Culture + Non Compliance + Mechanical Failures = DC3 Accident
The Transportation Safety Board of Canada (TSB) recently issued a report on the forced landing of a 1942 Douglas DC-3 C-GWIR after an engine failure on 19 August 2013. The Buffalo Airways aircraft was operating a scheduled passenger flight between Yellowknife and Hay River within the Northwest Territories. Buffalo Airways has been the subject of the TV series Ice Pilots NWT.
Moments after take-off a fire developed in the right engine. The crew turned back to the airfield but the aircraft struck a stand of trees and made a wheels up landing south of the airfield 5 minutes later. Fortuitously the 3 crew and 21 passengers were uninjured.
The Investigation – Mechanical Failures
The TSB report that:
The TSB were not able to identify the source of the cylinder fatigue crack due to post failure damage and do not comment on adequacy of the maintenance programme.
The Investigation - Operational Failures
Aerossurance has recently reported on another Canadian accident where a propulsion system malfunction resulted in an accident after, in that case, an inappropriate crew response. The difference in this accident was that inappropriate actions had occurred before the engine failure, in relation to aircraft loading and performance calculations (and the lack thereof). The TSB report that:
The company procedure for maintaining accurate weight and balance data on its fleet by using calculations was ineffective. Inconsistencies between the weight and balance report at the last weighing in 1990 with subsequent amendments did not reflect actual aircraft configuration… …a complete and accurate weight and balance report was not calculated prior to takeoff. As such, the crew would not be able to determine accurately the aircraft’s performance capabilities during a normal takeoff. Additionally, the company did not have the capability to demonstrate how its aircraft could meet the CARs net take-off flight path (NTOFP) performance requirements, despite stating this requirement within its operations manual. This put the safety of flights at risk.
On this flight:
Using the applicable standard passenger weights as prescribed by the Company Operations Manual (COM), the data from the OFP and the actual cargo weight, the operational take-off weight for the occurrence flight was determined to have been 27 435 pounds, 1235 pounds over the [maximum certified take-off weight] MCTOW.
Not surprisingly, as demonstrated by an 1994 Australian DC-3 accident, in this overloaded condition, with powerplant malfunctions, climb performance was seriously degraded. Three months ago Aerossurance wrote about another loading related accident, involving a Pilatus PC-12: Wait to Weight & Balance – Lessons from a Loss of Control
The Investigation - Regulatory Oversight, SMS and Culture
Buffalo Airways had been required by Canadian regulations to have a Safety Management System since 2005, however the regulator, Transport Canada (TC), is reported to have only conducted their first SMS assessment at the operator in 2009. The TSB comment that:
SMSs are intended to promote the proactive management of risk by operators. While regulations identify the components and processes required of an SMS, the degree to which these will be effective depends on the safety culture of the organization into which they are introduced. As the collection of values and beliefs that drive individual behaviour, organizational safety culture will determine the extent to which the mandated processes and components are used. In particular, a safety culture that does not support a thriving SMS is unlikely to have effective processes for reporting hazards.
The term ‘safety culture’ was initially used in the report on the 1986 Chernobyl nuclear accident. In many ways the TSB comment supports the assertion on the difference between SMS and safety culture in this article: Beyond SMS by Evans and Parker from May 2008. Unfortunately, according to the TSB, there were:
…indications that the organizational culture at Buffalo Airways was not supportive of a system that required the organization to take a proactive role in identifying hazards and reducing risks. The company’s response to deficiencies identified during TC surveillance activities demonstrated an adversarial relationship between the company and the regulator. The company refuted the regulatory basis of findings, questioned the competence of TC inspectors, and initially did not take responsibility for the issues identified. The overall picture that emerged from this investigation is of an organization that met the basic requirements of regulations and then only when pushed by the regulator.
In particular at when submitting corrective action plans (CAPs) for a 2011 audit:
…the operator took exception to multiple findings, requesting clarification as to the regulatory basis for the deficiencies identified by TC, and explicitly questioning the competence and motivation of TC inspectors. TC rejected these initial CAPs noting that the CAP process was not the appropriate venue for “repeated diatribes against Transport Canada.” Buffalo Airways revised the CAPs and they were accepted by TC. The picture presented by the TSB review was one of an operator at odds with the regulator.
No reasons are apparent to explain why this, of four audits in the three years prior to the accident, was fractious. Nor is there any examination of the validity of the complaints. Only limited details of this 2011 audit are included, but findings are described as relating to:
When two special TC post-accident audits focusing on operational compliance matters were conducted, a number of findings relevant to the accident were identified, although it is noticeable that TC Inspectors had to use checklists reserved for operators without an SMS in order to consider operational compliance matters. The TSB comment:
While a move towards SMS has great potential to enhance safety by encouraging operators to put in place a systemic approach to proactively manage safety, the regulator must also have assurances of compliance with existing regulations, particularly for operators that have demonstrated a reluctance to exceed minimum regulatory compliance. In order to assess regulatory compliance, and hence whether risks are sufficiently mitigated, inspectors must have appropriate processes and carry out detailed inspections of actual operating procedures and practices. The current approach to regulatory oversight, which focuses on an operator’s SMS processes almost to the exclusion of verifying compliance with the regulations, is at risk of failing to address unsafe practices and conditions. If TC does not adopt a balanced approach that combines inspections for compliance with audits of safety management processes, unsafe operating practices may not be identified, thereby increasing the risk of accidents.
At a time when performance based regulation is a major topic, this accident perhaps suggests that care must be taken to identify organisations whose culture and systems are not sufficiently mature. However, it is equally apparent that with hindsight bias it could be far too easy to reactively label a culture as weak after an accident based on limited evidence. In the same way it is also very easy to identify non-compliances with the aid of insight from an accident. In practice of course the real challenge is to identify and act on weak cultures and systems prior to accidents. Despite making an issue of regulation and culture, disappointingly no actions are reported to have been taken in these areas and no recommendations are made by the TSB. UPDATE 9 September 2015: This accident was used as an SMS case study at a European Aviation Safety Agency (EASA) Workshop in Cologne. It was stated that EASA would address the lessons from this accident by:
- Phased approach
- Stakeholder involvement
- Maintain compliance backstops
- Balance the split between rules and AMCs
- Combine safety management system assessments with audits for regulatory compliance
UPDATE 25 September 2015: The airline had a further accident with a Curtis C-46 after another powerplant malfunction.
UPDATE 4 December 2015: In the case of Buffalo, it is reported that an October 2015 TC inspection turned up “deficiencies” in the airline’s operational and maintenance control systems. Buffalo are currently chartering replacement aircraft and have until 30 December 2015 to appeal the suspension.
UPDATE 25 December 2015: Rather oddly a consultant employed by Buffalo has been interviewed by the media: Buffalo Airways owner agrees to step away as airline remains grounded and Inside Buffalo Airways Suspension: What’s happening?
UPDATE 4 January 2016: It is now claimed that the company is in the process of submitting “its final correction action plan” to TC: Buffalo Airways could resume commercial flights this week
UPDATE 12 January 2016: Transport Canada reinstates Buffalo Airways’ Air Operator Certificate
Transport Canada has reinstated Buffalo Airways’ Air Operator Certificate following the approval of the company’s corrective action plans. The reinstatement is effective immediately.
Buffalo Airways’ corrective action addresses Transport Canada’s concerns regarding the company’s safety record and its ability to keep its operations consistently compliant with aviation safety regulations. Transport Canada will closely monitor Buffalo Airways to verify that its corrective action is implemented and sustained.
UPDATE 31 December 2016: Having reinstated Buffalo’s AOC, during the year TC has imposed C$25k of fines on the company, one for a “maintenance violation’, 6% of all TC civil penalties.
Further Safety Resources
Aerossurance has previously written about safety culture including:
We have also covered issues with aircraft loading:
- Inadequately Secured Cargo Caused B747F Crash at Bagram, Afghanistan
- Misloading Caused Fatal 2013 DHC-3 Accident
- Wait to Weight & Balance – Lessons from a Loss of Control
- The Passengers Who Caused a 737 Tail Strike: Ground Handling Lessons
We have also discussed other examples of possibly lax regulatory oversight in Canada and US:
- UPDATE 19 June 2016: HEMS Black Hole Accident: “Organisational, Regulatory and Oversight Deficiencies”
- UPDATE 17 July 2016: Fatal Flaws in Canadian Medevac Service
- UPDATE 19 August 2016: Canadian KA100 Fuel Exhaustion Accident This accident highlights important human factors, competence and regulatory oversight issues.
- UPDATE 24 October 2016: Execuflight Hawker 700 N237WR Akron Accident: Casual Compliance A disturbing US accident after an unstabilised approach that begs serious questions of the operator’s procedures and culture.
- UPDATE 29 October 2017: How a Cultural Norm Lead to a Fatal C208B Icing Accident
Prof Sidney Dekker comments on the danger that a Safety Management System can become a “self-referential system”: a system that just exists for itself and is a sponge for data but one from which intelligence never emerges. https://www.youtube.com/watch?v=-7WrIT6i0Ss&feature=youtu.be UPDATE 19 September 2016: It’s worth listening to Todd Conklin’s podcast interview with Prof Ed Schein. UPDATE 22 September 2016: NTSB Board Member Robert L. Sumwalt presented Lessons from the Ashes: The Critical Role of Safety Leadership to an audience in Houston, TX. Its worth noting the emphasis made of safety as a ‘value’ and of alignment across an organisation. UPDATE 16 February 2017: See also our article Consultants & Culture: The Good, the Bad and the Ugly UPDATE 31 May 2017: The US National Transportation Safety Board (NTSB) commented on the poor organisational culture and leadership after the loss of de Havilland DHC-3 Otter floatplane, N270PA in a CFIT in Alaska and the loss of 9 lives: All Aboard CFIT: Alaskan Sightseeing Fatal Flight UPDATE 22 June 2017: A Canadian Parliament Committee issued a report to the federal government with 17 recommendations, aimed at enhancing aviation safety in Canada. The Standing Committee on Transport, Infrastructure and Communities heard 47 witnesses and received 11 briefs, leading to a report with 17 safety recommendations. These included:
- That the implementation of a Safety Management System becomes mandatory for all commercial operators, including the air taxi sector.
- That Transport Canada: a. establish targets to ensure more on-site safety inspections versus Safety Management System audits; b. use poor results from Safety Management System audits (including whistleblower input) as a ‘flag’ for prioritizing on-site inspections; c. Review whistleblower policies to ensure adequate protection for people who raise safety issues to foster open, transparent and timely disclosure of safety concerns.
- That the government make sure that Safety Management Systems are accompanied by an effective, properly financed, adequately staffed system of regulatory oversight: monitoring, surveillance and enforcement supported by sufficient, appropriately trained staff.
- That Transport Canada review all training processes and training materials for civil aviation inspectors to ensure they have the resources to perform their duties effectively.
UPDATE 25 June 2017: During an air ambulance positioning flight in Iceland an Impromptu Flypast Leads to Disaster, begging more questions on organisational culture. UPDATE 7 November 2017: Running on Fumes: Fatal Canadian Helicopter Accident UPDATE 24 December 2017: The Leader’s Guide to Corporate Culture UPDATE 26 January 2018: The night the Swiss Cheese holes lined up
After nearly three months of emotional courtroom proceedings and nine days of jury deliberations, three former employees of Ed Burkhart’s now-defunct Montreal, Maine & Atlantic Railway were found not guilty of all charges arising from the 2013 Lac-Mégantic oil train disaster.
One of the best assessments of the Crown’s weak case came from Railroad Workers United (RWU). In its celebratory news release after the not guilty verdict, RWU stated, “While the prosecution focused largely on a single event —the alleged failure of the locomotive engineer to tie enough handbrakes—they were tripped up at every turn by their own witnesses—government, company, ‘expert’ and otherwise—who, by their testimony, incriminated the company and the government regulators rather than the defendants.”
On the night of the disaster, it is likely that if only one of the management decisions had been different, or if only one of the equipment conditions had not been present, the trio of railroaders would have never been in a courtroom.
The mechanical condition of lead locomotive no. 5017 leads to one the event’s many “If Only” situations:
- If only operations manager Dematrie had not dismissed the July 4, 2013 report by engineer Francois Daigle that 5017 was belching black exhaust plumes.
- If only 5017 not been rewired in a way that violated TC safety regulations.
- If only 5017 had not caught fire.
- If only an MM&A employee with air brake system knowledge had been sent to check on the train after 5017’s fire had been extinguished.
MM&A’s “generally reactive” approach to safety, rather than a proactive one, was a major construct of the shoddy safety culture identified by TSB, which also found, “There were significant gaps between the company’s operating instructions and how the work was done day to day.”
The testimony of MM&A’s former safety and training supervisor provided an unflattering portrait of MM&A management. Michael Horan was on the witness stand for six days. During one particularly rigorous cross-examination, Horan told the court he had no formal training in safety education, had no budget, and needed prior authorization to use his company credit card.
MM&A had implemented its SMS in 2002. However, TSB stated TC never audited MM&A’s SMS until 2010, and that other prior inspections showed “clear indications” the SMS was not working properly. One of those clear indications was the discovery by Canadian investigators of another improperly secured MM&A oil train on July 8, 2013, while Lac-Megantic’s downtown was still smoldering.
UPDATE 7 April 2018: Investigators Criticise Cargo Carrier’s Culture & FAA Regulation After Fatal Somatogravic LOC-I. A Shorts 360 N380MQ, operated by SkyWay Enterprises as a Part 135 flight on contract to FedEx crashed in the Caribbean after the crew likely suffered a Somatogravic Illusion raising the flaps on a dark night in 2014. The lack of an FAA SMS regulation for Part 135, the operator’s poor safety culture and implications for the wider industry culture stand out in a thoughtful accident report.
UPDATE 13 November 2018: Inadequate Maintenance, An Engine Failure and Mishandling: Crash of a USAF WC-130H: investigators discuss a strong cultural overtone in this accident that killed 9. UPDATE 13 January 2019: Pathological to Generative. Moving up the Regulation Culture Ladder with Bruce.