Air transportation safety investigation report A20O0029

On 07 March 2020, at 0948 Eastern Standard Time, the Air Canada Embraer ERJ 190-100 IGW (Embraer 190) aircraft (registration C-FMZW, serial number 19000124), operating as flight ACA1037 and carrying 83 passengers and 4 crew members, was conducting a takeoff from Runway 06L at Toronto/Lester B. Pearson International Airport, Ontario. Shortly after the Embraer 190 had begun its take-off roll, the Air Canada Boeing 777-333ER (Boeing 777) aircraft (registration C-FJZS, serial number 62400), operating as flight ACA606, was instructed to line up on Runway 06L. On board were 345 passengers and 14 crew members.

As the Embraer 190 was accelerating on its take-off roll, it struck a bird. The flight crew initiated a rejected takeoff and made a radio call to report that they were rejecting the takeoff. Neither air traffic control nor the Boeing 777 flight crew heard this radio call because the Boeing 777 flight crew was reading back their take-off clearance on the same frequency.

As the Boeing 777 was accelerating on its take-off roll, the flight crew observed that the Embraer 190 was still on the runway and initiated a rejected takeoff. Both aircraft eventually exited the runway and returned to the terminal. There were no injuries. There was no damage to either aircraft.

The International Civil Aviation Organization (ICAO) and Transport Canada (TC) define a runway incursion as:

[a]ny occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle or person on the protected area of a surface designated for the landing and take-off of aircraft. ^{Footnote 1},^{Footnote 2}

This definition often includes the following clarification:

this 'incorrect presence' may be a consequence of a failure of a pilot [or vehicle driver] to comply with a valid ATC [air traffic control] clearance or their compliance with an inappropriate ATC clearance. ^{Footnote 3}

The Canadian Aviation Regulations subsection 602.19(10) stipulates that

[n]o person shall conduct or attempt to conduct a take-off or landing in an aircraft until there is no apparent risk of collision with any aircraft, person, vessel, vehicle or structure in the take-off or landing path. ^{Footnote 4}

1.1 History of the occurrence

On 07 March 2020, at 0615,^{Footnote 5} the air traffic controller reported for duty at the control tower at Toronto/Lester B. Pearson International Airport (CYYZ), Ontario, and started his shift. That morning, the controller rotated through various controller positions and at approximately 0930, he assumed the combined controller position for both the north tower and the south tower (the north/south tower combined position). He thus began controlling aircraft operating on Runway 05 and Runway 06L. Local weather was reported as visual meteorological conditions, and traffic was moderate, with a small number of aircraft arriving but a constant lineup of aircraft awaiting departure. To expedite departures, the controller was using visual departure separation procedures outlined in NAV CANADA’s Manual of Air Traffic Services (MATS).^{Footnote 6} By 0945, the controller had coordinated 5 arrivals, 2 departures from Runway 05, and 14 departures from Runway 06L.

At 0948:04, an Air Canada Embraer ERJ 190-100 IGW (Embraer 190) aircraft (registration C-FMZW, serial number 19000124) operated as flight ACA1037 and bound for Denver International Airport (KDEN), Colorado, United States, was cleared to take off from Runway 06L. As soon as the Embraer 190 had begun its take-off roll, an Air Canada Boeing 777-333ER (Boeing 777) aircraft (registration C-FJZS, serial number 62400) operated as flight ACA606 and bound for Halifax Stanfield International Airport (CYHZ), Nova Scotia, was instructed to line up on Runway 06L.

At 0948:27, the Embraer 190 reached 50 knots indicated airspeed (KIAS)^{Footnote 7} and continued accelerating. Three seconds later, the track label from the advanced surface movement guidance and control system (A-SMGCS) on the display monitor at the controller working position (CWP) showed that the Embraer 190 was in air^{Footnote 8} with an altitude tag of 500 feet above sea level (ASL) (depicted as A005) (figures 1 to 3).^{Footnote 9} However, the aircraft was still on the ground at this time.

At 0948:47.7, while the Embraer 190 was on its take-off roll, the first officer saw a bird fly past the aircraft. The captain also saw the bird fly past his window, heard it hit the fuselage just below and behind his side window and was concerned that it would deflect into the left-hand engine. Concerned that the aircraft may not fly safely, the captain elected to reject the takeoff. At the time, the Embraer 190 was travelling at 139 KIAS (131 knots ground speed), just below the calculated V₁ speed of 146 KIAS. A second and a half after the bird strike, the captain of the Embraer 190 initiated the rejected takeoff. The Embraer 190 reached a maximum ground speed of 139 knots before decelerating. The rejected takeoff was conducted in accordance with the Air Canada E190 Airplane Operating Manual (AOM).

At 0948:48.7, the controller issued a take-off clearance to the Boeing 777, unaware of the bird strike and the Embraer 190’s rejected takeoff.

At 0948:53.4, the first officer of the Embraer 190 initiated a radio call stating that the crew were rejecting their takeoff. At 0948:53.5, the first officer of the Boeing 777 initiated the readback of their take-off clearance on the same frequency. The simultaneous radio transmissions went undetected: the controller heard the Boeing 777 flight crew read back their take-off clearance, but neither the controller nor the Boeing 777 flight crew heard the Embraer 190’s radio call for their rejected takeoff. At the time of the simultaneous radio transmissions, the Embraer 190 was 5000 feet from the beginning of the runway and decelerating rapidly. At 0948:55, the Boeing 777 started its take-off roll.

Over the next 25 seconds, the controller turned his attention to the north end of the airport, where 2 aircraft were on approach for Runway 05, and to the displays at his CWP twice before returning his focus to the threshold of Runway 06L, at the south end of the airport. In keeping with the departure flow, the controller instructed a 3rd aircraft, a de Havilland DHC-8 operated by Jazz Aviation LP as flight JZA28, to line up on Runway 06L. From his displays, he could see the Boeing 777 and the Embraer 190, but he saw no conflict at that time (see Figure 1 for a screen shot of the display monitor at the CWP and section 1.10 for information on the controller’s field of view of Runway 05 and Runway 06L from the control tower). Meanwhile, the Boeing 777 was accelerating through 80 KIAS when its flight crew observed that the Embraer 190 was still on the runway ahead of them.

At 0949:24, the Boeing 777 flight crew initiated a rejected takeoff at 127 KIAS (118 knots ground speed) in accordance with the procedure in the Air Canada B777 Airplane Operating Manual (AOM). The Boeing 777 reached 133 KIAS (125 knots ground speed) before decelerating. The calculated V₁ speed was 156 KIAS. The flight crew made a radio transmission a few seconds later, declaring that they were rejecting their takeoff. At that point, the separation between the 2 aircraft was 5000 feet.

At 0949:36, the Boeing 777 decelerated through a ground speed of 50 knots. The controller confirmed the rejected takeoff with the flight crew, still unaware of the Embraer 190’s presence on the runway, and waited to provide further assistance to the Boeing 777. At 0949:42, after searching the expected position of the Embraer 190 (in the air, at the departure end of the runway), the controller saw the Embraer 190 on the runway, and realized that it had also conducted a rejected takeoff. The controller then communicated with the Embraer 190 flight crew.

During this occurrence, the A-SMGCS track labels for the Embraer 190 and the Boeing 777’s radar targets automatically changed to indicate that the aircraft were in air before once again showing them as being on the ground (Table 1).

Table 1. Timings of the Embraer 190 and Boeing 777 flight status changes on the advanced surface movement guidance and control system

Time	Aircraft	Flight status
0948:30	Embraer 190	in air
0949:20	Boeing 777	in air*
0949:22	Embraer 190	on ground**
0949:43	Boeing 777	on ground

* At this time, the track labels showed that the Boeing 777 (ACA606) was accelerating and depicted as in air at a speed of 100 knots. The Embraer 190 (ACA1037) was decelerating, but it was displayed as in air with a speed of 51 knots.
** The track label indicated that, at this time, the Embraer 190 was on ground and had decelerated below 48 knots.

As a result, the runway incursion monitoring and conflict alert sub-system (RIMCAS) generated the following alerts (Table 2).

Table 2. Alerts generated by the runway incursion monitoring and conflict alert sub-system

Time	Alert	Aircraft in conflict and respective position
0949:39	Stage 1*	de Havilland DHC-8 Threshold of Runway 06L	Embraer 190 Departure end of Runway 06L
0949:43	Stage 2*	Boeing 777 Midway point along Runway 06L	Embraer 190 Departure end of Runway 06L
0949:45	Stage 1	de Havilland DHC-8 Threshold of Runway 06L	Boeing 777 Midway point along Runway 06L

* These stage alerts are explained in section 1.10.3.2.

By 0949:53, the Embraer 190 had exited at the end of the runway at Taxiway D7 and the Boeing 777 had come to a stop slightly past the midway point on the runway. The Embraer 190 taxied to the terminal without further incident. The Boeing 777 exited the runway, proceeded onto a taxiway, and waited for 45 minutes to allow the brakes to cool in accordance with company procedures, before returning to the terminal.

The runway was inspected and the remains of a hawk were found. The runway was then returned to service. The controller informed his supervisor of the incident and was relieved from the position by another qualified controller, as directed by NAV CANADA’s MATS and CYYZ control tower procedures.

1.2 Injuries to persons

None of the 83 passengers and 4 crew members on the Embraer 190 and none of the 345 passengers and 14 crew members of the Boeing 777 were injured.

1.3 Damage to aircraft

There was no damage to either aircraft.

1.4 Other damage

Not applicable.

1.5 Personnel information

1.5.1 Flight crew

Records indicated that the flight crew from both aircraft held the appropriate licences for the flights in accordance with existing regulations.

1.5.2 Air traffic services personnel

The air traffic services (ATS) controller involved in this occurrence was licensed and qualified for the operation. He had been employed by NAV CANADA and working at CYYZ since 2004 and was an experienced controller and instructor. However, he had never seen a high-speed rejected takeoff in either a controller or an instructor capacity. At the time of the occurrence, the controller was standing while performing duties in the north/south tower combined position.

The controller coordinated the movements of 21 aircraft from the time he accepted responsibility for the combined position at approximately 0930 until he was relieved after the event. Subsequently, NAV CANADA assessed traffic volume and workload at the time of the occurrence as moderate and somewhat complex. ^{Footnote 10}

Table 3. Controller information

Controller position	North/south tower combined
Licence/endorsement	CYYZ airport
Medical expiry date	30 April 2020
Experience as a controller	17 years
Experience in present unit	15 years
Hours on duty before the occurrence	3 hours
Hours off duty before the work period	12 hours

1.6 Aircraft information

1.6.1 Embraer ERJ 190-100 IGW

Air Canada used the Embraer 190 for medium-range domestic and international flights. Nothing was reported to indicate that there were any system malfunctions before the occurrence.

The Embraer 190 is equipped with the Honeywell Primus Epic avionics suite, which is an integrated suite of avionic modules, including the Honeywell model XS-857A Mode S transponder.

1.6.2 Boeing 777-333ER

Air Canada uses the Boeing 777 for long-range domestic and international flights. Nothing was reported to indicate that there were any system malfunctions before the occurrence.

1.7 Meteorological information

The aerodrome routine meteorological report for CYYZ issued at 0900 indicated visual meteorological conditions with winds variable at 6 knots, a visibility of 15 statute miles, few clouds at 25 000 feet, a temperature of −5 °C, and a dewpoint of −12 °C. Weather and visibility conditions were not a factor in this occurrence.

1.8 Aids to navigation

Not applicable.

1.9 Communications

1.9.1 General

Air traffic controllers at the CYYZ control tower follow the communication and phraseology guidelines set out in NAV CANADA’s MATS and the Toronto Control Tower Unit Operations Manual.

1.9.2 Undetected simultaneous transmissions

The European Organisation for Civil Aviation Equipment (EUROCAE) describes simultaneous radio transmissions as follows:

Situations arise when two or more radio transmissions occur, simultaneously, on the same frequency. In this context ‘simultaneous’ is defined as two or more transmissions that overlap in such a way that the controller is not aware that more than one transmission has occurred leading to a potential safety hazard.^{Footnote 11}

Undetected simultaneous transmissions (USiT) occur frequently in the aviation industry. Signal reception is dependent on the quality of a radio signal transmitted, which is based on the signal strength, distance between transmitters and receivers, line of sight, and other factors. A strong signal from a nearby aircraft can easily mask or block a weaker signal from another aircraft that is further away.

There are 3 types of signal overlap: garbled, partial, and full. In a case of full overlap,

[t]he stronger signal totally covers the weaker one (without detection) […]. Although both signal [sic] are transmitted, physical laws cause the receiver to eliminate the weaker signal leading to only one signal being transmitted to (or received by) the ATCO [air traffic controller]. Although some garbling may been [sic] heard in these circumstances depending on the type of RT [radio transceiver] equipment/architecture, no (or little) detection can be expected.^{Footnote 12}

1.10 Aerodrome information

1.10.1 Toronto/Lester B. Pearson International Airport

CYYZ is operated by the Greater Toronto Airports Authority and has a total of 5 runways: 05/23, 06L/24R, 06R/24L, 15R/33L, and 15L/33R.

1.10.1.1 NAV CANADA control tower

The NAV CANADA control tower at CYYZ is located approximately in the centre of the airfield, providing a view of the entire manoeuvring area. Because CYYZ is a large airport, certain portions of the manoeuvring area are relatively far from the tower. The distances from the tower to various locations on the airfield are within the limits of a person’s normal vision, but binoculars are available in the tower cab^{Footnote 13} if needed.

1.10.1.2 Controller working positions

At the time of the occurrence, 4 of the 9 positions in the tower were occupied:

• North/south tower (combined position) (the occurrence controller was working this position)
• North ground
• Clearance delivery
• South ground (the shift supervisor was working this position)

The CWPs are equipped to monitor, control, and communicate with ground vehicles and aircraft on the ground and in the air. Each position is equipped with A-SMGCS and the integrated information display system (IIDS), which includes the extended computer display system (EXCDS), the operational information display system (OIDS) and the NAV CANADA auxiliary radar display system (NARDS). Each position is also equipped with airport lighting controls, wind and altimeter displays, and radio controls.

1.10.1.3 North/south tower combined position and responsibilities

When all control positions are staffed, the north tower controller is responsible for arrivals and departures on Runway 05/23 and Runway 15L/33R, and the south tower controller is responsible for arrivals and departures on Runway 06L/24R, Runway 06R/24L, and Runway 15R/ 33L. When air traffic and workload permit, a single controller can assume the responsibilities of both of these tower positions in a combined position. ^{Footnote 14} ,^{Footnote 15}

At the time of the occurrence, combined-position operations were in effect: Runway 05 and Runway 06L were active and being used for both departing and arriving aircraft, and the controller had assumed the responsibilities for both the north and south tower positions. He was standing at the north tower control position in the control tower cab. This position is typically used for combined-position operations as it is deemed a better position for seeing, coordinating, and deconflicting arrival traffic congestion on Runway 05.

The fields of view^{Footnote 16} for Runway 05 and Runway 06L run in opposite directions (Figure 4).

When seated in the north tower position, the controller faces and has an unobstructed view of Runway 05 and all equipment and monitors at the CWP. To view runways 06L/24R and 06R/24L, the controller must either turn in the chair or stand and turn to face the opposite direction, away from the CWP. At the time of the occurrence, the controller was standing. To view runways 06L/24R and 06R/24L, he had to turn his body to face the opposite direction, away from the CWP. He then had to look past other personnel (who could be seated or standing at any given time) and other CWPs, and past the roof support beams to see aircraft operating on the south runways (Figure 5). A portion of the departure end of Runway 06L is not visible from this position because it is blocked by a roof support beam in the control tower cab and a section of gate infrastructure from Terminal 1. However, when seated at the south tower position, the controller faces and has an unobstructed view of runways 06L/24R and 06R/24L, as well as all equipment and monitors at that CWP.

1.10.2 Advanced surface movement guidance and control system

Volume IV of ICAO’s Annex 10 to the Convention on International Civil Aviation provides the international standards and recommended practices (SARPs) for surveillance and collision avoidance systems, including a chapter on multilateration systems.^{Footnote 17} Additional guidance and operational requirements for A-SMGCS are found in ICAO’s Advanced Surface Movement Guidance and Control Systems (A-SMGCS) Manual, which

is intended as guidance to enable manufacturers and operators, as well as certifying authorities, to develop and introduce A-SMGCS depending on local circumstances and taking into account global interoperability requirements for international civil aviation operations. Applicable ICAO Standards and Recommended Practices (SARPs) should also be taken into consideration in the development and implementation of A-SMGCS.^{Footnote 18}

ICAO defines A-SMGCS in the manual as follows:

A system providing routing, guidance and surveillance for the control of aircraft and vehicles in order to maintain the declared surface movement rate under all weather conditions within the aerodrome visibility operational level (AVOL) while maintaining the required level of safety.^{Footnote 19}

A-SMGCS is also discussed in various other ICAO and EUROCAE documents.^{Footnote 20} While ICAO SARPs are not necessarily used as regulation or certification requirements, these guidance manuals and their recommendations are widely adopted by ICAO Member States and organizations overseeing ATS.

In Canada, the Canadian Aviation Regulations refer to ICAO Annex 10 in subsection 802.02(1), which states only:

1. (1) A person who operates any equipment that is part of an aeronautical telecommunications system referred to in Annex 10 to the Convention shall ensure that
   1. (a) the equipment is installed, maintained and operated in accordance with the standards specified in Annex 10 to the Convention; and
   2. (b) documentation is maintained that shows how compliance with the standards referred to in paragraph (a) is being achieved.^{Footnote 21}

Although there are no regulatory obligations for airport operators to install and use A-SMGCS in Canada, the driving factor for the installation of these systems is to increase airport capacity in reduced visibility conditions and to maintain safety levels.

The control tower at CYYZ is equipped with a NOVA 9000 A-SMGCS, manufactured by Indra Navia AS. This A-SMGCS provides controllers with a real-time display of aircraft and vehicle traffic on the airport manoeuvring areas. The system relies on inputs from a terminal surveillance radar, a surface movement radar, and a multilateration (MLAT) system. Each CWP is equipped with its own A-SMGCS display. There is no formal A-SMGCS course for controllers, who learn how to use the system through experience and on-the-job training.

1.10.3 Runway incursion monitoring and conflict alert sub-system

The RIMCAS is a sub-system in the A-SMGCS. The purpose of the RIMCAS is to act as a safety net—to monitor aircraft and vehicle traffic on the airport movement area and in surrounding airspace and to identify and alert air traffic controllers to possible conflict situations. ^{Footnote 22}

The RIMCAS determines the positions of the ground targets by fusing the target data from the surface movement radar and the MLAT system. This data is then sent to the surveillance data server, where the RIMCAS assesses target positions and, within locally configurable thresholds, identifies incursions, and conflicts on the surface of the aerodrome. When it detects a hazard, the sub-system sends an alert message to the air traffic controller identifying the targets involved, their locations, and the severity of the hazard.^{Footnote 23} The simplified architecture of the sub-system is summarized in Figure 6.

The RIMCAS is susceptible to false alarms, which are generally caused by erroneous target perception by the sub-system, and unwanted or nuisance alerts, which are generated in circumstances where operations can still continue safely. The frequency of false alarms and nuisance alerts can vary, and their prevalence is not directly recorded. To reduce the frequency of false alarms, the RIMCAS must be configured and optimized for site-specific applications.^{Footnote 24}

1.10.3.1 Runway incursion monitoring and conflict alert sub-system in-air/on-ground logic

RIMCAS will only detect a departure conflict if the targets (aircraft or vehicles) are identified as on ground. Therefore, to ensure timely and accurate RIMCAS alerts are issued for departing aircraft, it is paramount that the status of these targets be correct and that the sub-system identify them as on ground.

The RIMCAS receives an aircraft’s in-air/on-ground status from the multi-sensor tracker (MST), which uses the aircraft’s ground speed, acceleration, and ground bit set (GBS).^{Footnote 25} When an aircraft is fitted with a Mode S transponder, its GBS value is sent in the form of a Mode S reply message from the aircraft, received by the MLAT system, and then sent to the MST. The logic in the MST uses several configurable speed and time values for determining the in-air/on-ground status. At the time of the occurrence, the relevant ground speed value for “Minimum speed for takeoff when GBS is OK” was set to 50 knots.

If the aircraft is accelerating and its speed is below the value set for “Minimum speed for takeoff when GBS is OK” (50 knots), the target will be considered on ground, regardless of the aircraft’s GBS value.

If the aircraft’s speed is above this set value, the aircraft’s GBS value will be used for determining the in-air/on-ground status, as long as it is available from the MLAT system. Increasing this value results in delaying the aircraft’s in-air status at takeoff. These values are set as recommended by Indra Navia AS after a local tuning and optimization process is completed with the client, NAV CANADA.^{Footnote 26}

In this occurrence, the Embraer 190 was identified as in air when it accelerated above a ground speed of 50 knots. The aircraft system on the Boeing 777 that provides the flight status is configured differently from the one on the Embraer 190. The Boeing 777 was identified as in air when it accelerated above 100 KIAS.

1.10.3.2 Runway incursion monitoring and conflict alert sub-system departure alerts

Departure alerts are generated in 2 stages. A stage 1 alert is a visual warning that appears on the A-SMGCS display advising controllers that a hazardous situation exists. A stage 2 alert is both visual and audible: a warning appears on the A-SMGCS display and a tower-wide audible alarm is sounded, indicating that the hazard is critical and a conflict may be imminent. Because the track labels are small, and changes to the aircraft flight status within the label is difficult to detect, an additional box is displayed over the track label with a yellow or red background to help highlight the alert and make the visual cue of the track label more salient to the controller.

RIMCAS-generated alerts, including audible alarms, are provided only to air traffic controllers and are intended to prompt controllers to issue alternative instructions to the aircraft or vehicles involved in the hazard. The sub-system does not provide alerts to flight crews on board aircraft.

A stage 1 alert – departure is generated when 2 or more targets are within the entire pre-defined departure area of an active runway, including when a target enters the protected area behind or ahead of a departing aircraft (Figure 7). This general rule has 1 exception: the alert will not be generated if it is determined that the lead target is a departing aircraft with a speed exceeding a pre-defined limit.^{Footnote 27} The stage 1 alert will remain active until all but one of the conflicting targets have left the departure area and the conflict situation no longer exists.^{Footnote 28}

A stage 2 alert – departure is generated when targets are in front of an aircraft detected to be accelerating for takeoff within a portion of the active departure area. The alert begins when the sub-system detects an aircraft accelerating down the runway at a speed that exceeds a pre-defined value^{Footnote 29} and a target is located within the search area in front of the accelerating aircraft. Then, at each CWP, the word “ALERT” will flash above the label of any target found in the search area (Figure 8). However,

the search will not take effect if the other target is determined to be a departure aircraft and is moving away from the aircraft (the calculated TCPA [time to closest point of approach][^{Footnote 30}] value is negative) [emphasis added]. In low visibility conditions, this extra TCPA check is omitted.^{Footnote 31}

The stage 2 alert will remain active

until the conflicting target has left the search area or if the reported speed of the departing aircraft falls below the pre-defined speed limit and the conflict situation no longer exists.^{Footnote 32}

1.10.3.3 Alerts generated in this occurrence

For this occurrence, 2 relevant configurable values are important. The first is the “Stage 1 Speed Limit.” If the lead target (or first aircraft) is determined to be a departing aircraft surpassing this speed (in this occurrence, 50 knots), the alert will not be generated. The second is the “Stage 1/2 Speed Sel” value. The sub-system searches for targets with a speed greater than this value (in this occurrence, 20 knots) and a positive TCPA value to generate an alert (Figure 9).

At 0949:02, while the Boeing 777 was accelerating through 20 knots ground speed, the RIMCAS began searching for stage 2 departure conflicts on the runway with targets showing a positive TCPA. At this time, the Embraer 190 was rejecting its takeoff and decelerating through 100 knots ground speed; however, it was still considered a departing aircraft, and it had a negative TCPA given that it was still travelling faster than the Boeing 777.

At 0949:12, the Boeing 777 had accelerated to 81 knots ground speed, and the Embraer 190 had decelerated to 64 knots ground speed. At this moment, the TCPA became positive because the Boeing 777 was now travelling faster than the Embraer 190. This should have triggered a stage 2 alert – departure that would have appeared on the controller’s CWP display. However, a stage 2 alert was not triggered because the MST had determined that the Embraer 190 was in air and, thus, not a conflicting target. As a result, the RIMCAS did not detect the departure conflict or generate an alert. The separation between the conflicting traffic at that point was 6500 feet.

At 0949:18, while the Boeing 777 was accelerating through 100 knots, its GBS indicated its status as in air. The Embraer 190 was also inaccurately identified by the MST as being in air because its airspeed was greater than 50 knots. Given that both the Boeing 777 and the Embraer 190 were identified as in air, the sub-system did not generate an alert.

At 0949:20, while the Embraer 190 was decelerating through 50 knots, its GBS changed its output from in air to on ground. However, the MST delayed changing the aircraft status from in air to on ground for a further 6 seconds.

At 0949:31, while the Boeing 777 was decelerating through 100 knots, its GBS changed its output from in air to on ground. However, in this case, the MST delayed changing the aircraft status from in air to on ground for a further 11 seconds.

The cause of these 2 delays within the MST was due to the “Ground speed” parameter which was set 10 knots lower than the configured take-off speed, that is to say 10 knots lower than the “Minimum speed for takeoff when GBS is OK” parameter of 50 knots.

At 0949:39, a stage 1 alert – departure was generated involving the de Havilland DHC-8 (when it taxied onto the runway) and the Embraer 190 (which was decelerating at the other end of the runway). These 2 aircraft were separated by approximately 9300 feet.

At 0949:43, while the stage 1 alert was still active, the RIMCAS generated a stage 2 alert – departure. With the Embraer 190 approaching the end of the runway and the Boeing 777 decelerating, the MST determined that both aircraft were on ground (Figure 10). These aircraft were now separated by approximately 3950 feet. The stage 2 alert – departure was visible for 2 seconds and then subsided when the next alert was generated.

Finally, at 0949:45, a stage 1 alert – departure was generated between the de Havilland DHC-8 and the Boeing 777. Both aircraft were stopped on the runway and separated by approximately 5400 feet.

1.11 Flight recorders

The aircraft were each equipped a flight data recorder. The data from both aircraft were successfully downloaded.

Both aircraft were also equipped with a cockpit voice recorder. The data from each aircraft were downloaded successfully and contained good-quality audio for the occurrence.

1.12 Wreckage and impact information

Not applicable.

1.13 Medical and pathological information

There was no indication that the performance of the controller or that of the flight crews was degraded by fatigue or any other physiological factors.

1.14 Fire

Not applicable.

1.15 Survival aspects

Not applicable.

1.16 Tests and research

1.16.1 TSB laboratory reports

The TSB completed the following laboratory report in support of this investigation:

• LP069/2020 – FDR analysis

1.17 Organizational and management information

1.17.1 NAV CANADA’s Manual of Air Traffic Services

Chapter 9 of NAV CANADA’s MATS provides fundamental guidance for controllers so that they can control and apply separation between aircraft in a safe, orderly, and expeditious manner. The MATS defines 3 basics for separation:

• planning: determine the appropriate separation minimum required
• executing: implement the selected standard
• monitoring: ensure that the planned and executed separation is maintained ^{Footnote 33}

The manual defines a loss of separation as “an occurrence in which less than the authorized minimum existed or in which the minimum was not assured.” ^{Footnote 34}

The manual provides the following instruction to controllers: “to ensure an expeditious flow of traffic, operate as closely to the prescribed minimum as circumstances permit.” ^{Footnote 35}

To ensure runway separation, the manual states,

[f]or successive departures from the same runway, a controller may authorize the second aircraft to take off, provided that one of the following applies before the second aircraft begins its take-off roll [emphasis added]:

• The first aircraft has departed and turned to clear the departure path. [...]
• The first aircraft has departed and reached a point on the departure path where it will not conflict with the second aircraft. [...] ^{Footnote 36}

Although the MATS standard states the conditions that must occur before the second aircraft starts the take-off roll, NAV CANADA has stated that the intent is for the conditions to be in place before the take-off clearance—in its entirety—is issued.

To ensure wake turbulence separation, for situations when larger aircraft are arriving or departing in front of smaller aircraft, the manual provides specific time and mileage standards. Depending on the size of aircraft requiring separation, controllers must respect these time and mileage standards to ensure safe separation.

To ensure initial instrument flight rules (IFR) separation between aircraft operating under IFR, controllers may use surveillance equipment or, when weather conditions and visibility permit, visual IFR separation or visual departure separation procedures.

Under visual departure separation procedures, 2 types of separation are possible: controller-applied and pilot-applied. The amount of separation applied by a pilot can be less than what it would be when applied by a controller. However, under these procedures and aside from situations where wake turbulence separation standards should be considered, MATS offers no time or mileage standards that controllers or pilots should follow to ensure safe separation between aircraft. When the pilot-applied visual departure separation procedure is being used, the crew of the second aircraft are expected to maintain visual separation. At the time of the occurrence, the controller had planned to coordinate the Boeing 777’s departure using pilot-applied visual departure separation procedures in order to expedite the departures.

1.17.2 Air traffic controller working environment and context

1.17.2.1 Reducing separation and optimizing flow rates

Air traffic controllers work in a dynamic, fast-paced environment. They understand that there are operational and financial pressures from commercial operators. With operating costs measured by the hour or minute, ^{Footnote 37} operators seek to conduct operations efficiently and strive to reduce wait times during ground operations. The sequencing of arriving and departing traffic requires precise timing and an understanding of aircraft performance capability on the part of the controller. To reduce separation and optimize flow rates, procedures such as the visual departure separation procedures in the MATS are implemented.

As previously explained, the intent of the departure separation procedures is that the first aircraft will be airborne before the second take-off clearance—in its entirety—is issued. In common practice, however, some techniques are in place to try and reduce separation to a minimum and to optimize flow rates. These techniques may not be specifically written or included in the MATS. One technique is for controllers to adjust their rhythm or cadence when issuing take-off or landing clearances, when instructing aircraft to taxi or line up on the runway, or when handing aircraft off to the next controller.

Controllers learn through experience to adjust the timing of their cadence between various operators and aircraft types. As they develop this experience, they learn to anticipate an aircraft’s departure run, probable rotation point, and the moment at which the nose wheel will be off the ground, which is the moment the aircraft is considered committed to fly. In doing so, controllers also learn to estimate the time required to issue a clearance, hear the clearance readback, and allow the following aircraft to begin its take-off roll. This allows them to shorten or lengthen the time required between events and to confirm that the conditions are in place. With this in mind, there is an expectation from the controllers that pilots will not commence the take-off roll until the clearance—in its entirety—is issued.

1.17.2.2 Expectations when dealing with rejected takeoffs and runway incursions

Controllers understand that there are multiple reasons why a pilot may initiate a rejected takeoff. They also understand the consequences if these rejected takeoffs are not carried out successfully. For example, controllers learn that a pilot should not initiate a rejected takeoff after the aircraft has accelerated past its V₁ speed or started its rotation for takeoff; the consequences of doing so could lead to a hazardous situation, such as a runway overrun. Controllers also learn that once an aircraft’s nose wheel has left the ground, the probability of a rejected takeoff is very low.

Finally, controllers understand the defences that are in place to prevent runway incursions, such as radio calls and RIMCAS alerts (which provide visual and aural cues). These defences provide an alert if a conflict develops or is detected. Controllers have an expectation that these defences will work and support them as they conduct their tasks.

1.18 Additional information

1.18.1 Bird strike statistics

Bird strikes are a well-known hazard in aviation. Transport Canada’s Wildlife Strikes at Canadian Airports: A 2019 Annual Report indicated that in 2019, 2536 wildlife events, including 2043 bird strikes and 176 bird near misses, were reported to Transport Canada. Of the 1339 bird strikes for which the phase of flight was reported, the majority occurred either during takeoff (39%) or landing (38%). Of the 324 events that reported the altitude at which the bird strike occurred, 34% occurred on the ground. CYYZ was 2nd on the list of the top 20 airports, with 224 wildlife strikes.^{Footnote 38},^{Footnote 39}

The 2020 annual report indicated that 1339 wildlife events, including 1093 bird strikes and 84 bird near misses, were reported to Transport Canada.^{Footnote 40} Of the 598 bird strikes for which the phase of flight was reported, the majority occurred either during takeoff (37%) or landing (38%). CYYZ was fourth on the list of the top 20 airports, with 39 wildlife strikes.^{Footnote 41}

1.18.2 Mental models and decision making

The task of controlling aircraft taking off and landing is complex and challenging and takes place in a dynamic operating environment. Mental models and decision making are key aspects of human performance involved in air traffic control.

1.18.2.1 Mental models

Mental models are cognitive structures that represent information about a system. They typically contain information about the components of a system and how those systems interact to produce various system states and events. Mental models can aid situation assessment because people recognize key features in the environment that map to key features in the mental model. This speeds up performance and reduces the load on working memory, enabling the performance of complex tasks. Mental models can circumvent the limitations of working memory and can direct attention more effectively.^{Footnote 42}

An accurate mental model of a situation is facilitated by expertise (knowledge, skill, experience, and ability).^{Footnote 43} Expertise facilitates the rapid and accurate perception of information and cues under normal conditions, as well as when such information or cues could signal a problem. Expertise also enables pattern matching to occur more rapidly between data perceived in the environment and existing mental models. This increases the ability to understand a situation and the likelihood of its various consequences, and project future outcomes. As a result, comprehension and future projections can be developed with less effort and within the constraints of working memory when accurate mental models have been developed. This simplifies the decision-making process.^{Footnote 44}

Goals are key to performance and can be thought of as ideal states an operator wishes to achieve. Goals are created by guidance and procedures (e.g. MATS departure procedures), by supervisory feedback (e.g. performance evaluations and unit statistics), by feedback in the system (e.g. expeditious and safe flow of aircraft movements and satisfied customers), and by an operator’s own performance goals (e.g. performing tasks in a safe, orderly, and expeditious manner). As well, the operator may recognize perceived data in his or her environment that will indicate a need for different plans to meet goals or a need to change the goals themselves.^{Footnote 45}

1.18.2.2 Decision making

Information processing becomes part of decision making as decisions grow more complex. Classical or normative decision-making models are focused on making rational, optimal decisions, such as buying a house, and are often characterized by slow, analytical evaluation of options and selection of the optimal choice. In comparison, behavioural and naturalistic decision-making models are focused on how decisions are made in time-sensitive, dynamic, real-world settings. These models account for human cognitive limitations and are characterized by making decisions in routine, nonanalytical ways, comparing actions in terms of expected value or utility. Research shows that professionals in real-world settings use naturalistic decision making depending on their experience, the task, and the operational context.^{Footnote 46}

Decision making, in this way, “fuses two processes: the way decision makers size up the situation to recognize which course of action makes sense, and the way they evaluate that course of action by imagining it.”^{Footnote 47} In these types of situations, decision makers recognize situations as typical and familiar, and proceed to take action. They understand what types of goals make sense, what priorities to set, which cues are important, and what to expect next, as well as typical ways to respond in given situations. By recognizing a situation as typical, they also recognize a course of action likely to succeed. This strategy of decision making is extremely efficient and is performed very quickly. Good situation assessment is critical to good decision making.^{Footnote 48}

1.18.3 Aspects of detecting a high-speed rejected takeoff

Emergencies or abnormal conditions that are unexpected can surprise operators, like controllers or pilots, especially in the performance of demanding mental tasks.^{Footnote 49} In unexpected events, operators can be startled and surprised because what happens in the environment matches neither their own mental model of the situation nor what is supposed to occur.^{Footnote 50} Furthermore, given that the attention of air traffic controllers and pilots is so focused when they perform their duties, cues must be salient enough to capture their attention.

Aural and visual cues help alert controllers of high-speed rejected takeoffs: controllers can hear a radio call from the crew, or they can see an aircraft decelerating or stopping on the runway. Automated systems (such as RIMCAS) can also provide such cues. These can include colour changes to the track labels or numerical changes in speed and altitude as the aircraft accelerates and climbs. In this occurrence, for example, the addition of an “A” and the altitude value to the Embraer 190’s track label in the A-SMGCS indicated that it was in air at 50 knots; however, this is inaccurate and can be misleading for controllers because they know an aircraft is rarely airborne at this speed.

At the time of the Embraer 190’s rejected takeoff, the controller was listening to the appropriate frequency to receive aural cues and visually scanning 4 specific locations to receive visual cues:

• The threshold of Runway 05 for landing aircraft
• The threshold of Runway 06L for aircraft in position waiting to depart
• The departure end of Runway 06L for departing aircraft
• His CWP

At the time of the occurrence, the controller had no knowledge of the bird strike or the rejected takeoff. Based on his mental model of the operating environment and what he saw outside on the runway, the controller expected the Embraer 190 to depart normally. In order to expedite the departures, he issued the take-off clearance to the Boeing 777.

1.18.4 Transponder operations

1.18.4.1 Minimum operational performance standards for transponders

The minimum performance standards for transponders are identified in the Radio Technical Commission for Aeronautics’ ^{Footnote 51} document Minimum Operational Performance Standards for Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment(DO-181 MOPS). ^{Footnote 52}, ^{Footnote 53} In the DO-181 MOPS, the in-air/on-ground status is reported in the Flight Status, Vertical Status, and Capability fields of the Mode S transponder. Aircraft with the ability to automatically determine their in-air/on-ground status (through weight-on-wheels sensors, for example) are required by the DO-181 MOPS to use this capability to determine and transmit the status.

The DO-181 MOPS also provides a standard for validating an automatically determined in-air/on-ground status to ensure that an aircraft does not continuously transmit an erroneous on-ground status. According to the DO-181 MOPS, any of the following conditions will override the Flight Status or Vertical Status fields and set them to in air:

• Ground speed greater than 100 knots
• Airspeed greater than 100 knots
• Radio altitude greater than 50 feet

If an automatic method of selecting or identifying the in-air/on-ground status is unavailable, or if such information is deemed invalid by any mechanism, the transponder shall ensure that the status is set to in air. In other words, the transponder will consider the aircraft to be in the air and broadcast data accordingly.

The DO-181 MOPS explains that the on-ground status is to “reduce unnecessary interrogation activity” of the airborne collision avoidance systems (ACAS) between nearby aircraft. The requirements for the on-ground status function to indicate a status of in-air are deliberately conservative to ensure that aircraft become visible to ACAS on board other aircraft, while avoiding unnecessary interrogation activity during operations conducted before takeoff and after landing (e.g. startup, taxi, etc.). The requirements do not intend for this function to be an accurate means by which ATS or ground surveillance systems could determine the physical position or status of the aircraft.

The DO-181 MOPS requires the on-ground status to be overridden by in air at any airspeed or ground speed above 100 knots, a conservative value that is well under the speed at which most large transport-category airplanes are capable of becoming airborne. This ensures that aircraft taking off become visible by ACAS on board nearby aircraft even if other means of detecting airborne status, such as weight-on-wheels sensors, are not functioning correctly.

The DO-181 MOPS predate systems such as A-SMGCS or RIMCAS and their intent did not include a requirement to provide air/ground transitioning data with the necessary accuracy for use by these systems while an aircraft is on the ground.

1.18.4.2 Technical standard order

In Canada, the applicable standard governing transponders in transport-category airplanes is Canadian Technical Standard Order (CAN-TSO) C112e, Air Traffic Control Radar Beacon System/Mode Select Airborne Equipment. CAN-TSO C112e is adopted from the U.S. Federal Aviation Administration’s TSO C112e. The TSO invokes the DO-181 MOPS, which includes the requirement for aircraft to determine their on-ground status if they can do so automatically.

As explained above, the standard also requires that the determined status be in air at airspeeds greater than or equal to 100 knots as a precaution and be overridden if other systems malfunction. Airspeeds of less than 100 knots are also permitted as an override threshold; therefore, a threshold of 50 knots is in compliance with this standard.

Transport Canada has confirmed that the use of the in-air status function by ATS or ground surveillance systems was not envisaged by the TSO.

1.18.4.3 Determination of an aircraft’s in-air/on-ground status

The Honeywell Primus Epic avionics suite and the Honeywell XS-857A Mode S transponder configuration exist on all of the Embraer E-Jets, of which more than 1500 have been produced. Similar configurations also exist on other aircraft types, such as Dassault and Gulfstream, though with different logic for the automated in-air/on-ground state.

As an independent device, the XS-857A transponder is fully compliant with the DO-181 MOPS. It uses an airspeed threshold of 100 knots as a validation check to bias the aircraft status to in air. This validation check ensures that the aircraft will be tracked by ATS and ACAS even with a failed automatic means to determine Flight Status or Vertical Status.

To determine the aircraft’s in-air/on-ground status, the avionics suite computer works with the transponder using:

• 3 air data computers;
• 2 utility computers (for weight-on-wheels sensors); and
• the monitor warning function (MWF) in the Primus Epic computer.

For takeoffs, the automated MWF signal will transition from on ground to in air if:

• all 3 air data computers indicate that the calibrated airspeed is above 50 knots; or
• both weight-on-wheels sensors indicate in air.

The MWF sends the automated in-air/on-ground signal to the transponder, which in turn is used as the GBS value for the RIMCAS. The MWF does not simply relay signals from the weight-on-wheels sensors; it performs its own validation check using a ground speed threshold of 50 knots. This validation check takes place before the data are sent to the XS-857A transponder so that the MWF’s 50-knot threshold pre-conditions the XS-857A transponder’s output to always transmit an in-air status whenever the aircraft’s ground speed is greater than 50 knots.

Transport Canada has confirmed that the selection of a 50-knot override threshold in the Embraer 190 may be unusually low for large transport-category aircraft, but other aircraft may have different override threshold values below 100 knots as well.

1.18.5 Simulated scenarios

1.18.5.1 Modification of the “Minimum speed for takeoff when GBS is OK” parameter in the runway incursion monitoring and conflict alert sub-system

Simulations were conducted to determine whether the RIMCAS could have generated an alert earlier in the sequence of events and to explore what would have occurred if all of the departure targets had been accurately identified as on ground for the duration of the event. For these simulated scenarios, the RIMCAS value for the “Minimum speed for takeoff when GBS is OK,” which can be configured to a value other than 50 knots, was set at 160 knots. During the simulation, the RIMCAS issued a stage 2 alert – departure at 0949:12, as soon as the TCPA became positive. This hypothetical stage 2 alert – departure was active approximately 13 seconds before the Boeing 777 initiated its rejected takeoff (Appendix A). This was 27 seconds before the RIMCAS generated the stage 1 alert and 31 seconds before the stage 2 alert.

It is important to note that although modifying the “Minimum speed for takeoff when GBS is OK” may trigger a timely RIMCAS alert, it may also inadvertently cause false alarms in other situations. This could, in turn, reduce controllers’ confidence in the sub-system. Therefore, the configuration of specific parameters remains dependent upon local on-site tuning and optimization processes that include site acceptance configuration trials and tests.

1.18.5.2 Modification of the Embraer 190’s 50-knot validation check speed

The Brazilian Aeronautical Accidents Investigation and Prevention Center conducted an examination of the occurrence Embraer 190’s in-air/on-ground status (Appendix B) and found that it would have transmitted an in-air status for approximately 50 seconds during the event. The analysis showed that even if the value had been increased to 100 knots, the aircraft would still have been inaccurately depicted as in air for approximately 19 seconds.

In this occurrence, the Embraer 190 transmitted an in-air status for approximately 52 seconds. ^{Footnote 54} Coincidently, the recording and playback sub-system logs for the occurrence depicted the Boeing 777 as in air at 100 knots for approximately 23 seconds.

1.18.6 Complex system interactions

A system can be described as interconnected component parts and how those parts work and interact together to achieve a goal. A complex system is inherently diverse, interconnected, and interactive by design. ^{Footnote 55}, ^{Footnote 56}, ^{Footnote 57} Complex systems, including transportation, medical, and energy production, are different from other systems in that they adapt to cope with the complexity and uncertainty found in the working environment and its associated operations. ^{Footnote 58} Complex systems benefit from processes, procedures, and contingencies that are flexible and applied by operators with knowledge and experience. The more complex a system, the more difficult it becomes for people to know whether they still have adequate control or not because they contain unexpected interactions and interconnections; this has safety implications. ^{Footnote 59} Complex systems can be difficult to control because these types of systems are constantly adapting to balance multiple, conflicting goals. ^{Footnote 60}

Managerial and technical systems continuously pursue optimizations that reduce costs, improve efficiencies, and maximize or minimize key values such as minimum limitations or maximum production. ^{Footnote 61} Optimizing a complex system too much, for example processes that are timed too close together or staffing complements that are too lean, increases the risk of small disruptions or breakdowns cascading into large emergencies. Sufficient slack or flexibility is needed in complex systems to give time and resources to detect and respond when minor variations in the working environment or operation take place. ^{Footnote 62}

Systems exist to provide a service or product, to achieve economic gain, or to maximize capacity utilization, and they have to do so safely. ^{Footnote 63} Goal conflicts are inherent in operational systems and are often seen in terms of production pressures and safety pressures. However,

[m]ost important goal conflicts are never made so explicit, arising rather from multiple irreconcilable directives [e.g. policies and procedures] from different levels and sources, from subtle and tacit pressures [e.g. known costs of delays creating tacit pressure to expedite], from management or customer reactions to particular trade-offs. ^{Footnote 64}

Though safety (protection) is a (stated) priority, these systems do not exist to be safe. Safety protections create a safety margin, a space to operate that can allow for the mitigation of risks but still does not produce an accident. As these systems adapt to produce, they can erode the safety margin. When a near-miss occurs, it pushes back against the production pressure, but not unusually to the original set point. With time and ongoing production goals, the safety space can be eroded. ^{Footnote 65}

Capacity–safety trade-off in a complex system, such as an air transportation network, was examined in a study looking at increasing capacity and enhancing safety. ^{Footnote 66} The study found that as the hourly flow of aircraft movements in the network increased, after a certain level, the risk of collisions increased as the number of movements crossed a designated target level of safety. The study concluded that estimating the true capacity of an air transportation network system without considering safety is very unrealistic because its maximum capacity depends on the interactions of its underlying airport and airspace networks. ^{Footnote 67}

One of the patterns through which accidents occur in complex systems is the drift into failure: the component parts interact, evolve, and adapt to new situations in ways that are not always visible or controllable, but that may cause the operations to drift into the safety margin, increasing the level of risk. Complex systems function optimally at “the edge of chaos,” which is

what is called a critical state, or, in an explicit reference to thermodynamics, a dissipative state. While poised in a critical or dissipative state, a system is not in equilibrium and can be easily perturbed. In this state, the many components that make up the complex system never quite lock into place, yet hardly ever dissolve into an entire chaos. […]

Drift into failure, in these terms, is about optimizing the system until it is perched on that edge of chaos. There, in that critical state, big, devastating responses to small perturbations become possible. Large events are within the space of possibilities. Drift doesn’t necessarily lead to failure. At least not until it does. ^{Footnote 68}

Safety and risk are viewed as dynamic aspects of the system, requiring continuous adaptation and management. System accidents result not from component failures, but from an erosion of control of safety-related constraints on the system. A complex system that experiences unchecked drift usually is successful until a small disturbance or increment pushes it outside the safety margin.

1.18.7 TSB Watchlist

The TSB Watchlist identifies the key safety issues that need to be addressed to make Canada’s transportation system even safer.

The risk of collisions from runway incursions is a Watchlist 2020 issue. As this occurrence demonstrates, runway incursions continue to occur in Canadian commercial aviation, despite the involvement of highly trained personnel, modern aircraft with advanced avionic systems, and airports with sophisticated automated runway incursion monitoring systems.

ACTIONS REQUIRED Risk of collisions from runway incursions will remain on the TSB Watchlist until the rate of runway incursions, particularly the number of high-risk incursions, demonstrates a sustained reduction; or new technology is implemented that improves safety defences. There is no single solution that can address the incursion risk nationwide. Individual solutions to previously identified hazards, in combination with wider-reaching technological advancements such as in-cockpit situational awareness aids and runway status lights, will likely be most effective.

1.19 Useful or effective investigation techniques

Not applicable.

In this occurrence, the controller and the flight crews from both aircraft held the appropriate licences and qualifications for their respective positions. Both aircraft were serviceable and the weather was not a factor.

This occurrence met the criteria for a runway incursion when the Boeing 777 flight crew complied with a take-off clearance even though the Embraer 190 was still on the runway. It is important to note that the events, from the bird strike up to the Boeing 777 flight crew initiating a rejected takeoff, all occurred very quickly—within 36 seconds.

The analysis will examine complex interactions in visual departure operations, the decision to issue a take-off clearance when another aircraft was still on the runway, and how a risk of collision occurred. Next, it will examine the bird strike, the undetected simultaneous transmissions (USiT), and how the Embraer 190’s rejected takeoff was detected. The analysis will also look at the aircraft flight statuses and the interaction between the Primus Epic’s monitor warning function (MWF) and the runway incursion monitoring and conflict alert sub-system (RIMCAS). Lastly, the analysis will examine the Boeing 777’s rejected takeoff.

2.1 Complex interactions in visual departure operations

Air traffic services (ATS), aircraft operations, and airport operations can be considered complex safety-critical systems. These systems must constantly balance the goals of production and protection, where the capacity–safety trade-off is a critical component. While there are many safety protections and defences in place in ATS and airport operations, the constant operational demands and significant financial pressures have driven this system to become highly optimized.

An example of optimization is seen in NAV CANADA’s implementation of reduced separation procedures. In an attempt to optimize departure sequences and increase flow rates, NAV CANADA and its controllers can effectively shave off several seconds between departures. Saving a few seconds per departure may seem trivial; however, airline operating costs depend on time, fuel burn, and reducing delays.

For example, if the flow rate at an airport were 30 departures per hour (1 departure every 2 minutes), and the separation timing between departures were reduced by 30 seconds, up to 15 minutes could be gained, allowing as many as 10 more departures in that same hour. These additional departures would result in significant time and financial savings for airlines and passengers. By accommodating the additional departures within that time, the system could effectively increase capacity (production). However, when unforeseen events occur, they can reduce safety (protection) and the safety margin, increasing the risk of incidents and accidents.

Chapter 9 of NAV CANADA’s Manual of Air Traffic Services (MATS) directs controllers to plan, execute, and monitor aircraft separation in a safe, orderly, and expeditious manner. The manual also instructs controllers to “operate as closely to the prescribed minimum as circumstances permit.” When departing aircraft are lined up and other aircraft arrive in quick succession it creates operational pressure, which controllers manage in the normal conduct of their duties.

As was observed in this occurrence, using pilot-applied visual departure separation procedures detailed in the MATS, controllers can reduce the initial instrument flight rules (IFR) separation between 2 aircraft to the minimum required by runway separation procedures. This reduction in initial IFR separation results in a practice that is highly optimized, with reduced time available to respond to unexpected events or disturbances.

Unlike other forms of IFR separation or wake turbulence separation, for pilot-applied visual departure separation, no time or mileage standard is required.

For successive departures from the same runway, the MATS states that controllers may authorize a second aircraft to take off, provided the first aircraft has departed before the second aircraft begins its take-off roll. NAV CANADA has stated that the intent of this procedure is that the take-off clearance should not be issued until the first aircraft has departed. However, to optimize the time between the 2 aircraft movements, controllers can begin issuing the take-off clearance to the second aircraft before the first aircraft has departed because the clearance takes a few seconds to issue and it is anticipated that the MATS departure condition will be met before the clearance is complete.

In addition to the time saved by this anticipation, the practice is often further optimized given that, although controllers generally understand the term departed to mean when the aircraft is airborne, some controllers consider this departure to have occurred at the moment the aircraft rotates.

In this occurrence, the procedures, personnel, working environment, aircraft, technology, and pressures—the component parts of the system—all interacted together, and these interactions between the component parts were complex.

During operations before the occurrence, these component parts interacted to produce highly optimized aircraft movements, including precisely timed departure sequences, reducing a backlog of aircraft departing CYYZ. When the bird strike and the USiT occurred, the system was unable to detect and respond in a timely manner to avoid a runway incursion or reduce the risk of collision, and separation was not assured. When complex operations, with highly interactive component parts, are conducted in a tightly connected manner, small disruptions or emergencies can lead to and result in situations with high risk.

2.2 Decision to issue the take-off clearance

At the time of the occurrence, the controller planned to coordinate the Boeing 777’s departure using pilot-applied visual departure separation behind the Embraer 190. He was using a rapid flow, or cadence, to be as expeditious as possible, in accordance with NAV CANADA’s MATS. He was highly experienced, was comfortable with the traffic level, and was managing the workload efficiently. The controller assessed this situation very quickly (in the span of only a few seconds), which was a normal practice. The controller made assessments based on his past experience, knowledge, and perceptions of the performance capabilities of both the Embraer 190 and the Boeing 777, including:

• perceiving the Embraer 190 at a speed at or near its rotation speed;
• perceiving the Embraer 190 in a position at or beyond a typical rotation point;
• timing the Boeing 777’s take-off clearance; and
• anticipating that the Embraer 190 would be airborne by the time the Boeing 777 flight crew read back their take-off clearance and started the take-off roll.

The controller’s expectation was very high that the Embraer 190 would depart at the controller’s assessed position and time. This expectation was reinforced by his knowledge that:

• high-speed rejected takeoffs are rare;
• aircraft do not conduct rejected takeoffs after rotation; and
• he had never in his career seen a rejected takeoff at such a high speed or from that point on the runway.

With this understanding, the monitoring stage and confirmation of action of the Embraer 190’s departure was effectively complete. Therefore, the controller transitioned to other duties, even though he did not actually see the Embraer 190 rotate. He concluded that the Embraer 190 was “rotating” based on all of the cues indicating that his assessment was correct.

The point at which the controller decided to issue the take-off clearance to the Boeing 777 was several seconds before the Embraer 190 was anticipated to be airborne. The controller’s situation assessment matched his mental model up to the point of the bird strike and the USiT. This decision was also influenced by guidance and procedures in the MATS, as well as the controller’s extensive experience.

In this case, the controller needed external cues to tell him that things were not as he had assessed. He did not hear any radio calls from the Embraer 190 and did not receive any RIMCAS alerts; therefore, the controller did not receive any contradictory cues (aural or visual) to challenge his mental model or his expectations, or alter his assessment or actions. These 2 defences failed.

As a result, the controller’s mental model and expectation were that the aircraft was rotating, which meant that it was essentially considered departed and no longer required his attention and monitoring. The controller assessed the situation as typical and familiar and identified a course of action likely to succeed, which allowed him to rapidly move on to other pressing tasks and decisions. This decision is consistent with naturalistic decision making and with the way experts make rapid and timely decisions in a dynamic environment and under time pressure. The controller timed the delivery and expected readback of the Boeing 777’s take-off clearance so that the aircraft would start its take-off roll immediately after the Embraer 190 became airborne, satisfying procedural requirements of the MATS.

2.3 Bird strike and Embraer 190’s rejected takeoff

When the Embraer 190 struck a bird on its take-off roll, the controller was issuing a take-off clearance to the Boeing 777. The Embraer 190 was travelling at 139 knots indicated airspeed (KIAS)—just below the calculated V₁ speed of 146 KIAS—at the time. The captain of the Embraer 190 initiated a rejected takeoff and the first officer transmitted a radio call, per company procedures. This whole sequence of events took 5 seconds.

2.4 Undetected simultaneous transmissions

Simultaneous transmissions are a common hazard in aviation. They pose a threat and the risk of important communications going unheard increases when these transmission signals go undetected.

The radio transmissions from the Embraer 190 and the Boeing 777 were initiated within 0.1 seconds of each other and 0.6 and 0.7 seconds, respectively, after the controller had ended his radio transmission for the Boeing 777’s take-off clearance:

• At 0948:53.4, the first officer of the Embraer 190 initiated the radio call for the rejected takeoff. This transmission lasted 3.13 seconds.
• At 0948:53.5, the first officer of the Boeing 777 initiated the readback of the take-off clearance. This transmission lasted 3.225 seconds.

The timing of these radio calls indicates a full overlap of radio signals. As a result of this USiT, neither the controller nor the flight crew of the Boeing 777 were aware of the conflict because they did not know that the Embraer 190 was conducting a rejected takeoff.

2.5 Detecting the Embraer 190’s rejected takeoff

In this occurrence, the USiT meant that no aural cue was available to alert the controller or the Boeing 777 flight crew to the rejected takeoff. Unaware of the Embraer 190's radio call to reject the takeoff, the controller carried on with his duties.

Once the Embraer 190 flight crew initiated the rejected takeoff, some visual cues were available to the controller:

• the Embraer 190 could be seen decelerating on the runway; and
• the speed values on the track label for the Embraer 190 on the controller working position (CWP) could be seen decreasing.

Because the controller was working from the north tower control position, he had to perform visual scans to monitor the thresholds of Runway 05 and Runway 06L, the departure end of Runway 06L, and the monitors at his CWP. To face either Runway 05 and the CWP or Runway 06L, he needed to turn 180°, and did so several times. This made it more difficult to visually monitor aircraft departing from Runway 06L because of the visual obstructions present when he was looking across the tower cab and out the window at Runway 06L.

Furthermore, when the controller perceived that the Embraer 190 was about to become airborne, and with no expectation that it would perform a rejected take-off at that point, he concluded that it no longer required his attention and monitoring. He then shifted his body and visual scan, and started focusing on listening to the Boeing 777’s clearance readback, monitoring an aircraft landing on Runway 05, instructing an aircraft to line up on Runway 06L, and then looking down at his CWP. Because the controller had already shifted his focus to aircraft arriving on Runway 05, his back was likely turned away and he was no longer looking at the departure end of Runway 06L and, therefore, the Embraer 190 was no longer in his field of view.

As for the monitors at this CWP, the track labels are small and it is possible that changes to an aircraft’s speed, altitude, or flight status on the track label would go unnoticed by a controller who is standing and concentrating on looking outside to control aircraft movements. In this case, the controller did not notice any changes to the speed of the Embraer 190 once it had rejected the takeoff.

Lastly, the RIMCAS was not configured to help the controller detect the conflict that occurred following the rejected takeoff and did not generate alerts (visual or aural) in time (see section 2.6.2 for analysis).

After the Boeing 777 flight crew had read back their take-off clearance, they began the take-off roll. At that moment, they were unaware of the bird strike or the Embraer 190’s rejected take-off and saw no apparent risk of collision. They could see the Embraer 190 on the runway, but had no reason to expect that it would not be airborne given that they had received their take-off clearance. In addition, because they did not hear the radio call made by the first officer of the Embraer 190, no aural cues were available to alert the Boeing 777 flight crew of the Embraer 190’s rejected takeoff.

2.6 In-air/on-ground flight status

In this occurrence, 3 aircraft were on the runway at the same time: the Embraer 190, the Boeing 777, and a de Havilland DHC-8 that was moving into position and waiting to take off. Advanced surface movement guidance and control system (A-SMGCS) alerts were generated only after both the Embraer 190 and the Boeing 777 had initiated their respective rejected takeoff procedures. The investigation examined why neither a stage 1 alert – departure nor a stage 2 alert – departure was generated earlier in the occurrence sequence of events. The following sections will discuss the system logic that contributed to the in-air/on-ground flight statuses observed in this occurrence.

2.6.1 Honeywell Primus Epic monitor warning function

The investigation determined that the Honeywell XS-857A Mode S transponder’s system logic complies with the Minimum Operational Performance Standards for Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment (DO-181 MOPS) guidance and, as designed, uses the in-air/on-ground status that it receives from the Honeywell Primus Epic’s MWF. Although the MWF system used input from the weight-on-wheels sensors, an examination of where the data came from found that the origin of the in-air/on-ground status was the logic in the MWF because the validation check used a speed of 50 knots.

The system logic in the Honeywell Primus Epic avionic suite causes the XS-857A Mode S transponder to transmit an in-air status when the indicated airspeed is greater than 50 knots, even if the aircraft is still on the ground. Although the investigation was unable to determine why the MWF was set to 50 knots, the threshold of 50 knots complies with the applicable standard and technical standard orders, was set in accordance with design requirements, and presented no issues for the operation at the time of design and certification processes in the early 2000s. The DO-181 MOPS cites 100 knots as a validation check for overriding a faulty on-ground status and accepts any value below 100 knots (including 50 knots) as valid.

Discussions with Honeywell and Embraer revealed that the 50-knot value was selected during the design and certification processes for the Embraer 190. It was most likely selected as a conservative speed value to ensure the timely interoperability of the transponder with airborne surveillance systems (such as an airborne collision avoidance system [ACAS]) before flight while the aircraft accelerates on its take-off roll. At that time (early 2000s), the DO-181 MOPS predated systems such as A-SMGCS and RIMCAS. The use of the transponder’s in-air status function for use by ground surveillance systems was not considered by the DO-181 MOPS, applicable technical standard orders, aircraft and transponder manufacturers, or other stakeholders. While this speed value complies with the applicable standard and technical standard orders and is an effective means of ensuring the timely interoperability of the transponder with airborne surveillance systems before flight, it provides inaccurate information for ground surveillance systems that need to accurately determine an aircraft’s on-ground status.

The transponders on board the Embraer 190 and the Boeing 777 functioned as designed and switched to an in-air status after the aircraft had accelerated past a speed threshold during takeoff while still on the ground, making the aircraft visible to ACAS. This is consistent with the original intent of the system.

Transport Canada has confirmed that selections of this threshold value vary and are generally selected by the aircraft manufacturer. The selection of a 50-knot override threshold found within the Embraer 190’s transponder system logic may be unusually low for large transport-category aircraft, but other aircraft may have different override threshold values below 100 knots as well.

2.6.2 Runway incursion monitoring and conflict alert sub-system alert logic

The RIMCAS is designed to monitor aircraft and vehicles and to identify and alert air traffic controllers to possible conflict situations. In this occurrence it functioned as designed; however, because the transponder transmitted an inaccurate status, the RIMCAS did not immediately detect the departure conflict and, as a result, the controller did not receive an alert until after both aircraft had conducted their rejected takeoffs.

To provide timely and accurate alerts, the RIMCAS must correctly identify a target’s status. If a target is identified as in air, it will be omitted from the targets used to detect a departure conflict. Therefore, if the RIMCAS receives or uses an inaccurate in-air/on-ground status, it might not identify vehicles or aircraft that are on the ground at critical times.

In this occurrence, at 0948:30, 3 seconds after the Embraer 190 accelerated through a ground speed of 50 knots, the A-SMGCS multi-sensor tracker (MST) accepted the aircraft’s status based on its ground bit set (GBS) value and inaccurately identified the Embraer 190 as being in air. As a result, the RIMCAS logic omitted the radar target from the departure conflict detection logic. Forty-two seconds later, when the Boeing 777 was accelerating down the runway, the criteria for a stage 2 alert – departure should have been met; however, because the Embraer 190 was still identified as being in air, the RIMCAS did not detect a departure conflict. The Boeing 777 initiated its rejected takeoff 12.5 seconds later.

The RIMCAS generated an alert regarding these 2 aircraft at 0949:43, when both the Embraer 190 and the Boeing 777 met the criteria to be identified as on ground.

The investigation determined that the RIMCAS relied on the GBS value for automated conflict detection and alerting, despite the limitations with respect to the accuracy of the data. However, the investigation was unable to determine the rationale behind the RIMCAS default values and what the full extent of the repercussions would be if the parameters were modified and the setting of the in-air status at takeoff were delayed.

The RIMCAS can be configured to overcome these limitations, but doing so may cause false alarms, which might reduce the controllers’ confidence in the sub-system.

The DO-181 MOPS recommended speed of 100 knots for the transition point from on ground to in air is beneficial to ensure the timely interoperability of an aircraft’s transponder with airborne surveillance systems before it becomes airborne. However, data inputs (such as Mode S reply messages, MWF values, or GBS values) that use a speed value may provide inaccurate data for ground surveillance systems or automated runway incursion monitoring systems, such as RIMCAS.

This investigation focused heavily on the inaccuracies found in the in-air status of the Embraer 190 and the RIMCAS. The Embraer 190 was identified as in air for approximately 52 seconds even though it remained on the ground. Simulations and an examination of flight data show that the Embraer 190 would have been identified as in air for approximately 19 seconds even if the DO-181 MOPS recommended airspeed of 100 knots had been applied.

Equally important, however, is the fact that the Boeing 777’s in-air/on-ground status was also inaccurate. The status of the Boeing 777 switched to in air at 0949:20 once it accelerated past 100 knots during its take-off roll, and remained that way for approximately 23 seconds even though the aircraft was still on the ground. Although the investigation did not examine the Boeing 777’s avionics systems or its transponder, it did determine that these systems will inaccurately identify an aircraft as in air if 100 knots is used as the standard recommended speed (in compliance with the DO-181 MOPS) and the aircraft is accelerating past that speed but is still on the ground.

In this occurrence, ground surveillance systems and automated runway incursion monitoring systems, such as RIMCAS, relied on the accuracy of the GBS value received from aircraft transponders. However, RIMCAS may make use of other available data to determine whether an aircraft is on ground or in air. As this occurrence demonstrated, the aircraft’s or transponder’s on-ground status function data were inaccurate—indicating in air when the aircraft was on ground. Using this inaccurate information, the RIMCAS made a determination that the Embraer 190 had become in air for a period of time while it was still on the runway. This same RIMCAS behaviour resulted in the controller’s display indicating the Boeing 777 was in air for 23 seconds even though it also remained on the runway during the entire occurrence. If more accurate aircraft status data are available, these systems will be better able to determine an aircraft’s on-ground status and provide accurate and timely alerts.

In addition to the inaccuracies identified above, the RIMCAS was also subject to internal latencies. As the Embraer 190’s airspeed was decelerating through 50 knots, its GBS from the multilateration system changed from in air to on ground. However, the MST delayed changing the target’s flight status for a further 6 seconds (Appendix A). ^{Footnote 69} This delay was also observed during the Boeing 777’s deceleration as the MST also delayed changing the Boeing 777’s flight status to on ground for 11 seconds. The cause of these delays in the changes to the aircraft flight status back to on ground was due to the setting of the “Ground speed” parameter within the RIMCAS, which was set 10 knots lower than the take-off speed, or the “Minimum speed for takeoff when GBS is OK,” of 50 knots. These values are set as recommended by Indra Navia AS after a local tuning and optimization process is completed with the client.

2.7 Boeing 777’s rejected takeoff

When the Boeing 777 flight crew detected that the Embraer 190 had rejected its takeoff and was decelerating on the active runway, they rejected their takeoff and significantly reduced the severity of this runway incursion. The Boeing 777 reached 133 KIAS before decelerating. At that point, the Boeing 777 and the Embraer 190 were separated by 5000 feet and that distance was decreasing.

The defences that were present included technical safety barriers (such as the use of radios and the interoperability between transponders and RIMCAS) and procedural safety barriers (such as aerodrome operating procedures, air traffic control procedures, and airline or pilot operating procedures).

A number of these defences broke down after the bird strike, the Embraer 190’s rejected takeoff, and the USiT, but 1 line of defence remained in place: the visual separation maintained by the Boeing 777 flight crew. The risk of collision was mitigated when the Boeing 777 flight crew conducted its own rejected takeoff.

3.1 Findings as to causes and contributing factors

These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence.

1. In order to achieve an expeditious flow of traffic, the controller was using pilot-applied visual departure separation procedures per NAV CANADA’s Manual of Air Traffic Services. In this occurrence, the operations conducted under the pilot-applied visual departure separation procedure were optimized to a point where separation was not assured.
2. Given the Embraer 190’s speed and position on the runway, the controller was not expecting a high-speed rejected takeoff. He assessed that the aircraft was becoming airborne and no longer required his attention and monitoring. As a result, he issued the take-off clearance to the Boeing 777 even though the Embraer 190 was still on the runway.
3. The Embraer 190 struck a bird and conducted a rejected takeoff at a critical point during its take-off roll, just before the Boeing 777 received its take-off clearance and started its own take-off roll.
4. The first officer of the Embraer 190 made a radio call reporting the rejected takeoff, but this call went undetected by the controller or the Boeing 777 flight crew as it was overlapped by the radio call from the first officer of the Boeing 777 reading back the take-off clearance. As a result, neither the controller nor the Boeing 777 flight crew were aware that the Embraer 190 was rejecting the takeoff.
5. Because the controller was expecting the Embraer 190 to take off without interruption, he shifted his attention and priority to other aircraft movements. Focus on these tasks, combined with operating from the north tower position, reduced the controller's opportunity to detect the Embraer 190’s rejected takeoff and delayed the response to the conflict.
6. The Boeing 777 flight crew visually sighted the Embraer 190, believed it would soon be airborne, and saw no apparent risk of collision; however, they were unaware that it was conducting a rejected takeoff and decelerating. Proceeding as authorized, the Boeing 777 flight crew commenced their take-off roll while the Embraer 190 was still on the runway, which resulted in a runway incursion and risk of collision.
7. The Embraer 190’s transponder transmitted that the aircraft was in air after the aircraft accelerated past 50 knots. As a result, although compliant with current standards, an inaccurate in-air status was transmitted for approximately 52 seconds while the aircraft remained on the ground during its take-off roll and rejected takeoff.
8. The runway incursion monitoring and conflict alert sub-system (RIMCAS) relies on data from aircraft systems designed to provide aircraft flight status data for use by airborne surveillance systems. The use of this data by RIMCAS led to the inaccurate identification of the Embraer 190 and the Boeing 777 as in air while these 2 aircraft were still on the ground. This resulted in late and inaccurate RIMCAS alerts and delayed the response to the risk of collision.
9. A risk of collision occurred when the accelerating Boeing 777 was travelling at 133 knots indicated airspeed and was approximately 5000 feet from the decelerating Embraer 190. The risk was mitigated once the Boeing 777 flight crew rejected their takeoff after recognizing that the Embraer 190 was still on the runway ahead of them.

3.2 Findings as to risk

These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences.

1. If the logic which determines flight status within the runway incursion monitoring and conflict alert sub-system (RIMCAS) has a latency of several seconds, the resulting delays in conflict detection increase the risk that the RIMCAS alerts will be ineffective.

4.1 Safety action taken

4.1.1 Transportation Safety Board of Canada

On 30 November 2020, the TSB issued Aviation Safety Advisory A20O0029-D1-A1 ^{Footnote 70} to highlight the importance of accurate flight status data being validated and transmitted by transponders and how this data is received, validated and used by runway monitoring and conflict alert (RMCA) systems to ensure maximum safety benefit.

The safety advisory encouraged manufacturers of aircraft transponder systems and of advanced surface movement guidance and control systems (A-SMGCSs) with RMCA systems, along with certification authorities and air traffic service providers, to work together to ensure that these systems interact effectively to transmit, receive, and validate an accurate airborne status and that alerts work as intended to reduce the risk of collisions on runways.

4.1.2 NAV CANADA

On 08 December 2020, NAV CANADA published Urgent ATCI - ATC Information Bulletin 2020-003 for all Toronto Tower personnel. The bulletin cautioned controllers that runway incursion monitoring and conflict alert sub-system (RIMCAS) stage 1 and stage 2 alerts may not be generated when Embraer E-jets and some aircraft manufactured by Dassault, Gulfstream, Learjet, and Textron Aviation (formerly Cessna) are departing. The bulletin also advised that stage 1 and stage 2 alerts may not be produced for aircraft or vehicles approaching the active runway when one of these aircraft types is departing, and reminded to monitor these situations closely.

4.1.3 Transport Canada

On 03 May 2021, Transport Canada published Civil Aviation Safety Alert (CASA) No. 2021‑03 ^{Footnote 71} to raise awareness to aircraft owners, operators, and air navigation services providers of the potential for inaccurate airborne status transmitted by transponders and its effect on runway monitoring and conflict alert (RMCA) systems.

On 20 December 2021, Transport Canada published an update to CASA No. 2021-03. The changes address potential variability of transponder airborne status thresholds, their variability from aircraft to aircraft, and how these can be adjusted by the original equipment manufacturers and not specifically the transponder manufacturers.

This report concludes the Transportation Safety Board of Canada’s investigation into this occurrence. The Board authorized the release of this report on 16 March 2022. It was officially released on 14 June 2022.

Appendix A – Graph depicting separation metrics and the time delay between the indications for the Embraer 190 from the multi-sensor tracker (line labelled MST AIR/GROUND) and from the multilateration system (line labelled MLAT GBS)

Source: TSB

Appendix B – Graph depicting the approximate time the Embraer 190 is identified as in air at 50 and 100 knots

Source: Brazilian Aeronautical Accidents Investigation and Prevention Center