Aviation Investigation Report A13O0045

A Sunwing Airlines Inc. maintenance van was left unattended with the engine running and in drive gear near a company aircraft at gate H16 at Toronto–Lester B Pearson International Airport (YYZ), Ontario. The driverless van began to move from the gate area toward the threshold of Runway 24R; when it reached the center of the runway threshold, air traffic control noticed a ground radar target. Air traffic control then instructed Air Canada 178, an Embraer EMB190-100 (registration C-FLWH, serial number 19000094) on short final for Runway 24R to pull up and go around. The flight crew did not respond to the call, and air traffic control again instructed the aircraft to pull up and go around. The flight crew did not respond, and at 2339 Eastern Daylight Time flew directly overhead the van separated by approximately 35 feet, and landed on Runway 24R.

History of the vehicle

Sunwing Airlines Inc. (Sunwing) is a charter operator based at Toronto–Lester B. Pearson International Airport (CYYZ), Ontario. A large portion of the company's fleet undergoes maintenance and grooming during the evenings. Generally, these routine tasks are performed while the aircraft are parked at gates set aside for this type of operation on the east side of Terminal 1 (Figure 1).

Image

On the evening of 11 March 2013, several Sunwing maintenance staff were assigned to complete scheduled maintenance tasks. An aircraft maintenance engineer (AME) and a technician were assigned to C-FTLK, a Boeing 737-800 parked at gate H16. The maintenance staff completed their tasks at approximately 2300,^{Footnote 1} although the contracted groomers were still onboard completing their duties. The technician drove the AME back to the company facility in a maintenance van, and returned alone to the aircraft to wait for the groomers to finish their tasks. The technician parked the vehicle abeam the nose of the aircraft on the left side in an area of broken pavement and remained in the vehicle with the engine running.

Approximately 30 minutes later, the groomers began to exit the aircraft from the left-hand main door. The last groomer off the aircraft attempted to close the door but was having difficulty due to the falling rain and the weight of the door. The technician observed this, drove the vehicle a few feet forward, exited the van, and instructed the groomer to stop, indicating his intention to take care of it. The technician then attended to the ground power unit (GPU), which was on the right side of the aircraft, before boarding the aircraft to check the cockpit. When the technician eventually exited the aircraft, he noticed that the vehicle was nowhere in sight.

While the technician was inside the aircraft, the unattended vehicle, at idle and in drive gear, had begun to roll. The vehicle grazed the outer cowling of C-FTLK's left engine and continued under the wing in the direction of the threshold of Runway 24R, the active arrival runway. As the vehicle proceeded across the apron and maneuvering area, the speed varied between 1 and 5 mph, likely due to the gradual slopes in the pavement. The vehicle crossed Runway 24R perpendicularly, almost directly over the displaced threshold, continued straight across taxiway D7 and into the grass where it struck a taxiway reflector sign and became stuck. The vehicle was located 14 minutes later, with the engine running, headlights, taillights, and beacon on, and the automatic transmission in drive.

Control tower operations

As the night operation in CYYZ is not as busy compared with peak operations, control positions are often combined for efficiency. At the time of the occurrence, there were 3 air traffic controllers in the tower cab, 1 working combined north and south tower, 1 working combined north and south ground, and the other remaining in the cab for post-handover monitoring.

The ground controller monitors traffic visually from the window and on an airport surface detection equipment (ASDE) radar. The ASDE is set up to monitor the maneuvering area of the airport but does not display the aprons or gate areas in their entirety in an effort to reduce clutter.

As the Sunwing van departed from gate H16, the first 700 feet of the journey was not monitored by air traffic control (ATC) on the ASDE until the vehicle reached intersection DV. Shortly after the vehicle reached DV, the ground controller noticed an unexpected slow-moving target on the ASDE, and considered that it was possibly a false target.^{Footnote 2} The ground controller then continued with other duties for the next 2 minutes before returning to check the ASDE.

The tower controller was standing during the occurrence and moving around the tower cab as necessary to ensure visibility of both the departure and arrival runways. When the ground controller's attention returned to the ASDE display of the east side of the airport, a target was noticed on the threshold of Runway 24R. The ground controller immediately notified the tower controller who at the time was also looking at the ground controller's ASDE display. Both controllers quickly scanned the electronic flight progress strips and looked outside in an attempt to identify or confirm the target. The third controller scanned the area with binoculars; however, as the area in question is approximately 1.4 nautical miles (nm) from the tower and in darkness the view is saturated with various lights from Terminal 1, visual identification was impossible.

The tower controller, realizing that there was an aircraft on final approach for Runway 24R, clicked the push-to-talk (PTT) switch and stated, “Air Canada 178 pull up and go around, sir”. Six seconds later, having heard no response from Air Canada 178, the tower controller again pressed the PTT and instructed, “Air Canada 178 pull up and go around”.

In an effort to transmit information quickly, air traffic controllers often speak quickly, and words are sometimes elided^{Footnote 3} to make fast pronunciation easier. For example, in this occurrence, the tower controller elided the aircraft call sign^{Footnote 4} “Air Canada” to “ercana” or ”ɛrkænə”.

The controllers watched the aircraft land and watched the ASDE target disappear off the side of taxiway D7. The tower controller eventually established contact with Air Canada 178, now on the landing rollout, and asked if they had seen anything. The crew of Air Canada 178 replied that they had not. Shortly after, the controllers organized with the airport authority to have the area inspected, and the van was located in the grass.

History of the flight

The Air Canada Embraer EMB190 C-FLWH, operating as flight Air Canada 178, was inbound to CYYZ from Edmonton International (CYEG) with 5 crew and 67 passengers on board.

The aircraft was cleared for an instrument landing system (ILS) approach to Runway 24R. The airport activity was relatively slow at that time of night, and ATC had elected to use Runway 24R for arrivals and Runway 23 for departures. Air Canada 178 was following Air Canada 1126, another EMB190, which was 7 nm ahead of them, also inbound to Runway 24R.

The crew of Air Canada 178 acquired the airport visually at approximately 7 nm back on the approach, and noticed the preceding aircraft vacate the runway at approximately 5 nm.

As the crew continued the approach, they followed the standard operating procedures and sterile cockpit rules.^{Footnote 5} The approach was stable and the crew made the standard callouts as required.

Once below 500 feet above ground level (agl) on the approach, the following audio occurred in the cockpit:

The initial call from ATC instructing the aircraft to go around came almost simultaneously with the “two hundred” EGPWS callout; it went unnoticed by the flight crew.

As the aircraft reached approximately 120 feet agl, the crew heard part of a radio transmission containing the words “go around”. The crew communicated between themselves and decided that the call could not have been for them.

The crew continued the approach and the aircraft touched down on Runway 24R, approximately 1500 feet past the displaced threshold. The crew was asked by ATC if they had seen anything on the runway, and they replied that they had not.

Weather

The environmental conditions at the time were considered normal for that time of year. Visibility was 10 statute miles in light rain, the ceiling was 5200 feet agl, and winds were from 210° magnetic at 10 knots. The occurrence took place during the hours of darkness.

Flight crew

The flight crew of Air Canada 178 were fully licensed and qualified for the operation. The captain had approximately 14 500 hours of experience, including 4200 hours on the EMB190. The first officer had approximately 26 000 hours of experience, including 3000 hours on the EMB190. The 4-hour flight into CYYZ was the crew's only sector on the last day of a 4-day pairing. The crew was adequately rested having received sufficient time off duty during the pairing.

The first officer was acting as pilot flying (PF) for the sector into CYYZ, and the captain was acting as the pilot monitoring (PM).

The crew had completed numerous missed approaches and ATC instructed go-arounds during their careers, all of which were at least partially anticipated.

Aircraft technician

The Sunwing technician was a licensed AME; however, because he was employed by Sunwing as a technician, he was not allowed to sign off on maintenance tasks. The technician had been employed by Sunwing for the preceding 4 months; he had previously been employed at the airport by another operator since 2005. This evening shift was the technician's fourth shift following 4 days off duty. There was no indication fatigue was a factor.

The technician possessed a valid Airside Vehicle Operators Permit (AVOP), which had been recently renewed: the technician had completed a written and practical test 2 months before the occurrence.

Air traffic controllers

The air traffic controllers working in the tower cab during the occurrence were fully licensed and qualified for the operation.

The controller responsible for the tower position, who had been a controller at CYYZ since 2007, had worked the previous 4 days following 2 days off duty.

The controller responsible for the ground position, who had been a controller at CYYZ since 2007, had worked the previous 4 days following 2 days off duty.

There was no indication fatigue was a factor.

Aircraft

The Embraer EMB190 is a narrow-body, 97-passenger medium-range twin-engine jet operated by Air Canada since 2006.

Flying characteristics and viewing angles from the cockpit, including lighting at night, are all considered normal for a modern jetliner. Considering these factors, the vehicle, which was 8 feet tall, should have been visible to the flight crew until the aircraft was approximately 380 feet from the threshold at a radar altitude of approximately 55 feet agl, at which point it would disappear below the nose.

The aircraft is equipped with an enhanced ground proximity warning system (EGPWS), connected to the aircraft global positioning system (GPS) and the radar altimeter. The EGPWS provides aural and visual messages to alert the crew of the aircraft's proximity to the ground. During a normal approach, such as the one flown by Air Canada 178, the EGPWS makes several standard automated aural call outs, which are broadcast simultaneously over the cockpit speakers and the pilots' headsets. During post-incident simulation, it was noted by TSB investigators that the callouts were significantly louder than the radio or intercom audio, which is delivered solely to the pilots' headsets. The volume of the intercom and radio is adjustable by the flight crew, whereas the EGPWS audio is not.

The aircraft is equipped with 2 digital voice–data recorders (DVDRs), which are capable of recording 2 hours of cockpit audio. At the TSB's request, the crew of C-FLWH's subsequent flight from Toronto to Ottawa was instructed by Air Canada Operations to disconnect power to the DVDRs upon arrival in Ottawa. The flight crew was met by company maintenance staff at the gate who informed the flight crew that they would do it. The maintenance crew did not disconnect the power to the DVDRs until an hour later, and the relevant cockpit voice data was overwritten. The TSB's review of the company maintenance control manual determined that the guidance on how to perform this procedure was unclear.

Vehicle and Airside Vehicle Operators Permit

The Sunwing maintenance van was a 2007 Chevrolet Express Cargo 2500 with a 4.8 L engine and a 4-speed automatic transmission. The van was painted white, with a large Sunwing logo on both sides in blue and orange lettering.

Affixed to the roof of the van was a large aluminum work platform with a ladder running down the left side. Attached to the front left corner of the platform was an orange beacon light. The beacon was approximately 15.5 cm tall and was mounted 7 cm from a 7 cm tall skirt, which surrounds the platform. From a position 3 degrees above horizontal, similar to an approaching aircraft's perspective, the bottom 6.6 cm of the beacon would not be visible. The filament of the bulb was located 6 cm from the base (Figure 2).

Image

The beacon is designed to use a #1295 bulb, which is 37.5 W, to provide the 40 candelas specified by Transport Canada.^{Footnote 6} After the incident, it was determined that the bulb inside the occurrence beacon was only 7 W. It could not be determined why or when the incorrect bulb was installed.

The Greater Toronto Airports Authority (GTAA) has established and enforced rules regarding the operation of ground vehicles at the airport in its Airport Traffic Directives. These instruct operators parking a vehicle to shift the gear to park or neutral, apply the parking brake, and turn off the engine (in extremely cold conditions, the Directives allow, diesel engines in authorized areas may be kept running).^{Footnote 7}

Ground radar

The ASDE (airport surface detection equipment) in service at CYYZ at the time of the occurrence was installed in 1998; it contains the runway monitoring and incursion alert system (RIMCAS). RIMCAS is designed to monitor the maneuvering area and, depending on various settings, to alert the controller to potentially hazardous situations. The settings are controller-adjustable and can be different at adjacent positions.

The tower controller's RIMCAS was set to alert the controller to conflicts on arrival for Runway 24R and Runway 23, and on departure on Runway 23. Under these settings, the RIMCAS was designed to issue a stage 1 alert (an amber tag on the ASDE display) when an arriving aircraft was within 30 seconds of conflict. A stage 2 alert (a red tag on the ASDE display and an audible alarm) was intended in the design to alert the controller 9 seconds before conflict.

During this occurrence, the stage 1 alert was displayed 23 seconds before the conflict and the stage 2 alert sounded only 2 seconds before the conflict.

The RIMCAS receives data for the arriving aircraft from the terminal surveillance radar. This radar rotates at 12 rpm, which means that  the radar targets obtained from it are refreshed once every 5 seconds. In the worst case scenario, this sweep delay can cause the ASDE alerts to display and/or sound an alarm 5 seconds later than intended.

The RIMCAS alerts for arrival runways are designed to activate an alarm when the runway is assessed to be occupied and the arriving aircraft is at a fixed time from the threshold of the runway. However, for undetermined reasons, the threshold was configured in the system at 618 feet from the arrival end of the runway (the setting was input into the system prior to 2001). The displaced threshold where the conflict occurred is actually 197 feet from the end of the runway. This difference of 421 feet, at a groundspeed of approximately 120 knots, caused the alerts to activate 2 seconds later than intended.

As a result of these two delays, both RIMCAS alerts activated 7 seconds later than intended.

The ground controller's RIMCAS was set to monitor Runway 23 only and therefore the ASDE display, which was being watched by both controllers during the occurrence, did not display any alerts.

Although not as a result of this occurrence, the ASDE at CYYZ was upgraded at the end of summer 2013 to an advanced surface movement ground control system (A-SMGCS). Some of the improvements include a reduction in false targets, integration with other sensors such as vehicle tracking and multilateration, and improved RIMCAS.

Radios

The NAV CANADA Toronto air traffic control tower is equipped with several radio transmitters and receivers to operate the numerous frequencies assigned to their control. All of the frequencies assigned to the tower are digitally recorded, and the records are kept for 30 days (or longer, if required). The recordings are used for many purposes including investigations, quality assurance, controller training, and periodic evaluations of performance.

The GTAA also records all radio frequencies in use at the airport, and uses these recordings for purposes similar to NAV CANADA's. The recordings are made using separate dedicated receivers for each frequency.

Several delays are inherent in radio transmission equipment, but they are due essentially to the time that elapses between activation of the PTT (push-to-talk) switch and the broadcast of the signal at the antenna. The National Voice Communications Switch (NVCS) system in use at the tower is designed in part to minimize these delays.

A large portion of the outgoing delay is created within the transmitter: the data input captured by the NAV CANADA digital recorders is pre-transmitter, which means that everything spoken into the microphone once the PTT is pressed, except for a 5 millisecond (ms) PTT delay, is recorded. The audio which is recorded may not be broadcast in its entirety, however, because the set-up delay in the transmitter can cause up to 40 ms of it to be clipped. In the course of recent maintenance work on the NVCS system, the total outgoing delay/truncation was found to be up to 45 ms.

Similarly there are delays inherent in radio reception equipment. The audio, which arrives at the flight crew's headsets, can be slightly truncated due to the fraction of a second it takes for the auto-squelch circuit in the receiver to recognize an increased voltage on the carrier signal and amplify the audio signal before output to the headsets. Recent tests of the radio type on board Air Canada 178 showed the delay to range between 45 and 85 ms.

Because the duration of syllables is, on average, approximately 200 ms,^{Footnote 8} these combined transmitting and receiving delays/truncations of up to 130 ms are extremely minimal and virtually undetectable during normal operations. To encounter an operationally noticeable truncation, the broadcaster would have to begin speaking immediately upon PTT selection and at a very rapid pace—and even then, the truncation of a single rapidly spoken syllable may not be operationally noticeable.

The tower's digital recording of the two go-around instructions contained the spoken aircraft call sign “ɛrkænə 178”. The post-receiver recordings made at the GTAA are somewhat truncated compared with the NAV CANADA recordings, missing a small portion of the first syllable on the first transmission and the entire utterance ”ɛrkænə” on the second: the GTAA recording of the second transmission does not contain the first 126 ms of the NAV CANADA recording, and the 100 ms it took to utter “ɛrkænə” was within this 126 ms truncation.

The delays inherent in the transmitting and receiving radios used in this occurrence ranged from 90 to 130 ms; consequently, the broadcast that reached the crew of Air Canada 178 is considered to have been very similar to the one in the GTAA recording.

Human performance

Recognition-primed decision making (RPD) is a robust model^{Footnote 9} that was developed to explain how people make quick, effective decisions when faced with complex situations. Decisions are based on what is perceived about the world, which in turn is based upon what is being attended to. Individual control of attention resources is a balancing act between maintaining operational efficiency by attending to items that are expected, and being open to new or conflicting data that may challenge the operational assumptions that form the current mental model.

Decision making is usually based on the first mental model that fits the recognized data. This enables rapid decision making in situations that demand prompt responses. Attention mechanisms that encourage scanning^{Footnote 10} behaviours and identification of new data are critical to ensuring that decisions are made on the basis of the most operationally relevant mental model.

For scanning behaviour to be effective, new data must be detectable (over background noise), and recognizable. That is, the new information must be received, considered and either dismissed as irrelevant or integrated into an updated mental model of operational status. Rejection or integration of new information is a cognitive task that takes time to complete. The more difficult to detect or the more incomplete the new information is, the greater the likelihood that it will not be integrated into a new mental model.

Landing an aircraft is a high-workload context for a pilot even in situations where weather conditions are adequate and the airplane is on a stable approach. The landing phase of flight is associated with the highest risk of fatal accident.^{Footnote 11}

ATC instructed go-arounds issued below 200 feet due to an occupied runway are a rare event. Within this set, rarer still are such events where the occupying traffic is not visible to the approaching flight crew.

The combination of the naturally higher workload context of landing an aircraft, the lack of environmental and contextual cues to heighten expectation of a go-around, and clear sightlines of the runway and threshold served to bias the flight crew's expectation towards a typical, non-eventful landing.

TSB Laboratory reports

The following TSB Laboratory reports were completed, and are available on request:

• LP049/2013 - CVR Download
• LP050/2013 - FDR Analysis

The investigation determined that all of the individuals involved in the occurrence were adequately experienced, trained and licensed, and were operating without the negative effects of fatigue. Therefore, the analysis will focus on the underlying reasons that the risk of collision occurred and how the defenses in place to prevent this type of occurrence failed.

After moving the vehicle forward several feet and getting out to assist the groomer, the technician did not intend to be out of the vehicle for very long, and did not secure it as required by the Greater Toronto Airports Authority. The fact that the transmission was left in drive would normally have been noticed by vehicle movement upon exiting but the vehicle did not initially move. The surrounding noise from the rain and the ground power unit may have masked the sound of the vehicle's movement and striking of the aircraft cowling.

The vehicle was not noticed as it moved slowly across the apron. The ground controller first saw a very slow-moving unidentified airport surface detection equipment (ASDE) target shortly after its appearance on intersection DV but was unaware of the target's identity or intentions. The controller planned to monitor the target, and returned to other tasks. When attention was returned to the target 2 minutes later, the target was on the runway. The 3 controllers attempted to determine the target's identity but could not visually see the vehicle, possibly due in part to the inadequate vehicle beacon.

The ASDE in the tower was an older technology that did not have the functionality of current models. Newer ASDE's have the ability to display identity tags on surface vehicles and aircraft, allowing the controllers to positively identify radar targets. If this information had been available to the controllers, they would have been able to identify the hazard sooner.

The runway monitoring and incursion alert system incorporated within the ASDE system did not provide alerts as intended. The tower controller's display was set to monitor the runway as required, but this display was not being attended to at the time of the occurrence. The ground controller's display, which was being attended to by both controllers, was not set to provide RIMCAS warnings.

The Stage 1 visual warning appeared on the tower controller's display 23 seconds before the conflict, 7 seconds later than intended, reducing the time available for the tower controller to recognize the conflict and react. The Stage 2 visual and aural alert activated 2 seconds before the conflict, too late to provide a useful warning, and after both go-around instructions had been transmitted.

When the aircraft radios received the first go-around instruction, there was a simultaneous broadcast in the cockpit of an automated enhanced ground proximity warning system callout. The callout was louder than the received radio transmission and the transmission went unnoticed by the flight crew.

The audio delays encountered in the transmission and reception were both within the limits specified by the equipment design standard. These inherent delays are very minimal and unnoticeable in day-to-day operations because the delay normally occurs during the small amount of time between push-to-talk activation and the speaker beginning to talk.

The controller issued the second go-around instruction by pressing the push-to-talk switch and immediately talking at a rapid pace, responding to the urgency of the situation. The pronunciation of the call sign “Air Canada” was significantly elided. Due to the rapidity of speech, elision and inherent delays in the radio systems, the resultant audio, which arrived at the flight crews headsets, was devoid of the term “Air Canada”, or its elided counterpart “ɛrkænə”.

On short final to land, the flight crew had a clear view of the entire runway and was aware that the previous landing traffic had cleared the surface. The weather was adequate, the approach was stable, and radio traffic on the frequency was light. The flight crew focused their attention on the detailed task ahead and was expecting a typical non-eventful landing.

What is expected is a key factor in attention behavior and, as a result, cues that indicate that the situation is not as expected may not attract attention from anticipated tasks. The implication is that situations will appear normal or familiar unless the “out of the ordinary” is of sufficient magnitude to attract attention and subsequent analysis.

Although the crew heard a “go-around” transmission, without other supporting cues such as visually sighting an obstacle, the crew did not interpret the instruction to apply to them. Consequently, the communication was insufficient to challenge the flight crew's mental model of the situation, or their expectation of an uneventful landing.

Findings as to causes and contributing factors

1. The vehicle was left unattended in drive gear, resulting in the vehicle rolling across the active arrival runway.
2. The air traffic controllers were unable to determine the identity of the target on the ground radar and as a result were uncertain as to its intended path.
3. The airport surface detection equipment at the tower controller's position was not being monitored. When the Stage 1 runway monitoring and incursion alert system (RIMCAS) visual alert was activated, it went unnoticed.
4. The first air traffic control go around instruction was masked in the cockpit by a louder overlying enhanced ground proximity warning system automated callout, and the crew did not hear it.
5. The second ATC go-around instruction issued by the tower controller was truncated by the transmitting and receiving radios. This, in combination with a rapid speech rate and elision, caused the aircraft call sign to be absent from the received transmission.
6. Although the crew heard a “go-around” transmission, without other supporting cues such as visually sighting an obstacle, the crew did not interpret the instruction to apply to them. Consequently, the communication was insufficient to challenge the flight crew's mental model of the situation, or their expectation of an uneventful landing.
7. The RIMCAS Stage 2 aural alert was heard by the controllers 2 seconds before the conflict, which was too late to provide a useful warning.
8. The vehicle beacon did not meet the standard required for airport operations, decreasing the likelihood that it would be seen by ground personnel, the flight crew or air traffic control.
9. The flight crew did not see the vehicle and passed directly overhead, separated by approximately 35 feet, resulting in a risk of collision.

Other findings

1. The guidance provided to maintenance crews regarding the procedure to isolate the digital voice–data recorders was unclear and as a result, important data relevant to the investigation was lost.

Safety action taken

Greater Toronto Airports Authority

As a result of the incident the Greater Toronto Airports Authority (GTAA) has undertaken the following:

• Operational Directive to Secure Vehicles Airside: The GTAA issued Directive #2013-D-002; 2013-04-05 to the Toronto Pearson aviation community, reiterating the Airport Traffic Directives prohibition against leaving vehicles idling and unsecure on the airside.
• Airside vehicle beacon safety blitz: GTAA aviation safety officers undertook spot checks and airside traffic stops of any vehicle that appeared to have a weak or inoperative roof beacon, and directed drivers to have vehicle beacons repaired or replaced.
• Vehicle Beacon Illumination Standard Advisory: The GTAA issued Advisory #2013-A-012; 2013-06-06 to inform the Toronto Pearson aviation community of minimum luminosity expectations for vehicle beacons. This expanded standard will be incorporated in the next version of the Airport Traffic Directives.
• Safety management systems (SMS) incident reviews: Incidents involving inadvertent movement of unsecure vehicles are the subject of increased scrutiny and GTAA safety management systems reviews, under which subject organizations are requested to provide to the GTAA the results of investigations as well as subsequent corrective actions.

Sunwing Airlines

Sunwing Airlines reported to Transport Canada Civil Aviation that it had inspected all of its airside vehicles' rotating beacon bulbs, and that bulbs found not to meet the specifications of TP312 were replaced to meet it.

This report concludes the Transportation Safety Board's investigation into this occurrence. the Board authorized the release of this report on 21 May 2014. It was officially released on 30 July 2014.