Air transportation safety investigation report A19O0006

On 28 January 2019, the Sky Regional Airlines Embraer ERJ 170-200 SU aircraft (registration C-FEJB, serial number 17000086) was operating as flight SKV7665 on a scheduled flight from Toronto/Lester B. Pearson International Airport, Ontario, to Dallas-Fort Worth International Airport, Texas, United States. At 1348 Eastern Standard Time, the aircraft was departing from Runway 06L during snowy weather conditions.

At the same time, a group of 4 snow removal vehicles was operating north of Runway 06L and proceeding southbound on Taxiway E. The ground controller instructed the vehicles to turn left onto Taxiway C; however, the vehicles turned left on Taxiway C2 toward Runway 06L and 3 of the vehicles continued past the holding position. The ground controller instructed the vehicles to stop, which they did just before the runway surface. The tower controller instructed flight SKV7665 to abort its takeoff; the flight crew rejected the takeoff, and the aircraft came to a stop just before Taxiway C2. There was no damage to the aircraft, nor injury to the occupants.

1.1 History of the occurrence

On 28 January 2019 at approximately 1230,^{Footnote 1} a group of snow removal vehicles, consisting of 3 combination sweeper/snow plow vehicles and 1 snow blower vehicle, had begun clearing snow from the taxiways at Toronto/Lester B. Pearson International Airport (CYYZ).

Forward visibility was reduced due to the snowy conditions, and the snow removal equipment created more blowing snow. As a result, the drivers’ forward visibility was reduced to near zero. In addition, snow had accumulated on the manoeuvring area, obscuring some of the visual cues such as paint markings on the surface of the taxiways, inset taxiway centreline lights, and holding position lights.

Due to the reduced visibility, the ground controller could not see all of the traffic on the airfield from the control tower but, as is common practice, was using the ground radar to identify aircraft and vehicles and to control traffic on the airport’s manoeuvring areas.

The vehicles were operating as a group. The lead plow vehicle’s call sign was PLOW 862, which was used during communication between the lead plow vehicle and the ground controller. However, the radar screen showed the call sign for this vehicle as PLOW 170.

Although all of the vehicles were equipped with very high frequency (VHF) radios capable of communicating with the ground controller, PLOW 862 was performing the radio work, and the ground controller was referring to the group as “PLOW 862 and company.”

The operators of the other vehicles in the convoy were listening to the VHF radio on the ground frequency, and following PLOW 862, which is a common procedure for a group of vehicles operating together at CYYZ.

At 1347:16, PLOW 862 and company were proceeding south on Taxiway E and were instructed to turn left onto Taxiway C (eastbound and parallel to Runway 06L), and to continue snow removal operations. As the vehicles reached the intersection of taxiways E and C, they made a wide left turn to position some of the snow near the south edge of Taxiway C, and inadvertently lined up with the entrance to Taxiway C2.

Next, PLOW 862 inadvertently proceeded onto Taxiway C2 instead of Taxiway C and continued toward Runway 06L, with the other vehicles following (Figure 1). At this point the operator of PLOW 862 believed that they were on Taxiway C.

As the lead plow operator approached and then crossed the Runway 06L holding position, he did not see any of the associated lights or visual cues. In addition, the drivers of the 3 vehicles driving in the group behind the lead plow did not see any of the visual cues. The 2 vehicles behind the lead vehicle also crossed the holding position, and the 3rd stopped behind the vehicle ahead, before the holding position.

At 1347:45, when Sky Regional flight SKV7665 was cleared for takeoff from Runway 06L, the runway visual range was 3000 feet. With visibility reduced to this level, the flight crew could not see Taxiway C2 from their position at the threshold. A few seconds later, the flight crew began their take-off roll.

At 13:48:21 the stop-bar overrun alarm in the control tower activated. The ground controller observed the vehicles crossing the holding position on the ground radar and instructed the lead plow to stop by transmitting the instruction “PLOW 170 hold your position.” The driver of PLOW 862 (the lead plow) did not recognize that this instruction was intended for him. When the vehicles did not stop, the ground controller repeated the instruction, this time transmitting “PLOW 170 STOP.”

The vehicles continued, and the ground controller transmitted “PLOW 862 STOP.” With no immediate response, the ground controller then repeated the instruction. The lead plow came to a stop at 1348:31. The ground controller then told the lead plow operator “you are on the runway, hold position there.”

When PLOW 862 came to a stop, it was approximately 270 feet beyond the holding position for Runway 06L, but still on the taxiway surface, approximately 100 feet laterally from the edge of the runway.

At about the same time that the plow vehicles were crossing the holding position (1348:26), the south tower controller instructed flight SKV7665 to abort its takeoff, using the phraseology “Maple 7665 abort.”^{Footnote 2}

Due to the snowy conditions, the flight crew could not see the plow vehicles ahead; however, the flight crew heard the abort call and immediately began the abort sequence in accordance with company procedures, using heavy brakes and thrust reversers. At this point, the aircraft was in the high-speed regime of the takeoff: the airspeed was 110 knots.

The aircraft came to a stop on the runway centreline, approximately 200 feet before the intersection of Runway 06L and Taxiway C2, and separated from PLOW 862 by about 200 feet laterally (Figure 2).

1.2 Weather

At the time of the occurrence, the visibility was reduced due to heavy snow conditions. There were 2 aerodrome special meteorological reports (SPECI)^{Footnote 3} for CYYZ around the time of the occurrence.

At 1333 the SPECI was reported as follows:

• winds: 070° true (T) at 9 knots, gusting to 16 knots;
• visibility: ⅜ statute miles (SM);
• precipitation: snow;
• vertical visibility: 400 feet above ground level (AGL);
• runway visual range of Runway 06L: 3000 feet;
• temperature: −13 °C, dew point −18 °C;
• altimeter setting: 29.98 inches of mercury (inHg).

At 1349 the SPECI was reported as follows:

• winds: 070° T at 9 knots;
• visibility: ¼ SM;
• precipitation: heavy snow;
• vertical visibility: 400 feet AGL;
• runway visual range of Runway 06R: 3000 feet;
• runway visual range of Runway 05: 2800 feet;
• temperature: −13 °C, dew point −17 °C;
• altimeter setting: 29.97 inHg.

1.3 Air traffic control at Toronto/Lester B. Pearson International Airport

1.3.1 General

The NAV CANADA control tower at CYYZ is located approximately in the centre of the airfield, providing a view of the entire manoeuvring area. Because the airfield in its entirety is large, certain portions of the manoeuvring area are relatively far from the tower.

The airfield has 3 parallel runways in an east–west orientation and 2 in a north–south orientation. During periods of high-volume traffic, all 3 east–west runways are used; this is referred to as triple-runway operations.

On the day of the occurrence, Runway 05 was being used for departures; however, the airport was transitioning to triple-runway operations at the time of SKV7665’s departure. SKV7665 was the first planned departure from Runway 06L during the transition.

Due to the snowy conditions, there were numerous snow removal vehicles operating on the manoeuvring areas. In addition, there were several aircraft taxiing to and from the gates. With the amount of traffic and reduced visibility, the ground controller’s workload was high and complex.

1.3.2 Controller experience

Both of the air traffic controllers involved in this occurrence were certified and qualified for their respective duties. The ground controller had approximately 15 years of experience as an air traffic controller and 1.5 years of experience at the CYYZ tower. The tower controller had 14 years of experience as an air traffic controller and 9 years of experience at the CYYZ tower.

1.3.3 Advanced surface movement guidance and control system

Each control position in the tower is equipped with various equipment or systems to monitor, control, and communicate with aircraft and ground vehicles, including but not limited to ground radar or surveillance systems, communication radios, and ground lighting control.

The tower is equipped with an advanced surface movement guidance and control system (A‑SMGCS), or ground radar, which provides controllers with a real-time display of aircraft and vehicle traffic on the airport manoeuvring areas. The system receives input from both radar and multilateration antennas.^{Footnote 4}

Each control position in the tower is equipped with its own A‑SMGCS display screen. On this screen, ground vehicles and aircraft are displayed as irregular yellow shapes (Figure 3). If these vehicles and aircraft are equipped with transponders, the display will also show information such as the vehicle’s call sign.

In this occurrence, the lead plow (PLOW 862) was shown as PLOW 170 on the controller’s A‑SMGCS display. The call signs of the next 2 vehicles in the convoy did not appear on the display, and the last vehicle was shown as BLR 186.

The NAV CANADA Toronto Control Tower Unit Operations Manual outlines the local procedures for controllers to follow at each tower position, as well as controllers’ responsibilities. The manual describes controllers’ responsibilities and actions they are to take if an aircraft’s transponder tag information on the display does not match its call sign. However, it does not contain procedures for when a ground vehicle’s transponder tag does not match its call sign (i.e., there is a mismatch between the vehicle call sign and the transponder tag).

Before the introduction of the A‑SMGCS, the ground radar system at CYYZ was based on primary surveillance radar, and was referred to as airport surface detection equipment (ASDE). At that time, vehicles were not equipped with transponders, so the vehicles were shown only as yellow irregular shapes on the display screen, without any transponder tags. Vehicle call signs were input manually on a virtual progress strip embedded in the extended computer display system (EXCDS)^{Footnote 5} to which controllers could refer.

Because the ASDE did not show any tag information, controllers became used to seeing the vehicles without associated tags. Over time, some vehicles became equipped with transponders and, when the ground radar was upgraded to A‑SMGCS, the display screens began to show the tags or call signs of associated vehicles.

If a vehicle’s tag was incorrect, controllers did not deem it a major concern because they were used to seeing the targets without tags and could refer to the EXCDS display for the appropriate call sign. Controllers did not track the number of incorrect tags or call signs, so it could not be determined how frequently this was happening.

In this occurrence, the ground controller saw the lead plow vehicle on the A-SMGCS display as it crossed the holding position; however, the display showed the vehicle as PLOW 170. When there was no response from the ground controller’s first 2 transmissions to stop, the ground controller referred to the EXCDS display, saw the correct call sign for the plow, and then referred to the plow by the correct call sign in his next instruction to stop.

1.3.3.1 Runway incursion monitoring and conflict alert system

The runway incursion monitoring and conflict alert system (RIMCAS) is a sub-system within the A‑SMGCS. RIMCAS monitors aircraft and vehicle traffic on the airport movement area and surrounding airspace to identify and alert air traffic controllers to possible conflict situations.^{Footnote 6}

Stop-bar^{Footnote 7} overrun monitoring and runway incursion monitoring are functions of the RIMCAS. When an aircraft is due to take off or land on a designated active runway, the system assesses the positions of radar targets and, within configurable parameters, identifies incursions onto that runway. When it detects a hazard, the system sends an alert to the air traffic controller to help identify the targets involved, their locations, and the severity of the hazard.^{Footnote 8}

RIMCAS-generated alerts and alarms are provided only to air traffic controllers and are intended to prompt controllers to issue alternative instructions to the aircraft or vehicles involved in the hazard. The system does not provide alerts directly to flight crews on board aircraft.

1.3.3.1.1 Stop-bar overrun monitoring

When enabled, the stop-bar overrun monitoring function of the RIMCAS assesses aircraft and vehicle target positions and generates a visual and aural alert to controllers when a target crosses an illuminated stop-bar while entering a runway.^{Footnote 9} This alarm is reactive rather than predictive; it is triggered only once a stop-bar has been crossed. Aircraft that have landed or vehicles and aircraft that are on the runway and exit will not trigger an alarm.

1.3.4 Lighting and visual cues

Air traffic controllers control the airfield lighting using a control system touch-screen panel. Procedures and requirements for the use of the lights and for selection of lighting intensity levels are outlined in NAV CANADA’s Manual of Air Traffic Services (MATS)^{Footnote 10} and supplemented by the Toronto Control Tower Unit Operations Manual and associated operations directives.

At taxiways intersecting a runway, there is a painted yellow line (the hold-short line), which identifies the runway holding position. In addition to the hold-short line, the Runway 06L holding position at Taxiway C2 has elevated runway guard lights (which flash on and off and are commonly referred to as “wig wags”), inset stop-bar lights, supplemental elevated stop-bar lights, and taxiway centreline lights. The purpose of these lights is to draw attention to the runway holding positions.

The inset stop-bar lights (unidirectional red lights spaced evenly across the taxiway) are set into the pavement at the holding position.

The intensity of the lights is adjustable from levels 1 to 5, with level 5 being the brightest. The intensity of the airfield lighting is not recorded, so the intensity setting of the stop-bar lights at the time of the occurrence could not be verified. The intensity was reported to have been set at level 5; however, at the time of the occurrence, the lights were obscured by the accumulated snow.

The supplemental elevated stop-bar lights are installed on both sides of the taxiway near the runway guard lights and consist of a pair of raised unidirectional red lights on each side, for a total of 4 lights.

The lights were installed in accordance with the standard set out in the 4th edition of Transport Canada TP 312, Aerodrome Standards and Recommended Practices, which stated that “these lights shall have the same characteristics as the lights in the stop-bar, but shall be visible to approaching aircraft up to the stop-bar position.”^{Footnote 11} To meet this standard, the elevated stop-bar lights were aimed at a location consistent with the approximate position of an aircraft holding at the runway holding position, or roughly 3 m (10 feet) from the hold-short line.

When TSB investigators attended the site of the incursion, it was noticed that 1 light on each pair of elevated stop-bar lights was not functioning. However, it could not be determined whether the lights had been serviceable at the time of the occurrence.

1.3.5 Safety-critical phraseology

In the event of a serious incursion, a controller may decide that the safest course of action is to issue an instruction to a departing aircraft to abort takeoff or to issue an instruction to an aircraft on approach to pull up and go around. Such instructions, particularly with respect to aborting takeoff, are not common and are considered only as a last resort. The MATS states:

Aborting a takeoff is an emergency procedure used when continuing would present a grave hazard to the aircraft. A controller-initiated aborted takeoff is an extreme measure used only where no clear alternative exists.^{Footnote 12}

It is not common for high-speed abort instructions to be issued. The tower controller involved in this occurrence had not issued high-speed abort instructions to a departing aircraft before this occurrence.

During the occurrence, the controller used the phraseology “abort" when issuing abort instructions to the aircraft. However, according to the MATS, the standard phraseology at the time of the occurrence was “abort take-off.”^{Footnote 13} Even though the tower controller used the abbreviated phraseology, the flight crew understood the clearance, and took immediate action to abort.

The MATS also states that the phrase “I say again” means “I repeat for clarity or emphasis” and that “immediately” should be used only “when immediate action is required for safety reasons.”^{Footnote 14} However, it does not specifically recommend using this phraseology to emphasize an instruction to abort a takeoff.

In situations in which the aircraft involved has already begun its take-off roll, the appropriate phraseology according to the International Civil Aviation Organization (ICAO) Procedures for Air Navigation Services – Air Traffic Management (PANS-ATM) is [emphasis in original] “STOP IMMEDIATELY [(repeat aircraft call sign) STOP IMMEDIATELY].”^{Footnote 15},^{Footnote 16}

The report on the TSB’s safety issue investigation into runway incursions at CYYZ states the following:

When air traffic controllers recognize a conflict between aircraft or vehicles—such as when an aircraft is on the take-off roll and another aircraft incurs on the runway—they must issue prompt instructions to resolve the conflict. These instructions need to be recognized and understood by the intended recipients so that the safest course of action can be taken. If these instructions are not followed, there is a risk that the conflict may result in a collision.^{Footnote 17}

At the time of this occurrence, the phraseology to be used in these safety-critical situations in Canada differed from international guidance. NAV CANADA’s procedures did not prescribe any attention-getting enhancements, such as using the word “immediately” or repeating the instruction. Without these enhancements, the instruction may not be compelling enough to attract the intended recipient's attention, and, as the phraseology may be different from what flight crews are expecting, there is a risk that the instruction will not be immediately understood, particularly during periods of high workload. These 2 factors may result in the instruction not being actioned and an increased risk of collision. As a result, the TSB recommended that:

In response to Recommendation A18-04, in July 2019, NAV CANADA amended its abort take-off phraseology to include repetition as a method to ensure that the instructions are significantly compelling to be recognized during periods of high workload, such as takeoff.

However, this phraseology was not in effect at the time of the occurrence.

1.4 Greater Toronto Airports Authority

1.4.1 Vehicle operators

All of the vehicle operators involved in this occurrence had several years of experience operating various equipment (including snowplows) on the airport manoeuvring areas. They all held a valid airside vehicle operator’s permit, and were trained and qualified for the type of operation.

The drivers were familiar with operating equipment on the manoeuvring area and navigated the area using their local knowledge, experience and the visual cues and signs. They did not have access to any real-time navigation displays to assist with navigating the various taxiways and runways, such as moving maps or a GPS (global positioning system).

Recently, the Federal Aviation Administration released an Advisory Circular^{Footnote 18} which provides non-mandatory performance specifications for airport vehicle runway incursion warning systems, including, but not limited to, real-time navigation displays for airport vehicles. However, in Canada there are no known airports that have vehicles equipped with such displays, nor are they required to by regulation.

However, all of the drivers understood the clearance provided by air traffic control (ATC) and knew where they were on the airfield before turning onto Taxiway C2, and where they were intending to go.

Each of the vehicles had VHF radios capable of communicating with ATC. Although the lead driver would primarily communicate with ATC, the other drivers listened to the ATC instructions and followed the lead driver. The plow drivers also had handheld radios capable of communicating with each other.

1.4.2 Vehicles and transponders

The GTAA began installing transponders on its vehicles in October 2014. The installation and programming of the transponders was performed by a contracted service provider. At the time of the occurrence, there were 171 multilateration transponders in use.

The occurrence transponder^{Footnote 19} (Figure 4) was initially installed on PLOW 170 and programmed with that call sign. PLOW 170 was later removed from service.

PLOW 862 was a new vehicle and did not have a transponder. Due to an extended delivery wait for a new transponder, PLOW 170’s transponder was removed and installed on PLOW 862 on 10 December 2018.

The GTAA has standard operating procedures (SOPs) regarding the installation of transponders in GTAA vehicles. According to the SOPs, the GTAA receives a block of hexadecimal identifiers from NAV CANADA for the purposes of programming their call signs. When a new transponder is required, a contracted service provider programs the unit with its call sign (e.g., PLOW 170 will be associated with a NAV CANADA hexadecimal identifier), then installs and tests the unit.

The SOPs indicated that during the testing, the contracted service provider was to use web-based software to check the transponder code and ensure that the signal or call sign is correct. However, in the case of the occurrence transponder, the step to reprogram and test the transponder was missed. As a result it was not noticed that the call sign had not been changed from PLOW 170 to PLOW 862. The SOPs do not call for the transponder code to be checked periodically to ensure that it is correct, and the vehicle operators do not have access to the software to check the code and ensure that it is correct.

Transferring of transponders between vehicles is not common; the majority of the installations are new units and therefore would not have a code pre-programmed in the unit.

It was reported that when the transponder program began, controllers would often challenge a vehicle that had an incorrect or a missing code. However, there were no records of how often this occurred, and over time, as less feedback was sent to the GTAA, the GTAA assumed that fewer errors were occurring.

A threat hazard identification and risk analysis was conducted in 2012, early on in the development of the transponder project, in accordance with the GTAA’s safety management system process for airside changes. Call sign and vehicle mismatch was identified as a hazard with corrective action being the development of SOPs to prevent the problem.

1.5 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer. The TSB publishes the Watchlist to focus the attention of industry and regulators on the problems that need to be addressed today.

The risk of collisions from runway incursions is a 2018 Watchlist issue. Since this issue was first added to the Watchlist in 2010, the TSB has completed 10 investigations ^{Footnote 20} into runway incursions at airports across Canada, including a safety issue investigation focused on the south complex parallel runways at CYYZ. ^{Footnote 21} In late 2018 and early 2019, the TSB initiated 3 additional investigations across the country. ^{Footnote 22} Although there has not been a recent accident as a result of a runway incursion in Canada, the potential consequences of such a collision could be catastrophic. ^{Footnote 23}

The Board is concerned that the rate of runway incursions in Canada and the associated risks of collision will remain until effective defences tailored to address previously identified hazards are implemented at airports and in aircraft, vehicles, and air traffic service facilities across Canada.

ACTIONS REQUIRED Risk of collisions from runway incursions will remain on the TSB Watchlist until the rate of runway incursions, particularly the most severe ones, demonstrates a sustained reduction. Transport Canada and all sectors of the aviation industry must continue to collaborate and develop tailored solutions to identified hazards at Canadian airports. These solutions could include improvements in air traffic control procedures, surveillance and warning systems, runway and taxiway designs, holding position visual aids, and flight crew training and procedures. Modern technical solutions, such as in-cockpit electronic situational awareness aids, and direct-to-pilot warnings, such as runway status lights, should also be implemented.

1.6 TSB laboratory reports

The TSB completed the following laboratory reports in support of this investigation:

• LP014/2019 – Flight data recorder analysis
• LP015/2019 – Cockpit voice recorder download

In this occurrence, snow removal vehicles incurred on the protected area of a runway as an aircraft was beginning its take-off roll. The analysis will focus on why the vehicle operators were not aware of their position and why the defenses in place to mitigate the consequences of the incursion were of reduced effectiveness.

2.1 Situational awareness

All 4 of the vehicle operators were experienced in operating vehicles on the airport manoeuvring areas, and there was no misunderstanding of the air traffic control (ATC) instruction, where the vehicles were authorized to work, and the intended route.

The vehicle operators did not have access to any real-time navigation displays to assist with navigating the various taxiways and runways, such as moving maps or a GPS (global positioning system). The operators were knowledgeable about the area but were driving in conditions of reduced visibility.

The operator of the lead vehicle, PLOW 862, was instructed to proceed east on Taxiway C. However, after making a wide left turn to position snow near the south edge of the taxiway, he inadvertently turned onto Taxiway C2. Believing he was on Taxiway C, he continued onto Taxiway C2, and due to the limited visibility the other vehicles followed.

Due to the reduced visibility from blowing snow, the operator of PLOW 862 was not aware that the vehicle was on Taxiway C2 as it approached the holding position. As a result, the operator was not looking for, nor expecting to see, any of the visual cues that would have alerted him that the vehicle was approaching an active runway.

In addition to the reduced visibility, Taxiway C2 was covered in snow, which obscured the paint markings and the inset stop-bar lights. When investigators later examined the location, it was noticed that 1 light in each pair of elevated stop-bar lights was not working. Although it could not be determined if these lights were operating on the day of the occurrence, the reduced lighting likely would have further reduced the conspicuity of the holding position.

Because some of the visual cues at the holding position were obscured by snow, and others may not have been working, the cues were not conspicuous enough to alert the operator of PLOW 862 to the vehicle’s proximity to the runway. As a result, PLOW 862 and the following 2 vehicles incurred on the protected area of the runway.

2.1.1 Vehicle transponder procedures

The Greater Toronto Airports Authority (GTAA) conducted a risk analysis in 2012 regarding vehicle transponders and identified vehicle mismatch as a hazard. As a result, standard operating procedures (SOPs) were developed to prevent the situation from occurring in future. The SOPs in effect for installing and testing the transponders include programming a code for the new transponder and then using web-based software to check that the code is correct before the vehicle is operated on the manoeuvring area. Once the transponder and vehicle are operational, the vehicle operators have no method of checking the software themselves to verify that the transponder is displaying the correct code.

Normally the GTAA installs new transponder units in new vehicles that are to be operated on the manoeuvring areas of the airport. However, in this case there were no new transponders available, and so a used transponder was installed. Transferring of transponders between vehicles is not common; the majority of the installations are new units, and therefore would not have a transponder code pre-programmed in the unit. The used transponder was checked for proper operation and deemed to be serviceable before it was installed on PLOW 862, although it was programmed with the code PLOW 170.

The transponder installed on PLOW 862 was not updated to remove the code from the vehicle on which it had previously been installed (i.e., PLOW 170). As a result, the incorrect code was shown on the ground controller’s display.

2.1.2 Uncorrected transponder code error

Before the introduction of the advanced surface movement guidance and control system (A-SMGCS), the ground radar system at Toronto/Lester B. Pearson International Airport (CYYZ) was based on primary surveillance radar. At that time, vehicles did not have transponder codes, so controllers were used to seeing the targets without these codes appearing as tags on their displays. Over time, some targets began to have tags associated with them, but controllers were still using the extended computer display system (EXCDS) screen to get call sign information. Consequently, when there was a mismatch between the tag on the A-SMGCS display and the vehicle call sign, although controllers initially reported these errors to vehicle operators, they did not deem it a serious ongoing hazard.

At the time of the occurrence, the NAV CANADA control tower at CYYZ did not have procedures to follow if there was a mismatch between a vehicle call sign and its transponder code. It was reported that when the transponder program began, ATC would often challenge a vehicle that had a wrong or missing code; however, this could not be verified. In addition, there were no records available regarding the frequency or number of transponder code and vehicle call sign mismatches. Over time as fewer challenges were received, the GTAA assumed that fewer mismatches were occurring. Even though PLOW 862 had an incorrect transponder code for 7 weeks, the error was not identified or reported to the GTAA.

NAV CANADA did not have procedures in place to track or report vehicle transponder errors to the GTAA.

2.2 Air traffic controller instructions

When the ground controller observed the vehicles crossing the holding position at Taxiway C2 on the A-SMGCS display screen, he used the call sign associated with the target (PLOW 170) when instructing the plow operator to stop. When the ground controller did not receive a response, he referred to the EXCDS screen and obtained the correct call sign (PLOW 862).

The ground controller recognized the incursion by PLOW 862 and instructed the vehicle to stop 4 times; however, the first 2 instructions were addressed to PLOW 170 rather than PLOW 862. Immediately after the ground controller used the correct call sign, but 10 seconds and 270 feet after crossing the holding position on Taxiway C2, PLOW 862 came to a stop.

2.2.1 Abort take-off phraseology

It is not common for controllers to issue high-speed abort instructions, and this occurrence was the first time the tower controller had issued such an instruction. In doing so, he used the phraseology “abort" when the standard phraseology at the time was “abort take-off.” However, the flight crew understood the instruction, and took immediate action to abort.

Although the use of abbreviated phraseology did not adversely affect the outcome of this occurrence, it represents a risk to transportation safety. If air traffic controllers use abbreviated phraseology when issuing safety-critical instructions, there is a risk that the instruction will not be recognized or followed by flight crews.

In response to TSB Recommendation A18-04, which was released after this occurrence, NAV CANADA has amended its abort take-off phraseology to include repetition as a method to ensure that the instructions are sufficiently compelling to be recognized during periods of high workload, such as takeoff.

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. The transponder installed on PLOW 862 was not updated to remove the code from the vehicle on which it had previously been installed. As a result, the incorrect code was shown on the ground controller’s display.
2. NAV CANADA did not have procedures in place to track or report vehicle transponder errors to the Greater Toronto Airports Authority.
3. Due to the reduced visibility from blowing snow, the operator of PLOW 862 was not aware that the vehicle was on Taxiway C2 as it approached the holding position. As a result, the operator was not looking for, nor expecting to see, any of the visual cues that would have alerted him that the vehicle was approaching an active runway.
4. Because some of the visual cues at the holding position were obscured by snow, and others may not have been working, the cues were not conspicuous enough to alert the operator of PLOW 862 to the vehicle’s proximity to the runway. As a result, PLOW 862 and the following 2 vehicles incurred on the protected area of the runway.
5. The ground controller recognized the incursion by PLOW 862 and instructed the vehicle to stop 4 times; however, the first 2 instructions were addressed to PLOW 170 rather than PLOW 862. Immediately after the ground controller used the correct call sign, PLOW 862 came to a stop 10 seconds and 270 feet after crossing the holding position on Taxiway C2.

3.2 Findings as to risk

These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If air traffic controllers use abbreviated phraseology when issuing safety-critical instructions, there is a risk that the instruction will not be recognized or followed by flight crews.

3.3 Other findings

These items could enhance safety, resolve an issue of controversy, or provide a data point for future safety studies.

1. The vehicle operators did not have access to any real-time navigation displays to assist with navigating the various taxiways and runways, such as moving maps or a global positioning system.

4.1 Safety action taken

4.1.1 Greater Toronto Airports Autority

The Greater Toronto Airports Authority (GTAA) has amended its standard operating procedure relating to changing vehicle transponders to require that the contracted service provider installing a unit confirm with NAV CANADA that the vehicle's transponder call sign is correct and not mismatched when displayed by NAV CANADA's systems.

In addition, immediately following the incident, the GTAA conducted a check of all of its other airside vehicles. They all had the correct transponder call signs.

The GTAA is currently evaluating in-vehicle situational awareness tools for its vehicles operating in the manoeuvring areas.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 22 April 2020. It was officially released on 12 May 2020.