Aviation Safety Study SA9401

The aircraft nosed down and then flipped over onto its back. The pilot escaped through the right door, but the passenger, although his seat-belt was released, failed to exit the aircraft and drowned.... Neither the pilot nor the passenger was wearing a life jacket, although they were available in the aircraft; both were wearing parkas and hip-waders.^{Footnote 1}

The Transportation Safety Board (TSB) recently completed an analysis of seaplane accidents^{Footnote 2} that occurred in Canada over the 15-year period from 1976 through 1990. During that period, there were 1,432 such accidents; and 452 people died in 234 of these accidents.

The TSB examined these 1,432 accidents in order to identify underlying safety deficiencies in seaplane operations. Using this database, the Board recently completed a safety study addressing shortcomings in piloting skills, abilities and knowledge.^{Footnote 3} This second study deals with occupant survivability in seaplane accidents.

Of the 234 fatal accidents examined, 96 (41%) occurred during the take-off phase, and 87 (37%) occurred during the approach and landing phase.^{Footnote 4} In 48% (103) of the 216 fatal accidents where the accident site was described fully in the occurrence records, the aircraft terminated in the water. Less than 10% of the 276 occupants involved in these 103 accidents escaped unhampered from these aircraft.

This study aims to advance aviation safety by identifying factors affecting occupant survivability in seaplane accidents that terminate in the water.

Information from the 103 fatal accidents that terminated in the water (resulting in 168 deaths) was examined from the point of view of impact survivability and post-impact survival.

A myriad of issues pertaining to post-crash survivability arose that could only be examined through a file-by-file examination of accident and autopsy data. Did the deaths occur predominantly as a result of impact-related forces, or as a result of post-impact drowning? To what extent were lap belts and shoulder harnesses used? Did the drownings occur in the cabin as a result of egress difficulties or did they occur outside the aircraft? Were personal flotation devices available to the occupants? If so, were they used and were they effective?

The study examines the potential for egress of the occupants in the 103 fatal accidents, the causes of death, and the use of personal restraint systems and flotation devices.

4.1 Emergency Egress

The circumstances surrounding each of the fatalities were examined to determine the location of the deaths. The fatalities occurred predominantly within the confines of the aircraft cabin.

Of the 168 occupants (including pilots and passengers) who died in the 103 accidents known to have terminated in the water, 118 (70%) were located inside the aircraft, 37 (22%) were located outside the aircraft, and 3 (2%) were found onshore.^{Footnote 5} Half of the occupants drowned while trapped in the confines of the cabin. Of the 63 pilots who died, 49 (78%) were located inside the aircraft, 10 (16%) were located outside the aircraft, and one (2%) was found onshore.^{Footnote 6}

The aircraft fuselage often buckled during impact, bending doors and door-opening mechanisms. Aircraft sometimes flipped upside-down, making it difficult to maintain situational awareness. The flaps, which are at least partially lowered on most aircraft during take-offs and landings, may have prevented egress through outward-opening exits. Disoriented occupants may have panicked as icy cold water rushed into the cabin in the seconds following impact. Some of the aircraft involved in water-impact accidents did not have a rear exit, making evacuation for the rear-seat passengers difficult. In these cases, the only egress route for passengers would have been to crawl over the front seats and through the crew door(s). Actuating a simple door-opening mechanism can become an almost impossible task in cold dark water when the aircraft cabin is vertical or upside-down. This may be compounded by the fact that the opening mechanism of some doors is not so simple (with more than one handle or lever to actuate) and few are standard.

Recognizing the difficulties of emergency egress from seaplanes in the water, following a fatal DHC-2 Beaver accident, the TSB recommended in 1992 that "the Department of Transport require that the exits of DHC-2 aircraft be marked clearly."^{Footnote 7} In response, Transport Canada (TC) issued an Airworthiness Directive requiring the inspection and rectification of door placards.

A 1988 study conducted by the Canadian Aviation Safety Board (CASB)^{Footnote 8} cited eight occurrences in which the occupants exited the aircraft successfully but drowned attempting to swim to shore. The report found evidence that "occupants sometimes drown while attempting to reach life jackets stowed in the rear of the cabin or under seats. Often the aircraft became inverted in the water, suspended by the floats. The occupants then swam to the surface whereupon one would dive back to the aircraft to retrieve the life jackets."

4.2 Causes of Death

The causes of death for the 168 fatalities (including pilots and passengers) from accidents which occurred on the water fell into four major categories as follows: 18 (11%) of the deaths occurred during impact; 17 (10%) of the occupants were incapacitated during the impact sequence from non-fatal impact forces and subsequently drowned; 113 (67%) died from drowning; and 3 (2%) died from exposure.^{Footnote 9}

When the causes of death for the pilots (63) were examined in isolation, a similar pattern emerged: 9 deaths (14%) occurred during impact; 9 pilots (14%) were incapacitated from non-fatal impact forces and subsequently drowned; 42 (67%) died from drowning; and one pilot (2%) died from exposure.^{Footnote 10}

Although only 20% of the deaths (35 persons) occurred outside the cabin, the majority (30 or 86%) of these deaths were attributed to drowning.

4.3 Personal Restraint Systems

The front of the left float touched first, and the aircraft flipped over immediately. The pilot, who was not wearing his seat-belt, sustained facial injuries on impact. There was no indication that the pilot had tried to leave the aircraft. Death was by drowning.

Several recent studies have concluded that shoulder restraints offer significantly more occupant protection than lap belts.^{Footnote 11 Footnote 12} Also, crashworthiness studies conducted in the United States and Canada during the past decades have consistently concluded that the probability of surviving impact forces is significantly enhanced if occupants of small, general aviation aircraft are protected by upper-torso restraint.

Occupants of a float aircraft may drown in a sinking aircraft if they are unconscious; loss of consciousness is normally caused by a head trauma. Passengers who are restrained and protected during the impact sequence so that they maintain consciousness stand a better chance of successfully exiting a sinking aircraft. An effective restraint system may secure the occupants of the aircraft during even cart-wheeling impact forces, better enabling them to find the exits if the aircraft comes to a stop inverted and begins sinking in the water.

In almost half of the accidents, no information regarding the availability of shoulder harnesses for the passengers was recorded. Nonetheless, where the information was recorded, 60% of the passengers did not have shoulder restraints available; of the remaining 40%, over half did not make use of available shoulder restraint systems. Although only accident data was examined, it is likely that a large proportion of the passengers of seaplanes generally do not use upper torso restraint systems, even when they are available. The scarcity of the data regarding the occupant restraint issue precluded establishing a relationship between the actual use of shoulder harnesses by passengers and successful egress.

Information concerning the use of shoulder restraints by pilots was more complete.^{Footnote 13} In 31 (62%) of the 50 cases where the data was recorded, pilots were operating aircraft that had not been equipped with shoulder harnesses. Of the 19 pilots who did have shoulder harnesses available, 13 (68%) were not using them at the time of the accident. This contrasts sharply with a finding in a 1990 study on shoulder harnesses in small commercial aircraft which indicated that "approximately 25% of shoulder harnesses are not used in aircraft in which they are fitted."^{Footnote 14} This suggests that use of shoulder harnesses in seaplane operations is much lower than the use generally in commercial operations.

Where the TSB has recorded data for the period 1976 to 1990, 58 out of 347 front-seat seaplane occupants (17%) received fatal or serious injuries when they were not restrained by a shoulder harness, whereas 8 out of 79 (10%) received the same type of injuries when an installed shoulder harness was used.^{Footnote 15}

In 59 of the fatal accidents examined, no information regarding the use or the availability of lap belts was recorded. In the accidents where such information was recorded, 42 of the occupants (95%) had lap belts available, and 38 of those 42 occupants (90%) used them. Where lap belt information was recorded, all aircraft were equipped with lap belts for the pilot, but 8% of the pilots did not use them. It was not evident why occupants almost always used lap belts, but tended not to use shoulder harnesses.

Canadian regulatory requirements for the installation and use of shoulder harnesses on land-configured aircraft are less comprehensive than the regulations of the United States and Australia.^{Footnote 16} In 1987, the CASB concluded that pilots of small aircraft had the responsibility to assist passengers in the event of an accident, and therefore should be properly restrained to avoid injury. Thus, the CASB recommended that "the Department of Transport require the installation of shoulder harnesses, where practicable, in the flight crew seats of all commercial aircraft, regardless of their date of manufacture."^{Footnote 17}

In 1988, TC acknowledged the desirability of protecting persons occupying flight crew positions by the addition of shoulder harnesses to commercial aircraft manufactured after 1978; TC also undertook to conduct a study on the feasibility of introducing legislation for the retrofit of shoulder harnesses on small aircraft manufactured before 1978. The 1990 study by Sypher: Mueller^{Footnote 18} recommended that all small commercial aeroplanes be fitted with shoulder harnesses in the front seats within five years.

After a floatplane accident in which all the occupants received incapacitating head injuries, the TSB recommended that "the Department of Transport expedite legislation to require the use of a seat-belt and shoulder harness during take-off and landing of small, commercial fixed-wing aircraft."^{Footnote 19} An amendment to Air Navigation Order (ANO) Series II, No. 2, the Aircraft Seats, Safety Belts and Safety Harnesses Order, appeared in Part I of the Canada Gazette on 1 January 1994. The amendment changes regulatory requirements regarding seat-belt and shoulder harness installation and use for flight crew on board small commercial fixed-wing aircraft; it addresses most of the TSB's concerns in that regard. Publication in Part I is for consultation purposes only; there is no certainty that the ANO amendment will come into force.

4.4 Personal Flotation Devices

Perhaps the most significant (and intuitively obvious) difference in cause of death in seaplanes compared to landplanes is the frequency of drowning. As shown earlier, only 11% of the fatalities in the seaplane accidents terminating in the water were attributable to the impact forces. The majority of the victims survived the impact but subsequently drowned. Had these accidents occurred on land, a large percentage of them might have been non-fatal.^{Footnote 20}

The majority of those who drowned were trapped in the aircraft. However, drowning was also the most common cause of death (86%) of those who exited the aircraft. Personal flotation devices would probably have saved the lives of many who drowned outside the aircraft.

The Air Navigation Order titled the Life-Saving Equipment Order (ANO Series II, No. 8) specifies that one life jacket for each person on board must be carried on board seaplanes and specifies the standards that the life jackets must meet. Section 5(1) of the Life-Saving Equipment Order states that:

... every life jacket required to be carried on board an aircraft ... shall be stowed in such a manner as to be easily accessible to the person for whose use it is intended.

There are two types of life jackets: inflatable and non-inflatable. The inflatable type is less bulky and can easily be stowed under a seat or can be worn by the seaplane occupant during take-off and landing; it is also more expensive than the non-inflatable type and more subject to critical damage (punctures) if left unprotected. Non-inflatable jackets are commonly used on board ships, but they do not meet Technical Standards Orders C13C which is incorporated by reference in the Air Navigation Order Series II, No. 8. New types of life jackets which incorporate new technology fabrics, multi-layer concepts and adjustable securing harnesses are coming on the market. Some of the newer models can be worn permanently for extended periods of time and are damage resistant so that they can be worn in the work environment (by jetty staff, for example).

The 1988 CASB Study^{Footnote 21} considered the implications of the language of the Life-Saving Equipment Order, cited above. The Board believed that while life jackets might have been accessible (i.e. they were carried on board the aircraft in a location where there was no physical barrier restricting access to them by occupants in an upright aircraft), they often were not readily available to the occupants after an accident. The circumstances of many accidents occurring on water do not permit passengers to locate and don life jackets stored in the rear of the aircraft. This is particularly true if the aircraft is inverted, or otherwise submerged or partially submerged. For these reasons, the CASB recommended that life jackets on float aircraft be stowed so as to be easily accessible to each seated passenger, and that the wearing of life jackets when operating on or near the water be made mandatory for float operations.^{Footnote 22}

In 1989, TC drafted a revised Air Navigation Order Series II, No. 8 that incorporated the recommendations regarding the accessibility of life jackets stemming from its study on life-saving equipment. However, the draft did not include the mandatory wearing of a life jacket during take-off and landing on water. In 1992, in the Osprey Wings DHC-2 floatplane accident report (91C0122), the TSB restated its concern regarding the inadequacy of the regulations governing the stowage and wearing of life jacket on floatplanes. To date, no significant change to the regulations has been promulgated.

A file by file examination was conducted to assess the availability and use of life jackets. Information about the availability of life jackets was not recorded for 67% of the fatalities. Of the 55 fatalities for which information was available, 47 occurred on board aircraft which were carrying life jackets. It was found that 32 of the 47 occupants for whom life jackets were available did not use them.

There is no conclusive evidence as to why the life jackets were not used when they were available. In fatal accidents, life jackets may not have been used because they could not be found, reached or donned. Unfortunately, data for non-fatal accidents, indicating whether the survivors had difficulty locating, donning or using their life jackets, have not been systematically captured. However, there is both intuitive and anecdotal evidence that accessibility is a factor. For example, one reporter to the Confidential Aviation Safety Reporting Program (CASRP) wrote:

In the case of the Norseman that flipped over in high winds, the pilot reported that the only problem he had was getting a life vest. After he was in the water he had to cut the bag to get at the life jacket... I had to use a life vest and found the hardest part was trying to get the damn thing on in a Beech 18... Most of the cases in seaplanes, you do not have time before hand to get one on... I have my pilots hang life vests out of the bags behind their two front seats; but this does not solve the problem... If the Regs stated that all flight crew wear life vests, I for one would welcome it.

The instinct of persons in an inverted cabin of an aircraft that is sinking in cold dark water is to get out as soon as possible, without fumbling for a life jacket. If they were wearing a life jacket and managed to find an open exit without the egress being hampered by clothes or the life jacket, then their chances of survival would be considerably enhanced by the personal flotation device. A videotape produced by TC, Aviation (Central Region) demonstrates that it is almost impossible for even a healthy person in a controlled test environment to don a life jacket in cold water. This demonstration tends to support the 1988 CASB study^{Footnote 23} which found not a single instance in which the occupants donned life jackets after the accident and prior to evacuating the aircraft.

It is often difficult, after a fatal accident, to determine the role that personal flotation devices might have played. In many of the otherwise survivable fatal accidents, the occupants may not have gotten out of the aircraft due to a combination of impact injuries, confusion, and panic. In any event, life jackets for seaplane occupants can undoubtedly best serve their purpose if:

• they are worn during take-off and landing;
• they do not hamper the movements of the wearer because of their size and configuration; and
• they do not provide flotation until activated by the wearer.

4.5 Passenger Briefings

The pilot had advised his passengers not to wear seat-belts; he believed that seat-belts would hamper the chances of escape should the aircraft overturn during the take-off or landing phase of flight.

As suggested earlier, passengers may have had difficulty locating their life jacket and operating the aircraft's exit mechanisms. For commercial operations, ANO Series VII, No. 3 states that an "air carrier shall provide every passenger aboard any aeroplane operated by him at the place where such passenger is seated information respecting the emergency equipment and exits on that aeroplane." Section 6 of the Life-Saving Equipment Order (ANO Series II, No. 8) states that "No person shall fly an aircraft en route over water ... unless, prior to commencing the over water portion of the flight, all passengers are informed of the location and method of use of the life-saving equipment carried for their use." As discussed in the CASB's 1988 study, this regulatory focus on the "en route" phase is not understood--particularly since most accidents occur during the take-off, and approach and landing phases.

The regulatory requirements for commercial operations are quite extensive. However, effective fulfilment of the Life-Saving Equipment Order is dependent upon interpretation. Section 6 appears to require a demonstration of the life jacket, as is customary in large passenger aircraft, but the wording of the regulation is not clear in this respect. Legally, information regarding the location and use of exits and emergency equipment can be provided without a demonstration. Although a pictorial presentation on a safety card or on a placard can serve the purpose, the Board believes that a demonstration would be more effective, particularly when the actuating mechanisms for doors, windows and emergency exits are complex or non-standard.

4.6 Cabin Loading

The aircraft overturned sometime after landing, most likely due to wind and sea conditions. The unsecured cargo would have hindered the pilot's attempt to escape from the overturned aircraft.

Section 218 of the Air Regulations states that "no person shall fly or attempt to fly any aircraft unless ... the equipment and any cargo carried are secured so as to prevent shifting in flight and are not so placed as to block or restrict the exit of passengers in an emergency."

The accident record for the study period indicates that "shifted cargo" and "improperly secured load" were recorded as contributing factors in only four accidents, one of which was fatal. In two of these recorded cases, egress was prevented either because the internal load shifted during the crash sequence, or because the load had been placed in front of an exit, preventing the exit's use; i.e. the Regulations had not been followed.

Although the fatal accident record provides little conclusive evidence that unsecured cargo or baggage is a systemic safety issue, a TSB survey conducted in 1991 indicated that a quarter of the respondents either usually, almost always or always flew with unrestrained cargo. Also, 14% of the respondents answered that there were seldom or never adequate tie-down points and restraints to satisfactorily restrain cargo or baggage in the event of a forced landing or emergency procedures.^{Footnote 24}

There are also indications of a safety deficiency regarding improperly stored cargo in reports to the CASRP as one reporter to the CASRP wrote:

...overloading of the B-18 sometimes by 1000 lbs... so that there is no exit out of the rear door. [There is] no pilot door. If there was a crash, [the] pilots would be trapped inside and no way out... Overloads in the north are a common thing, especially on floats, but there is no excuse for a captain or owner-pilot who overloads a twin. He is endangering not only himself but also the people in the small villages and reserves. Also the co-pilots are forced to be under these dangerous conditions and some of these guys are too young or inexperienced to say no.

The extent to which there was unrestrained internal cargo or baggage in the accident aircraft might explain why many occupants failed to exit aircraft involved in survivable accidents.

Fatalities in seaplane accidents terminating in the water are frequently the result of post-impact drownings. Most drownings occur inside the cabin of the aircraft. Most survivors who were able to exit the aircraft experienced some difficulty in doing so. The similarity of the location and causes of death for the pilots and the other occupants indicates that all occupants were similarly at risk during, and particularly after, an accident on water.

The causes of death underscore the hazard of operating aircraft from the water's surface. Relatively few of the deaths in seaplane accidents on the water occurred during the impact sequence. However, those who survived often encountered difficulty in exiting the aircraft. Over two-thirds of the fatalities occurred when occupants who were not incapacitated during the impact drowned. Of the occupants who successfully exited the aircraft and subsequently died (one fifth of all fatalities in the water), almost all died as a result of drowning rather than from impact-related injuries.

Failure to successfully exit a sinking aircraft is common for persons who suffer a trauma sustained because of a lack of appropriate restraint at the time of the accident. Yet, few occupants of seaplanes involved in water-accidents had taken advantage of available upper-torso restraint. Even pilots, who are more aware of the importance of being adequately restrained during an accident, and who are responsible for assisting survivors to exit the stricken aircraft after an accident, were often not using the shoulder harnesses that were available.

Because of limitations of the accident data, little is known about the role life jackets could have played in survivability. Nevertheless, the accident evidence continues to support the thrust of the recommendations made in the CASB's 1988 study--most of which have not been satisfactorily implemented.

While it is not clear why many occupants of seaplanes involved in survivable accidents fail to safely egress, a good understanding of the location and operation of emergency exits, emergency equipment and life jackets may be essential to survivability.

Industry practices with respect to flying with unrestrained cargo may be exacerbating the consequences of upset on the water by trapping occupants in the cabin.

6.1 Personal Flotation Devices

In view of the continuing vulnerability of the occupants of seaplanes in accidents on the water to drowning, and since nearly four-fifths of fatal seaplane accidents which terminated in the water occurred during the take-off or the approach and landing phase, the Board, having considered advances in permanent wear, damage resistant, inflatable life-jackets, recommends that:

The Department of Transport require that all occupants of seaplanes wear a personal flotation device during the standing, taxiing, take-off, and approach and landing phases of flight.

A94-07

6.2 Personal Restraint Systems

Although the majority of fatal seaplane accidents in the water involve drowning, approximately one-tenth of these victims were incapacitated from non-fatal impact forces. The availability and use of personal restraint systems could have facilitated a successful egress for many of these victims.

The amendment to ANO Series II, No. 2^{Footnote 25}, which would require the fitment of seat-belts and shoulder harnesses and their use by flight crews on board small commercial fixed wing aircraft, has not been promulgated. Consequently, a significant proportion of Canadian seaplanes (most of which were manufactured before 1978) continue to operate without shoulder harnesses available--even for the flight crew. Given that the 1990 Sypher: Mueller study^{Footnote 26} estimated that the front seats of aeroplanes could be retrofitted with shoulder harnesses for approximately $2,000, the Board does not understand TC's apparent reluctance to require retrofit.

In view of the vulnerability of seaplane pilots to drowning following non-fatal accident impact forces, the Board recommends that:

The Department of Transport require the fitment of lap belts and shoulder harnesses in seaplanes and require their use by all pilots during take-offs and landings before the 1995 seaplane season begins.

A94-08

6.3 Compliance

The accident record seriously draws into question the attitude of some seaplane pilots towards basic safety measures. Even when shoulder harnesses were fitted in the aircraft, two-thirds of the accident pilots were not using them; some of them did not even secure the lap belt. Only half of the accident passengers who had shoulder harnesses available wore them--perhaps a reflection of the example set by their pilots. Similarly, despite the availability of life jackets on many of the accident aircraft, apparently few occupants wore them, or had a personal flotation device sufficiently close to use.

The Board recognizes that more stringent regulations alone will not alter current behaviour patterns which exacerbate the fatality rate. Furthermore, enforcement of regulations pertaining to seaplane operations in Canada presents a formidable challenge on a day-to-day basis. Nevertheless, in view of the continuing disregard of basic safety provisions by many pilots and operators in seaplane operations, the Board recommends that:

The Department of Transport implement a national safety awareness program, promoting the use of personal restraint systems and personal flotation devices in seaplane operations as soon as practicable; and

A94-09

The Department of Transport investigate options for imposing strong sanctions on owners and operators who flagrantly disregard the basic tenets of safety in seaplane operations, and make public its findings within one year of the receipt of these recommendations.

A94-10

6.4 Passenger Briefings

Many of the occupants of the accident aircraft were not experienced in seaplane operations. Often they were fare-paying passengers who were unfamiliar with the aircraft, its personal restraint systems, its life-support equipment, emergency egress routes, etc. These passengers could have benefitted from a pre-flight briefing prior to the take-off or landing on water. The provision of such safety briefings was recommended in the 1988 CASB study;^{Footnote 27} but regrettably, the recommendation has not been satisfactorily implemented.

In order to improve the survival of passengers in the event of a seaplane accident, the Board recommends that:

The Department of Transport establish and promote specific pre-flight briefing requirements for passengers for commercial seaplane operations from or to water.

A94-11

Again, the Board recognizes the difficulty of enforcing such a requirement. Whereas a TC inspector cannot be omni-present, perhaps the fare-paying passengers themselves can be better informed regarding seaplane safety and encouraged to report unsafe practices to TC; e.g. inadequacy of passenger briefing, non-availability of personal restraint systems and personal flotation devices, excessive or improperly secured cargo, etc. Therefore, the Board recommends that:

The Department of Transport provide all commercial seaplane operators with safety information brochures, including procedures for reporting unsafe operating practices, to be made available to all fare-paying passengers.

A94-12

Appendix A — Phase of operations

(NOTE: The following definitions are extracted from the ICAO Definitions manual (Doc 9569) or the ICAO ADREP manual. In certain cases, the definitions are complemented by explanations mostly based on information obtained from various parts of these manuals.)

TAXIING: Movement of an aircraft on the surface of an aerodrome under its own power, excluding take-off and landing, but including, in the case of helicopters, operation over the surface of an aerodrome within a height band associated with ground effect and at speed associated with taxiing, i.e. air-taxiing.

TAKE-OFF PHASE: The operating phase defined by the time during which the engine is operated at the rated output.

EN-ROUTE PHASE: The part of the flight from the end of the take-off and initial climb phase to the commencement of the approach and landing phase.

APPROACH PHASE: The operating phase defined by the time during which the engine is operated in the approach operating mode.

(NOTE: This definition is ambiguous because it is unclear what is meant by "the approach operating mode" of an engine; jet engines, in particular, are not operated in a different mode during the en-route and approach/landing phases. The new coding for the phases of operation sheds some light on this matter: "approach" includes holding (in the process of completing an approach), intermediate approach (from first fix to final approach), final approach, circuit pattern and missed approach/go-around.

LANDING: Landing is not defined in the ICAO Definitions. As stated before, it is not a phase on its own as it accompanies "approach" to make the "approach and landing phase." The new coding, under "landing," lists level off/touchdown, landing roll, aborted landing (after touchdown) and other.