Aviation Investigation Report A17C0132

On 02 November 2017, a Perimeter Aviation LP Fairchild SA227-AC Metro III (serial number AC-756B, registration C-FLRY) was operating as flight 959 (PAG959) from Gods River Airport, Manitoba, to Thompson Airport, Manitoba, with 2 flight crew members on board. When the aircraft was approximately 40 nautical miles southeast of Thompson Airport, the crew informed air traffic control that they had received a low oil pressure indication on the left engine that might require the engine to be shut down. The crew did not declare an emergency, but aircraft rescue and firefighting services were put on standby. After touchdown on Runway 24 with both engines operating, the aircraft suddenly veered to the right and exited the runway. The aircraft came to rest in snow north of the runway. The captain and first officer exited the aircraft through the left side over-wing emergency exit and were taken to hospital with minor injuries. The aircraft was substantially damaged. The 406-MHz emergency locator transmitter did not activate. The occurrence took place during the hours of darkness, at 1920 Central Daylight Time.

History of the flight

On 31 October 2017, a Perimeter Aviation LP (Perimeter Aviation) Fairchild SA227-AC Metro III (serial number AC-756B, registration C-FLRY) was operating as flight 959 (PAG959) from Winnipeg/James Armstrong Richardson International Airport (CYWG), Manitoba, to Gods River Airport (CZGI), Manitoba. After landing at CZGI and selecting the speed levers low for taxi, the crew received a crew alerting system warning for the left engine oil pressure. The aircraft was then taxied to the ramp and a normal engine shutdown was performed.

The pilot checked the oil level in the left engine and discovered it to be low. The engines were then started to move the aircraft to the fuel pad for refuelling. During start-up of the left engine, the oil pressure only reached 35 psi and, as a result, the pilot decided to shut down the engine and use only the right engine to move the aircraft to the fuel pad.

After shutting down the aircraft on the fuel pad, the pilot contacted the company's maintenance operations control (MOC) to inform them of the oil pressure issue. After speaking with the MOC, a maintenance crew was dispatched to CZGI to inspect and repair the oil pressure issue. After arriving, the maintenance crew added 3 quarts of oil and an inspection of the left engine revealed oil leaking from the engine oil pressure snubber.^{Footnote 1} The aircraft was then parked overnight and arrangements were made to get the parts needed for the repair.

The next day, on 01 November 2017, a new maintenance crew arrived at CZGI with the required parts and replaced the left engine oil pressure snubber. Following a test run of the left engine, there was no evidence of an oil leak and maintenance released the aircraft back to service. During a pre-flight inspection, the aircraft maintenance engineer (AME) noticed a hydraulic fluid leak. The AME checked the hydraulic reservoir and found it to be low. An inspection of the hydraulic system did not reveal the source of the leak and the aircraft was once again parked overnight.

On 02 November 2017, another maintenance and flight crew were sent to CZGI to address the hydraulic leak and fly the aircraft back to base. After a lengthy inspection and engine run, the maintenance crew could not identify the source of the hydraulic leak. It was determined that a ferry flight permit^{Footnote 2} would be required to fly the aircraft to a company base at Thompson Airport (CYTH), Manitoba, for further inspection and repair. The aircraft was then inspected and serviced to the degree necessary for the 50-minute flight. Hydraulic fluid was added to the reservoir, and 1 quart of oil was added to the left engine.^{Footnote 3} The left engine and engine compartment were dry and did not show any signs of an oil leak. A ferry flight permit was then issued that stated the aircraft was to be flown with essential crew only and with the landing gear extended. The flight crew then contacted the assistant chief pilot for a pre-flight briefing that included the risk factors associated with the ferry flight and a discussion about potential emergencies and contingencies, including retracting the landing gear for emergency situations only.

At approximately 1830^{Footnote 4} on 02 November 2017, the aircraft, operating as Perimeter flight 959 (PAG959), departed CZGI on the ferry flight to CYTH with only the 2 flight crew members on board. Approximately 15 minutes after departure, the crew noticed the left engine oil pressure drop into the yellow band range. The crew then consulted with the MOC in flight and it was decided that if the oil pressure dropped below the yellow band^{Footnote 5} and the oil temperature increased beyond the green band,^{Footnote 6} then the engine was to be shut down.

The crew began executing the Preplanned Engine Shutdown checklist in the quick reference handbook (QRH) so that they would be prepared if the left engine indications changed. The crew retracted the landing gear to reduce drag and received a gear up-and-locked indication. Because the oil temperature remained in the green band, the crew paused the checklist at the point where the generators are to be turned off, and continued flying the aircraft to CYTH with the left engine running. When the aircraft was approximately 40 nautical miles southeast of CYTH, the flight crew told air traffic control (ATC) that they had received a low oil pressure indication on the left engine and that the engine might need to be shut down. No emergency was declared, but aircraft rescue and firefighting services were put on standby.

During the final approach to Runway 24 at CYTH, the crew extended the landing gear. As the aircraft approached the runway threshold, the left engine rpm dropped to 96%. The pilot then adjusted the right engine rpm to counter the differential rpm. Although the left engine oil pressure dropped below the yellow band, the oil temperature indication did not rise and the crew elected to keep the engine running. It was reported that the left engine oil pressure dropped to 16 psi and the engine oil temperature indication never exceeded 88 °C.

The aircraft's initial landing touchdown on Runway 24 was on the right main gear, with both engines operating, approximately 1200 feet past the runway threshold. The captain pulled the power levers over the flight idle gate.^{Footnote 7} An engine power surge was heard, and the aircraft began to pitch up and roll to the right. As the upset progressed, the right wing made contact with the runway and the aircraft pivoted around the right wingtip. The nose section then suddenly dropped to the ground and the aircraft came to rest off the runway, approximately 1800 feet past the runway threshold, in an upright position, facing the opposite direction with the engines still running. The engines were shut down using the engine stop and feather control, and the crew exited the aircraft via the left overwing emergency exit. There was no post-impact fire. The occurrence took place at 1920, during the hours of darkness.

Injuries to persons

Wreckage and impact information

The left main landing gear and the nose landing gear were torn out and the nose section of the aircraft was severely distorted (Figure 1). The right wing-tip was bent upward and the left wing exhibited damage to the leading edge, wing-tip and flap. Both sets of propeller blades were shattered down to the blade roots. The left propeller blades were found in the feathered position and the right propeller blades were found at a low angle, or start lock, position.

Image

The main cabin door, located on the left side of the aircraft, was pierced by a piece of propeller blade from the left propeller and, as a result, the door could not be opened. The emergency exit over the left wing was found open.

The wreckage was removed using a flatbed trailer and moved to a nearby hangar for further inspection. The cockpit voice recorder (CVR) was secured and sent to the TSB Engineering Laboratory in Ottawa, Ontario, for analysis.

An inspection of both engines revealed continuity from the propeller hub to the third stage power turbine. The oil tank sight gauge on the left engine did not show an oil level, and a look inside the oil tank revealed that it was empty. Further inspection of the left engine revealed a pool of oil in the exhaust duct area and no evidence of any oil leak in the engine compartment area. Draining the engine oil system produced 0.75 L of oil and an inspection of the magnetic chip detector revealed no contamination.

The left engine was subsequently removed and shipped to the Honeywell International Inc. facility in Phoenix, Arizona, United States, for teardown.

The 406-MHz emergency locator transmitter did not activate and no damage to the unit's components were observed. Impact dynamics were not conducive to setting off the g switch in the unit.

Personnel information

General

Records indicate that the flight crew was certified and qualified for the flight in accordance with existing regulations. Based on a review of the flight crew's work and rest schedules, fatigue was not considered to be a factor in the occurrence.

Captain

The captain was the pilot flying and was seated in the left seat. She held a commercial pilot licence, which was endorsed for the Swearingen SW3 and SW4 aircraft types. The captain had been employed by the company since November 2013. For the first 2 years and 2 months of her employment, she worked as an aircraft groomer and stores clerk. In January 2016, she completed first officer training followed by line indoctrination until 07 February 2016. In June 2017, the captain started captain upgrade training, with a pilot proficiency check on 14 July 2017. She successfully completed 82 hours of captain line indoctrination training, with a company line check on 25 October 2017.

First officer

The first officer was the pilot monitoring and was seated in the right seat. He held a commercial pilot licence, which was endorsed for the Swearingen SW3 and SW4 aircraft types. The first officer had been employed by the company since August 2014. For the first 2 years of his employment, he worked as a ramp attendant. The first officer's initial training was completed with a company line check on 17 August 2016. His most recent pilot proficiency check was successfully completed on 08 August 2017.

Aircraft information

General

The Fairchild SA227-AC Metro III is a pressurized twin turboprop aircraft configured to carry up to 19 passengers and has a retractable landing gear. The aircraft is approved for day and night visual flight rules (VFR) and instrument flight rules (IFR) operations and is certified for flight into known icing conditions. This aircraft type was first manufactured by Swearingen Aircraft and later by Fairchild. M7 Aerospace currently holds the type certificate for the aircraft.

Weight and balance

The aircraft had an empty weight of 8902 pounds and a maximum take-off weight of 16 000 pounds. The aircraft had approximately 1500 pounds of fuel on board and a gross weight of approximately 11 500 pounds at the time of the occurrence. It was determined that the aircraft was operated within its load and centre-of-gravity limits.

Engines

The aircraft is powered by 2 Honeywell TPE331-11U-612G turboprop engines. Each engine comprises a single spool with a 2-stage centrifugal compressor driven by a 3-stage axial-flow turbine, a single reverse-flow annular combustor, and an integral reduction gearbox that drives the aircraft propeller. The engine has a maximum continuous rating of 1000 shaft horsepower.

The engine oil lubrication system consists of a dry sump design with an externally mounted oil tank. Oil is required to lubricate and cool rotating components and to carry contaminants to the oil filter where the impurities are removed before the oil is further circulated. Engine oil is also required to operate the propeller-control system.

Normal oil pressure limitations for engine operation in flight are between 70 and 120 psi. The minimum oil pressure limitation for engine operation in flight is 50 psi.^{Footnote 8} The oil pressure gauge has a red limit indication, and the crew alerting system triggers an advisory at 40 psi. Allowable oil temperature limitations for engine operation are between 55 °C and 110 °C.

The left engine (serial number P-44670) had accumulated a total of 16 890 hours time since new and a total of 1900 hours time since overhaul.

An inspection of the right engine (serial number 44180) did not reveal any pre-impact anomalies.

The left engine rear scavenge pump and sump assembly were sent to the TSB Engineering Laboratory for further analysis. Inspection of the unit did not reveal any anomalies. Inspection of the quill drive shaft, oil tube and turbine shaft galleries did not reveal any obstructions.

Air-oil seal assembly

Engine oil seals are used to prevent oil from leaking around rotating shafts and out of the engine. The rear turbine air-oil seal assembly consists of 2 parts: a stationary seal (part number 896494-3) (Figure 2) and a rotor seal (part number 896549-2) (Figure 3). The stationary seal consists of a carbon seal, which is attached to a bellows and is mounted to the rear turbine bearing support assembly. The rotor seal is made of steel and has a machined flat surface that rotates along with the turbine shaft. Both are located in the rear oil scavenge housing. In operation, the bellows' spring action, combined with a negative pressure inside the scavenge housing, forces the carbon seal against the rotor seal, providing an oil seal.

The seal assembly of the left engine was installed new at the last engine overhaul, and had a total of 1900 hours in service. Teardown of the engine revealed that the turbine air-oil seal assembly exhibited excessive soot and carbon coking^{Footnote 9} (Figure 2 and Figure 3) around the carbon seal and inside diameter of the bellows convolutions. The seal retainer and bellows also exhibited discoloration (Figure 2).

Image

Image

The rear turbine air-oil seal assembly was removed and sent to the TSB Engineering Laboratory for further analysis. Other than the presence of coking, no abnormalities with the seal were noted.

Engine cool down

The Honeywell TPE331-11U-612G turboprop engine must be cooled down by running the engine at reduced power for a specified period prior to shutdown. If the engine is not allowed to cool down sufficiently, oil that remains trapped within hot locations of the engine will heat up to a point where the oil decomposes into a carbon deposit.

The limitations section of the aircraft flight manual (AFM) for the occurrence aircraft specifies that an engine cooldown period of 3 minutes is required with the engine operating below 20% torque prior to shutdown. ^{Footnote 10}

The investigation was unable to determine the length of previous cooldown periods for the occurrence aircraft.

Following the occurrence, a random sampling of engine shutdowns was gathered using flight data monitoring information downloaded from a similar aircraft operated by Perimeter Aviation. Of 20 samples taken, 50% of engine shutdowns occurred before the full 3-minute cooldown period had elapsed.

Propellers

In August 2016, the aircraft had been modified with 2 MT-Propeller Entwicklung GmbH, MTV‑27-1-E-C-F-R (G) 5‑bladed (composite), full feathering, hydraulically actuated, constant-speed, counter-weighted, reversing propellers.

During propeller operation, springs and counterweights are always forcing the propeller blades toward a high angle, or feathered, position, while high engine oil pressure opposes this force to move the propeller blades toward a low-angle, or flight idle, position (Figure 4)

Image

As the propeller blade angles increase, the blades take a larger bite of air, resulting in a decrease in rpm until they reach a feathered position. In a feathered position, the blades are directly in line with the air stream and produce very little dynamic force. Conversely, as propeller blade angles decrease, the blades take a smaller bite of air, resulting in an increase in rpm.

An inspection of both propellers did not reveal any pre-impact anomalies.

Propeller-control system

Propulsion of the aircraft is controlled by the pilot using the power levers and speed levers that are mounted in the centre console in the cockpit. The engine power lever connects to the propeller pitch control and the manual fuel valve. The engine speed lever connects to the propeller governor and to the underspeed fuel governor (USFG).

The propeller-control system is designed to operate in either propeller-governing range or beta range. Propeller-governing range is used for flight operations, while beta range is used for ground manoeuvring operations. When the engine-power lever is forward of the flight-idle gate, the engine is in the propeller-governing range and when the engine-power lever is brought aft of the flight-idle gate, the engine is in beta range.

In the propeller-governing range, the power lever controls the engine power by adjusting the fuel flow from the manual fuel valve. Engine rpm is selected using the speed lever, which varies the propeller blade angle using the propeller governor. The propeller governor boosts engine oil pressure and meters oil to the propeller hub through the propeller pitch control and beta tube, to vary the propeller blade angles.

In the beta range, the power lever varies the propeller blade angle using the propeller pitch control. To maintain the speed lever and engine rpm settings, the USFG varies the engine power by scheduling the fuel flow. The USFG controls the engine rpm settings between 65% and 97%. The propeller pitch control in the beta range meters oil to the propeller hub to vary propeller blade angles.

The propeller governor and the propeller pitch control unit were sent to the TSB Engineering Laboratory for further analysis. No anomalies were found.

Hydraulic system

The aircraft hydraulic system consists a 2.5 U.S. gallon reservoir, and 2 engine-driven hydraulic pumps that pressurize a common manifold. The common manifold supplies hydraulic pressure to the wing flaps, landing gear and nose wheel steering systems. The aircraft instrument panel is equipped with a hydraulic pressure gauge (used to monitor hydraulic system pressure) and low pressure crew alert indications for the left and right hydraulic pumps. One engine-driven pump operating will provide the hydraulic pressure required for the systems to operate normally in single-engine operations, provided that adequate hydraulic fluid remains in the system. The aircraft is also equipped with a hand pump that provides hydraulic pressure for emergency landing gear extension only. Without hydraulic pressure or fluid, hydraulic nose wheel steering and flaps are unavailable.

Maintenance

General

The aircraft was maintained in accordance with Appendix D of the Canadian Aviation Regulations (CARs) Standard 625. Records indicate that the occurrence aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures.

Low oil pressure indication on 31 October

The left engine was inspected following the low oil pressure indications during the flight into CZGI on 31 October. The inspection revealed a low engine oil level and oil leaking from the oil snubber. The oil snubber and seal were replaced and the oil was replenished. The engine bay area was then cleaned and a run-up was completed. An inspection of the engine following the run-up revealed that the engine bay area was dry of any oil and the oil leak had stopped. Maintenance concluded that the low oil pressure indication was repaired and the aircraft was then returned to service.

Hydraulic leak on 01 November

Prior to the occurrence flight, a hydraulic leak was discovered with the aircraft and a ferry flight permit was issued to fly the aircraft back to base at CYTH. The hydraulic fluid reservoir was topped up before the occurrence flight. During the occurrence flight there were no indications of any issues with the hydraulic system. Due to the substantial damage sustained by the aircraft as a result of the accident, further inspection and repair of the hydraulic leak were not carried out.

Aircraft operation

Aircraft flight phases

Cruise

In cruise, engine rpm may be reduced as a noise reduction measure and for fuel efficiency. Engine rpm is normally reduced to 97% in cruise. Engine cruise is accomplished by slightly pulling back on the power levers and then moving the speed levers from the take-off position to the desired engine rpm setting.

Approach

During the approach, the speed levers are moved to the take-off position (100% rpm) and the power levers are then pulled back towards the flight idle position and adjusted to maintain the desired approach airspeed.

Landing flare

As the aircraft approaches the runway threshold, the power levers are pulled to the flight idle position. After touchdown and during the rollout, the power levers are pulled over the flight idle gate towards ground idle and into reverse, decreasing propeller angles to a finer or reverse position. As the propeller blade angles decrease, increasing air resistance due to the relative wind and drag increases the propeller loading. The engine rpm then falls below the propeller governor setting creating a low demand for fuel. At 97%, the USFG takes control of the fuel demand and maintains engine rpm.

Aircraft flight manual

The airworthiness standards listed in the CARs require that an AFM be carried on board during flight operations.^{Footnote 11} The AFM contains information that applies to that specific aircraft, including limitations, emergency procedures, abnormal procedures, normal procedures, performance data, and weight and balance.

The emergency procedures specified in the Metro III AFM states the following:

In addition, the abnormal procedures contained in the AFM state the following:

The investigation determined that the crew did not refer to the AFM during the occurrence.

Quick reference handbook

The QRH contains procedures that may need to be referred to quickly or frequently during aircraft operation, including emergency and abnormal procedures. The procedures may be abbreviated for ease of reference (although they must reflect the procedures contained in the AFM). The term “QRH” is often used as an alternative name for the Emergency and Abnormal Checklist.

The QRH can be developed by either the aircraft manufacturer or the air operator and is not a Transport Canada (TC) approved document. However, TC may assess the QRH during an operational evaluation^{Footnote 14} of the company.

Perimeter Aviation had published its own QRH for the occurrence aircraft type in which the following references are made regarding low oil pressure and high oil temperature indications:

• In the event of a low oil pressure light illuminating, check the corresponding oil pressure gauge. If oil pressure indication is below 40 psi or abnormal, the engine is to be shut down.^{Footnote 15}
• In the event of high oil temperature indication, if engine performance is deteriorating, the engine is to be shut down.^{Footnote 16}

The investigation determined that the crew referred to the QRH during the occurrence flight as per company procedures. However, after consulting with the MOC and because the engine oil temperature did not rise, the crew decided to keep the engine running.

Meteorological information

The CYTH hourly meteorological observation for 1900, 20 minutes before the occurrence, was as follows:

• wind 320° true (T) at 5 knots;
• visibility 15 statute miles in light snow;
• a broken layer of cloud at 3700 feet above ground level;
• temperature −18 °C, dew point −21 °C; and
• altimeter 30.40 inches of mercury.

Weather was not considered a factor in this occurrence.

Aerodrome information

CYTH has 2 runways: Runway 06/24, which is asphalt and 5800 feet long by 150 feet wide, and Runway 15/33, which is gravel and 5079 feet long by 100 feet wide.

For night operations, Runway 06/24 is equipped with the following lighting:

• high intensity runway edge lighting,
• threshold and runway end lighting,
• precision approach path indicator lights, and
• an omnidirectional approach lighting system.

There were no reported abnormalities with the aerodrome systems.

Flight recorders

Cockpit voice recorder

The aircraft was equipped with a CVR that was located on the equipment rack behind the aft cargo compartment bulkhead. The unit was capable of storing the last 30 minutes of cockpit area sounds, pilots' boom microphones, and radio audio. The CVR was not damaged in the accident and was sent to the TSB Engineering Laboratory for downloading.

Flight data recorder

The aircraft was not equipped with a flight data recorder (FDR), nor was there a regulatory requirement for one.

Garmin 950 glass flight deck

The aircraft was modified with a Garmin 950 integrated flight instrument system that replaces the conventional flight and engine instruments. The system is capable of recording and storing navigational and flight data, such as flight and engine parameters, on secure digital (SD) memory cards. The unit was equipped with 2 SD memory card slots: 1 for navigational data and 1 for flight data recordings. The unit did have an SD memory card for navigational data information, but it was not equipped with an SD memory card that stored any flight data information.

TSB recommendations regarding on-board recorders

Numerous TSB aviation investigation reports have referred to investigators being unable to determine the reasons for an accident because of the lack of on-board recording devices. The benefits of recorded flight data in aircraft accident investigations are well known and documented.^{Footnote 17}

For several decades now, FDRs and CVRs have been conceived, designed, and installed in order to record flight and cockpit data for accident investigation purposes. FDRs record numerous aircraft parameters—such as altitude, airspeed, flight control input, and engine settings — many times per second. CVRs record radio transmissions and ambient cockpit sounds, including pilot voices, alarms, and engine noises. Image/video recorders provide video of the crew immediately before, during, and after an event.

Currently, FDRs and CVRs are considered the most comprehensive tools of capturing large amounts of flight data to aid in accident investigations and to significantly help enhance aviation safety.

Recommendation A13-01

In 2013, following its investigation into a fatal in-flight breakup occurrence in March 2011 northeast of Mayo, Yukon,^{Footnote 18} the TSB concluded there was a compelling case for implementing lightweight FDR systems for all commercial operators, and recommended that

In February 2018, TC conducted a focus group with industry stakeholders to evaluate the challenges and benefits of installing lightweight flight recording systems on aircraft that are not currently required to carry these systems.

In its reassessment of TC's response, the Board noted that, until the focus group reaches conclusions concerning these challenges and benefits in aircraft not currently required to carry them, and TC provides the TSB with its plan of action following those conclusions, it is unclear when or how the safety deficiency identified in Recommendation A13-01 will be addressed. The TSB is concerned that few concrete actions have been taken to address Recommendation A13-01 and that this will result in protracted delays, as observed on numerous other recommendations.

Therefore, the Board was unable to assess the response to the recommendation. In April 2018, this recommendation was closed and superseded by Recommendation A18-01.

Recommendation A18-01

The TSB conducted an investigation^{Footnote 19} into a 2016 occurrence involving a Mitsubishi MU-2B-60 that struck terrain on final approach to Îles-de-la-Madeleine Airport (Quebec). All 7 occupants were fatally injured. Although regulations did not require it, the aircraft had a lightweight flight data recorder on board. Investigators recovered the recorder and extracted its data for analysis. This allowed them to better understand the sequence of events leading to the aircraft's loss of control. With no on-board recording system, investigators would not have obtained this information, which was vital to the understanding of the circumstances and facts that led to the occurrence.

In another 2016 occurrence^{Footnote 20} investigated by the TSB, investigators did not have any of the information normally contained in lightweight flight data recorders. As a result, it was not possible to determine the reasons for the aircraft's loss of control that led to the collision with the ground that killed all 4 occupants.

Although Recommendation A13-01 targeted commercial operators, these 2 more recent occurrences highlight the value of an on-board lightweight flight data recording system by demonstrating the importance of the availability of these data. It is also important to note that these systems allow regular surveillance of normal flight activities, which helps operators improve operational efficiency and detect safety issues before they cause an accident.

On 26 April 2018, the Board issued Recommendation A18-01, calling for TC to require the mandatory installation of lightweight flight recording systems by commercial operators and private operators not currently required to carry these systems. This new recommendation replaces Recommendation A13-01, which has been closed. The Board is calling for TC to use the work done for Recommendation A13-01 to accelerate the adoption of safety measures in response to Recommendation A18-01.

As a follow-up to its focus group held with industry in February 2018, in support of Recommendation A13-01, TC is undertaking a policy analysis of flight data management. Two approaches have been identified:

• The voluntary installation of FDRs and lightweight data recorders (LDRs), as well as the publication of an advisory circular and guidance to operators; and
• The possible introduction of regulations for the installation of FDRs and LDRs into newly manufactured aircraft. TC indicated that the sectors of the Canadian aviation landscape that would be subject to this certification requirement are yet to be determined. TC also indicated that all certification requirements will be, at minimum, fully aligned with ED155, the European Organisation for Civil Aviation Equipment (EUROCAE) Minimum Operational Performance Specification for lightweight flight recording systems, referenced in ICAO Annex 6.

In its September 2018 response to Recommendation A18-01, TC indicated that it agrees in part with Recommendation A18-01, and that it would undertake the following actions:

• TC has indicated that it will re-evaluate these 2 approaches by further assessing the number of operators that have voluntarily adopted flight data monitoring systems. Consideration would be given to other measures, including a regulatory solution, if the results of the voluntary approach prove insufficient.
• TC intends to continue to engage and collaborate with industry to develop recommended practices and determine key obstacles in the adoption and installation of flight data systems.

In addition to TC's response, the TSB received information from the Canadian Business Aviation Association (CBAA) regarding actions taken following the publication of Recommendation A18-01. In its letter, the CBAA informed the TSB that it will continue to promote FDR fitment and analysis of data derived from the FDR through the CBAA Partners-in-Safety Program. Additionally, the CBAA has signed an agreement with a supplier to provide CBAA members with flight data analysis services. Finally, the CBAA informed the TSB that it will support a regulatory approach requiring FDRs on private aircraft, if supported by a cost–benefit analysis. However, it noted that the retro-fit of business aircraft may not always be possible due to cost and technical constraints.

The Board appreciates that TC is committed to working with industry to promote the voluntary installation of FDRs and LDRs for Canadian aircraft that fall outside the scope of the current CARs requirements. However, no specific timeline has been provided for the proposed actions. Although the proposed actions could mitigate the risk once implemented, until TC provides the TSB with a more detailed plan of action for moving forward, it is unclear when or to what extent the safety deficiency identified in Recommendation A18-01 will be addressed.

Therefore, the response to Recommendation A18-01 is assessed to be Satisfactory in Part.

Medical and pathological information

The investigation determined that neither the captain's nor the first officer's performance was degraded by medical or pathological factors.

Survival aspects

Each crew member was wearing a 4-point restraint harness and received minor injuries. The aircraft is equipped with 3 over-wing emergency exits: 2 over the right wing and 1 over the left wing. Efforts to open the main cabin door were unsuccessful, but the crew was able to open the left over-wing emergency exit and exited the aircraft through it.

The crew had previously advised ATC of their situation and, as a result, aircraft rescue and firefighting had been put on standby and responded almost immediately. By the time the crew got out of the aircraft, rescue vehicles were on site and took the crew to the hospital for observation.

The aircraft was equipped with a 406-MHz emergency locator transmitter, which did not activate because the impact dynamics were not conducive to setting off the g-switch in the unit.

Tests and research

TSB laboratory reports

The TSB completed the following laboratory report in support of this investigation:

• LP001/2018 – Rear Rotor Seal Analysis

Organizational and management information

General

Perimeter Aviation is a regional operator providing scheduled, charter, and air ambulance services under CARs subparts 703 (air taxi), 704 (commuter), and 705 (airline) for many remote communities in Manitoba and northwestern Ontario. Perimeter Aviation's headquarters is located in Winnipeg, Manitoba, and the company has several bases located in smaller surrounding communities.

At the time of the occurrence, Perimeter Aviation operated 8 Fairchild SA227 aircraft and 14 Swearingen SA226 aircraft under CARs subparts 703 and 704, and 8 de Havilland DHC-8 aircraft under CARs Subpart 705.

Perimeter Aviation is also a TC-approved maintenance organization, which allows the company to perform in-house maintenance of their aircraft. In addition, the company is an approved engine repair and overhaul facility for the Honeywell TPE331 gas turbine engine.

Pilot training

Perimeter Aviation's Flight Crew Training Manual establishes the training requirements for initial, recurrent and upgrade flight training, as well as numerous other courses required by regulations and by the company. Perimeter Aviation has a dedicated 703/704 training department that provides training to the Fairchild SA227-AC Metro III pilots.

Pilots at Perimeter Aviation are normally initially hired and trained as a first officer. Their training consists of computer-based training, in-classroom courses, flight training and checking, and a minimum of 20 hours of on-the-job training (line indoctrination training).

When the company needs to fill a captain position, it will provide upgrade training to a first officer who has gained enough experience. Upgrade training consists of flight training and checking, and a minimum of an additional 20 hours of line indoctrination training.

Safety management system

TC defines a safety management system (SMS) as “[a] documented process for managing risks that integrates operations and technical systems with the management of financial and human resources to ensure aviation safety or the safety of the public.”^{Footnote 21}

Current regulations require CARs 705 airline operators and maintenance organizations to establish and maintain an SMS. Although there is no regulatory requirement for CARs 703 and 704 operators to establish an SMS, Perimeter Aviation does have a TC-approved SMS that encompasses all 3 types of operations.

Crew resource management, pilot decision making, and operational risk management

Crew resource management

The flight deck of a multi-crew aircraft is a dynamic, challenging workplace where flight crews are constantly interacting with the aircraft, the environment, and each other. Crew resource management (CRM) is about making effective use of the resources available—human, hardware, and information—to manage the hazards and challenges that can arise during any flight. According to the International Civil Aviation Organization (ICAO), CRM has as its fundamental purpose “to improve flight safety through the effective use of error management strategies in individual as well as systemic areas of influence”^{Footnote 22} and proposes the integration of threat and error management (TEM) into modern CRM training.

TEM is a conceptual framework regarding aviation operations and human performance, and can be used in different contexts, including flight deck operations and occurrence investigations. Three basic components of TEM are the management of threats, errors, and undesired aircraft states.^{Footnote 23} The premise is that operational hazards are a normal, inherent and predictable aspect of flight operations, creating threats to safety that must be proactively identified and mitigated. If an error occurs, the error is identified and mitigated appropriately and, if an undesired aircraft state develops, then it is identified and mitigated using emergency procedures.

The training curriculum for CARs Subpart 705 pilots at Perimeter Aviation included a formal CRM course.

Perimeter Aviation's initial and recurrent flight training for CARs subparts 703 and 704 pilots included some basic CRM principles, but did not include any TEM concepts. Throughout the occurrence flight the crew performed many CRM skills, including callouts, briefing checklists, calling checklists, challenge and response, problem solving, involving new resources (i.e., consultation with the MOC), monitoring, cross-checking, active handoffs, emergency procedures, and egress procedures.

Perimeter Aviation was not required to provide CRM training to the crew operating the occurrence aircraft and did not offer a stand-alone CRM course to its CARs subparts 703 and 704 pilots at the time of the occurrence.

Beginning 28 July 2017, CARs subpart 702, 703, and 704 operators in Canada had 18 months to implement CRM training. Effective 31 January 2019, all commercial air carriers (i.e., carriers operating under CARs subparts 702, 703, 704, and 705) will be required to have applicable personnel trained in modern CRM.

Pilot decision making and risk management

CRM training also includes more traditional knowledge and skills related to pilot decision making (PDM) and operational risk management. PDM, a critical aspect of flight safety, can be defined as a 4-stage process: gathering information, processing information, making a decision based on the possible options, and acting on that decision. For PDM to succeed, the pilot must continually re-assess conditions and determine whether a plan is still sound or whether a different course of action is required. Accurate and timely interpretation of the information available to a pilot is critical to the success of the process. An important component of PDM is good situational awareness, which requires pilots to align the reality of a situation with their expectations. It involves 3 levels: perception, comprehension, and anticipation.

Operational risk management involves identifying hazards, actively assessing the immediate risk level, and taking appropriate and timely actions to reduce the risk to a level that is as low as reasonably practicable, while continually monitoring for changes in the situation and feedback from the process. Operational risk management occurs during all aspects of a flight, including pre-flight, at altitude, in normal and abnormal situations and in emergencies. Inadequate or ineffective PDM and/or operational risk management can result in operating beyond an aircraft's capability or exceeding a pilot's abilities.

Approximately 60 miles south of CYTH, the engine oil pressure dropped into the yellow band and all other indications were normal. The flight crew began a preplanned shutdown of the left engine, should the oil temperature increase. The flight crew also considered a possible loss of hydraulic pressure, due to the pre-existing leak, which could result in a loss of nose wheel steering authority and decided to keep the left engine running to avoid a loss of directional control on landing, due to adverse yaw in a single-engine situation.

General

The occurrence flight was a ferry flight repositioning the aircraft from Gods River to Thompson, Manitoba, due to an unresolved hydraulic leak that required the aircraft to be flown with the landing gear extended. During the flight there were no indications of any issues with the hydraulic system.

A depletion of oil in the left engine and a subsequent loss of oil pressure resulted in a loss of propeller control on landing and upset of the aircraft. There were no indications that fatigue or other physiological factors contributed to the accident. Both pilots were qualified for the flight and held the appropriate licence.

The analysis will focus on the loss of engine oil pressure, the rear turbine air-oil seal assembly, engine cool down procedures, differences between the aircraft flight manual (AFM) and the quick reference handbook (QRH), pilot decision making (PDM) and operational risk management, and on-board recorders.

Accident sequence

While the aircraft was on final approach, the left engine rpm began to decrease and the torque began to increase. The propeller blade angle began to increase due to insufficient oil pressure to counter the propeller spring pressure and force exerted by the propeller counterweights. The continued depletion of oil and loss of oil pressure further increased the propeller blade angle, resulting in a further decrease in engine rpm and a rise in torque.

The initial touchdown was on the right main landing gear, at which point the power levers were pulled over the flight idle gate and into beta range. As the left engine rpm dropped below 97%, the underspeed fuel governor increased the fuel flow to maintain 97% engine rpm. This increased power while the left propeller blade angle was transitioning to a higher blade angle (larger bite of air) resulted in a sudden burst of thrust. The sudden increase of thrust while the aircraft was settling on the right main landing gear, aggravated by the right wing (retreating wing) and discing right propeller,^{Footnote 24} increased the lift over the left wing. The increased lift caused the aircraft to roll to the right, resulting in the loss of control of the aircraft.

Left engine oil pressure indication

It was determined that the oil leaking from the snubber had a negligible effect on the low oil pressure indications during the previous flight into Gods River Airport (CZGI), Manitoba, and was not contributory to the occurrence. It is likely that the left engine low oil pressure indications during the previous flight and the occurrence flight were likely the result of a steady oil leak past the rear turbine air-oil seal assembly. The depleting oil supply resulted in oil cavitation of the engine driven oil pump and a loss of oil pressure. The loss of engine oil pressure resulted in a loss of propeller control authority on landing and the upset of the aircraft.

Air-oil seal assembly and engine cool down

Coking within the inside diameter of the bellows convolutions had built up over a period of time. Carbon deposits that accumulated within the inside diameter of the bellows convolutions interfered with the bellows' ability to expand and to provide a positive seal against the rotor seal. If the Honeywell TPE-331 engine is not allowed to sufficiently cool down prior to shutdown, oil that remains trapped within hot areas of the engine may heat up to a point where the oil decomposes, creating a carbon deposit.

The investigation was unable to determine the length of cooldown periods for the occurrence aircraft. However, a random sampling of engine shutdowns for similar company aircraft showed that 50% had not completed the full 3-minute cooldown period.

An inadequate seal between the carbon seal and rotor seal and negative pressure within the scavenge pump unit likely drew in hot engine exhaust, resulting in elevated temperatures and discoloration of the rear turbine air-oil seal assembly. Oil within the scavenge pump unit leaked past the rear turbine air-oil seal, resulting in further coking on the carbon seal and oil to leak externally from the engine.

Aircraft flight manual and quick reference handbook

The Perimeter Aviation QRH for the occurrence aircraft type includes an instruction to shut down the engine when the oil pressure is below 40 psi.

Adequate engine oil pressure is necessary for proper operation of the propeller system. Because the AFM does not provide guidance to shut down the engine in low engine oil pressure situations, adherence to the current emergency procedure listed in the AFM may lead to continued operation of the engine with low oil pressure. If engine oil pressure is allowed to decrease to a critically low value, it will result in an adverse propeller response that could lead to a loss of control of the aircraft.

If operators of the SA227-AC Metro III aircraft rely solely on the emergency procedures listed in the AFM, continued engine operation with low oil pressure may result in loss of control of the aircraft.

Crew resource management

The crew had been introduced to some crew resource management (CRM) principles during flight training; however, Perimeter Aviation did not provide formal CRM training to Canadian Aviation Regulations (CARs) subparts 703 and 704 pilots at the time of the occurrence, nor was there a regulatory requirement for this training. Threat error management (TEM), a component of CRM, was not discussed during flight training. Despite having received limited CRM training, the crew demonstrated many skills and a knowledge of CRM principles, such as conducting briefings, using checklists, problem solving, and using available resources including the maintenance operations control (MOC).

While this crew implemented many CRM principles, if CARs subparts 703 and 704 operators do not provide initial or recurrent CRM training to pilots, these pilots may not be prepared to avoid, trap, or mitigate crew errors encountered during flight. Transport Canada has proposed new regulations requiring CARs subpart 703 and 704 operators to provide CRM and PDM training and these regulations will become in effect in January 2019.

Pilot decision making and operational risk management

The crew was assigned to and accepted to fly a ferry flight from CZGI to Thompson Airport (CYTH), Manitoba, with a known hydraulic leak and previous reports of low oil pressure. The only restriction for the flight was to fly with the landing gear down unless there was an emergency. To manage the safety of the flight, the assistant chief pilot briefed the crew and provided sample emergencies and contingencies.

Fifteen minutes into the flight, the crew observed that the left engine oil pressure dropped into the yellow band, but no other abnormal engine operation parameters were observed. The crew did not know that oil was leaking from the left engine and no information was available to the crew to confirm that it was. It was understood by flight operations and maintenance personnel that an oil leak presents on the instrument panel as low oil pressure and rising oil temperature indications. The crew consulted with the MOC in flight and it was decided that if the oil pressure dropped below the yellow band and the oil temperature increased beyond the green band, then the engine was to be shut down.

Since there was a possibility of an engine shutdown, the flight crew retracted the landing gear to minimize drag in the event of a single-engine situation. Additionally, the possible loss of hydraulic pressure, due to the pre-existing leak, would result in a loss of nose wheel steering availability, and the crew decided to keep the left engine running to mitigate the risk of losing directional control on landing due to adverse yaw during a single-engine landing.

After consulting the maintenance operations control, the crew considered the risks associated with landing on a single engine and without hydraulic pressure for the nose-wheel steering, and decided to continue the flight with both engines running, even though this was not consistent with the QRH procedures for low oil pressure indications.

On-board recorders

Although the aircraft was equipped with a cockpit voice recorder, it was not equipped with a flight data recorder to assist investigators with technical information, nor was one required by regulation. If flight data, voice, and video recordings are not available to an investigation, the identification and communication of safety deficiencies to advance transportation safety may be precluded.

Findings as to causes and contributing factors

1. The left engine low oil pressure indications during the previous and the occurrence flights were likely the result of a steady oil leak past the rear turbine air-oil seal assembly.
2. The loss of engine oil pressure resulted in a loss of propeller control authority on landing and the upset of the aircraft.
3. After consultation with maintenance, the crew considered the risks associated with landing single engine and without hydraulic pressure for the nose-wheel steering, and decided to continue the flight with both engines running, even though this was not consistent with the QRH procedures for low oil pressure indications.
4. Carbon deposits that accumulated within the inside diameter of the bellows convolutions interfered with the bellows' ability to expand and to provide a positive seal against the rotor seal.

Findings as to risk

1. If Canadian Aviation Regulations (CARs) subparts 703 and 704 operators do not provide initial or recurrent crew resource management training to pilots, these pilots may not be prepared to avoid, trap, or mitigate crew errors encountered during flight.
2. If operators of the SA227-AC Metro III aircraft rely solely on the emergency procedures listed in the aircraft flight manual, continued engine operation with low oil pressure may result in loss of control of the aircraft.
3. If an engine is not allowed to sufficiently cool down prior to shutdown, oil that remains trapped within hot areas of the engine may heat up to a point where the oil decomposes, creating a carbon deposit.
4. If flight data, voice, and video recordings are not available to an investigation, the identification and communication of safety deficiencies to advance transportation safety may be precluded.

Other findings

1. The investigation was unable to determine the length of cooldown periods for the occurrence aircraft. However, a random sampling of engine shutdowns for similar company aircraft showed that 50% had not completed the full 3-minute cooldown period.
2. Despite having received limited crew resource management (CRM) training, the crew demonstrated many skills and a knowledge of CRM principles.

Safety action taken

Transportation Safety Board of Canada

On 01 June 2018, the TSB issued Aviation Safety Advisory A17C0132-D1-A1, suggesting that Transport Canada (TC) review the Fairchild SA227-AC Metro III AFM's emergency procedures regarding low engine oil pressure indication. At the time of report writing, TC had not responded to this safety advisory.

Perimeter Aviation

Since the occurrence, Perimeter Aviation has implemented the following safety actions:

• Installed SD memory cards that store flight data, such as flight and engine parameters, on all aircraft equipped with the Garmin 950 integrated flight instrument system;
• Implemented crew resource management training for all Canadian Aviation Regulations subparts 703 and 704 flight crews;
• Provided awareness training on the following:
  • the effects of low oil pressure during flight operations;
  • the importance of closer scrutiny and examination of the rear scavenge pump in the engine exhaust duct area; and
  • the importance of a minimum 3-minute cooldown period of the engine prior to engine shutdown.

This report concludes the Transportation Safety Board of Canada's investigation into this occurrence. The Board authorized the release of this report on 17 October 2018. It was officially released on 22 November 2018.