consecutive hours, the FO could have legally continued working until having been awake for over 20 hours, and according to the Air Canada Flight Operations Manual, for over 23 hours if the duty day were extended due to unforeseen circumstances.

Fatigue management is a shared responsibility, and commuting pilots have a responsibility to arrive at their work location to begin their duty day rested. However, when a company requires a commuting pilot to take a last-minute flight to report for unscheduled work, the commuting time is not included in the pilot's duty day. If required commuting flights are not included as part of the pilot's duty day, there is an increased risk of pilots operating while fatigued due to prolonged periods of wakefulness.

Findings as to causes and contributing factors

1. The plain-language taxi instruction issued by the ground controller was misinterpreted by the flight crew, and the flight crew's readback using the same phraseology was ineffective in confirming that the ground controller and the flight crew had a common understanding.
2. Due to a misinterpretation of the taxi instruction, ACA726 taxied across the hold line and onto Runway 24R without an authorization from the airport controller to line up on the runway or take off.
3. Given that the airport controller's attention was directed toward the arriving aircraft, the controller did not detect ACA726 crossing the hold line and taxiing onto the runway.
4. When the runway incursion monitoring and conflict alert system (RIMCAS) stage 1 visual alert displayed on the tower advanced surface movement guidance and control system (A-SMGCS) display, the airport controller's attention was directed toward the aircraft on final approach, resulting in the stage 1 alert being undetected on the A-SMGCS display.
5. Five seconds later, the RIMCAS stage 2 alarm sounded in the tower at the same time that the ACA1259 flight crew reported to the airport controller that there was an aircraft on the runway and that they were overshooting the runway. The RIMCAS stage 2 aural alarm did not provide a timely warning to the airport controller to provide alternate instructions to the flight crews.

Findings as to risk

1. If air traffic controllers are not required to use standard phraseology that reinforces the need to hold short of a departure runway, there is an increased risk of miscommunication leading to runway incursions.
2. If plain-language phraseology used by air traffic controllers is not explicit, there is a risk of miscommunication between air traffic control and flight crews.
3. If airport lighting system stop bars are not illuminated at a hold line across a taxiway or in a holding bay leading to a departure runway and the RIMCAS stop bar overrun monitoring function is not used, there is an increased risk that an airport controller will not be alerted to an unauthorized movement of an aircraft or vehicle across a hold line.
4. If required commuting flights are not included as part of the pilot's duty day, there is an increased risk of pilots operating while fatigued due to prolonged periods of wakefulness.

Safety action taken

NAV CANADA

NAV CANADA has been working to improve the configuration of the runway incursion monitoring and alert system (RIMCAS) at Toronto/Lester B. Pearson International Airport (CYYZ).

A site review was performed to assess reported problems, identify potential issues and provide mitigations where possible. The main focus of the activity was to optimize the RIMCAS arrival and runway crossing areas, 2 areas identified as concerns by the Transportation Safety Board (TSB).

The following changes were made to the CYYZ Indra advanced surface movement guidance and control system (A-SMGCS) by NAV CANADA to optimize the RIMCAS arrival and runway crossing areas:

• The crossing areas on taxiways were optimized to provide an adequate RIMCAS warning for runway and taxiway crossing areas, and to minimize the number of nuisance alerts. Two new runway crossing areas and 2 new taxiway crossing areas were also created.
• The RIMCAS arrival areas were adjusted to include the holding bay (next to the touchdown end and not the far end of the runway) up to approximately 40 feet from the hold line. This adjustment will increase the RIMCAS warning time to the air traffic controller when a departing aircraft enters the area without authorization, as in the occurrence between Air Canada flight 726 and flight 1259. The far end of the arrival area was also extended to include the complete runway surface.
• The RIMCAS was adjusted to provide a 1-second update of approach targets out to 1 nautical mile from the runway thresholds, and the RIMCAS departure area parameters were also adjusted to include the whole runway surface.

Air Canada

Air Canada Flight Operations convened a working group in the spring of 2016 to review this and other incursion incidents in order to identify any common causal factors and to develop recommendations to prevent future incursions. One of the recommendations from the working group is to strengthen Flight Operations' policy with regard to the acceptance of clearances deemed "critically important" per section 7.1.16 of the Flight Operations Manual (FOM). Specifically, crews would be required to reconcile, using standard phraseology, any critically important clearance issued using non-standard phraseology, whether the crew believes they fully understand the instruction or not. Section 7.1.16 of the FOM will be adjusted to reflect this new policy.

This report concludes the Transportation Safety Board's investigation into this occurrence. The Board authorized the release of this report on 29 March 2017. It was officially released on 24 May 2017.

Appendix A – Toronto/Lester B. Pearson International Airport taxi chart