CAT File No. H-1704-17
MoT File No. 5802-AA123163



Donald W. Murray, Applicant

- and -

Minister of Transport, Respondent

Aeronautics Act, R.S.C. 1985, c. A-2, s. 7.1(1)(b)

Review Determination
Samuel J. Birenbaum

Decision: March 8, 2000

I confirm the Minister's decision to suspend Mr. Donald W. Murray's airline transport pilot licence.

A Review Hearing on the above matter was held on Tuesday, February 8, 2000 at 9:00 hours at the Federal Court Building, Toronto, Ontario.


On September 12, 1998, the Applicant was pilot-in-command of an A330 aircraft, C-FBUS, flight 551, departing Belfast for Toronto. The captain had serviced the aircraft with oil prior to 16:31 departure. Shortly after take-off, abnormal oil system indicators on engine #2 appeared, causing the captain and his crew to seek advice in assessing the potential problem. In the absence of other indicators of anomaly, the captain decided to continue his flight but he downgraded its status from ETOPS (extended-range twin-engined operations) to non-ETOPS. Prior to take-off the captain had, himself, added oil to both engines. By prior arrangement, the cockpit was occupied by a Transport Canada inspector performing a routine inspection of the flight operation. The flight continued without incident, except for the need to make routing changes and pay close attention to fuel consumption, until the landing in Toronto when it was necessary to shut down the #2 engine because of a distinct warning of low pressure, as well as low quantity. Following inspection by ground crew, it was noted that the caps on the oil filler tubes for both engines were off and hanging by their safety chain. There was no engine damage to either engine and both engines were returned to service following inspection and appropriate oil servicing.

As a result of the air carrier flight inspection performed by the inspector on board, it was determined that Mr. Donald W. Murray, the Applicant, had demonstrated incompetence. The Minister determined that he no longer met the required standard for an airline transport pilot licence (ATPL) in that:

  1. He performed airline servicing for which he was not qualified; and
  2. He exercised poor judgement and airmanship in the operation of the aircraft by continuing the transoceanic flight, Skyservice 551 from Belfast, Ireland, to Toronto, Canada, without having clear indication that the #2 engine oil system was operating properly.

A number of conditions for reinstatement were made and it is noted that Mr. Murray has fulfilled all of these conditions and his ATPL certificate has been reinstated.


The first witness for the Respondent was Ms. Tricia Bischoff. At the time of the alleged incident, Ms. Bischoff was a pilot of six months' duration with Skyservice and was the flight safety officer. She undertook investigation of the events on flight Skyservice 551 and her report was introduced as Exhibit M-1. Her evidence consisted of a review of this report and its conclusions which included the following:

  1. The aircraft was flown with oil cap off on either engine after the captain had serviced them with oil.
  2. The flight crew, after consulting with maintenance, elected to continue a flight in excess of eight hours over the north Atlantic non-ETOPS.
  3. The aircraft did not provide the flight crew with the cues they were expecting, hence their situational assessment was in error. All other engine parameters, with the exception of the oil quantity and pressure, indicated that the engine was performing normally.
  4. The mechanic who was giving advice to the flight crew was under the false impression that a mechanic had serviced the aircraft oil and he did not advise the aircraft to return to Ireland (which he might have done, had he been aware that the pilot had performed the oil servicing).

In her testimony, Ms. Bischoff stated that she was aware that pilots sometimes service the oil themselves but was unaware of any rule either allowing or prohibiting this function within the company. She was unaware of what training was provided to pilots in order to enable them to perform this function. She stated that today the company forbids the pilots to service the oil at any time although they are permitted to check the security of the oil caps on the filler tubes after servicing has already been performed.

The Minister's representative then introduced Exhibit M-2, the Skyservice ETOPS transit check A-330. This is a check list designed to ensure safety of long duration flights in excess of one hour in twin engine aircraft. Item 2 on this list indicated to the pilot that since the oil quantity was below 18 quarts in both engines, that oil was to be added. However, the ETOPS check list states that the top up to a maximum of 22 quarts should be performed. If more than three quarts are required, Skyservice maintenance control must provide authorization prior to ETOPS operations. In Belfast the #1 engine read 16.8 quarts and the #2 engine 17.6 quarts. Apparently, Captain Murray told the safety officer that he had serviced the oil, adding two quarts to the #1 engine and one quart to the #2 engine. Item 3 on the ETOPS check list is engine oil filler cap check for each engine with space for two signatures. Apparently, two signatures were not obtained when the captain provided the oil service on September 12, 1998.

The witness further testified that she is, herself, a low time pilot with only six months service as safety officer. She stated that maintenance was available in Belfast but not for this particular aircraft.

On cross-examination Ms. Bischoff stated that representatives from Pratt and Whitney and Air Bus felt that the pilot and crew had made the correct decision to proceed with the flight based on the facts they had available to them, which included an XX indicator, which means an invalid signal is being received. She further agreed that there was some confusion about the ETOPS check list, as to whether this was a maintenance form or was the duty of the pilot to complete.

The next witness was Inspector Geoffrey Scott who was duly sworn. Inspector Scott, on September 12, 1998, was employed by Transport Canada as an inspector and was seated in the cockpit of flight #551 in a seat situated between that of the captain and first officer. He was performing an in-flight inspection on the aircraft and was making notes at the time of the incident. A list of the inspector's remarks on the air carrier flight inspection of Skyservice 551 (C-FBUS) on September 12, 1998 was entered in evidence as Exhibit M-3 and includes the observation that during the take-off roll at about 80 knots, the witness noticed that the #2 engine oil quantity was about two quarts lower than it had been on the ramp. By 110 to 120 knots he noted a pronounced decrease in the rate of indicated oil quantity in the #2 engine, and at rotation, the indication was 0, though this number was not flashing. Between 100 and 200 feet above ground level he drew this observation to the attention of the crew but at 1,000 feet above ground level the #2 engine oil pressure began fluctuating rapidly, between 120 and 200 PSI and he announced "oil pressure is decreasing." Within one or two seconds the engine oil pressure became "XX" in amber colour but no abnormal indication was received by the electronic centralized aircraft monitoring (ECAM). In addition, no other indicators of abnormal function were received of any of the other aircraft instruments available to the crew. There followed considerable discussion within the cockpit which included Inspector Scott, as well as between the cockpit crew and ground support personnel. The witness stated that he was not comfortable continuing the flight and felt that this feeling was not fully understood by the crew.

Ultimately, the flight proceeded on non-ETOPS procedure to Toronto Lester B. Pearson Airport where an alternate flight plan was requested. The aircraft landed with adequate but limited fuel conditions and this situation was declared to the air traffic controllers in Toronto. During the roll-out ECAM low pressure warning was triggered three or four times for periods of one to two seconds. After taxiing for about nine minutes, they shut down the #2 engine after the #2 oil quantity indication began pulsing 0. After shutdown at the gate, the Skyservice engineer discovered the #2 engine oil cap was not secured but hanging by its safety chain and subsequently it was learned that the #1 engine oil cap was in a similar condition. The witness stated on further direct questioning that it was not normal for the pilot to perform oil servicing on this aircraft and felt that the crew was not adequately trained to do so.

Section 605.85 of the Canadian Aviation Regulations (CARs) and Appendix A of the Aircraft Equipment and Maintenance Standards (Standards) were quoted and introduced as Exhibit M-4. This indicated work tasks that require the holder of an aircraft maintenance engineer (AME) licence, and those that can be performed by others who are authorized to do so by the owner. Under subsection (3) of Appendix A is the listing of elementary tasks that can be performed by those other than an AME, provided they are individually listed in the operator's maintenance control manual and/or operational manual as applicable, along with a reference to the training to be undertaken by such persons authorized to perform them.[1]

In this section no reference is made to adding oil. The list of elementary work is exhaustive in nature and if a task is not listed, it is not considered elementary work. Elementary work is a form of maintenance that is not subject to a maintenance release. Hence, it need not be performed by a holder of an AME licence. The owner is responsible for controlling authorizations to persons who may perform elementary work.[2] This concluded the testimony of Inspector Scott, and completed the evidence by the Minister's representative.

The Applicant's representative, Mr. Roland Cook, presented his first witness, Mr. Peerboom. This witness is the customer technical support person for Air Bus and has, since 1986, been a licensed mechanic for this aircraft, and an expert on its function. He was accepted as an expert witness and testified that the presence of an XX indicator plus a caution amber 0 indicate an unreliable indication which cannot be used to determine the conditions of the engine. Although there were abnormalities in the oil quantity and pressure indicators, all other indicators were normal and thus, he would conclude that the problem was in the sensors, indicating problems with the sensing instruments, rather than in the engine itself. He stated that final inspection at the Toronto airport revealed that there were 16 quarts of oil remaining within the engine, although the oil reservoir tank itself was empty. The indicators measure the oil quantity in the tank, not the quantity within the engine itself. He testified that the ECAM would not trigger a warning for low quantity but only for pressure below 70 PSI and that the XX indicator would be triggered with a pressure change exceeding 100 PSI. Thus, it is possible for the aircraft engine to have sufficient pressure within the oil system to proceed safely but not sufficient if there is a wide fluctuation in pressure, to permit a satisfactory reading on the instrument. He would not recommend shutting down an engine without an ECAM warning. Thus, it was appropriate to proceed with the flight. He testified that following maintenance on the Toronto ramp, both engines were satisfactory; oil was replaced, and caps secured. Leaving the filter caps off was in itself not a problem because there is a seal consisting of a flapper valve below the caps which would retain the pressure within the system; however, the seal on the right engine was found to be faulty. Several changes to enhance safety have now been made as a result of this incident. On cross-examination this witness stressed the importance of safety considerations in all aspects of aviation.

The next witness was Captain Murray O'Shea, the first officer on board flight 551 on September 12, 1998. Mr. O'Shea is a pilot of 21½ years with 9,300 hours of experience, including 20 years of military experience, mostly on Hercules aircraft. He is a certified pilot of the A320 and A330. In addition, he performs several management functions involving internal audits, advising on maintenance and the writing of manuals and operational documents.

On direct questioning he replied that there is nothing in the CARs that prevents a pilot from adding oil and this is discussed in pilot training. He stated that throughout the flight there was an intense consultative process in the making of all decisions. The captain consulted him as well as the inspector from Transport Canada, along with ground personnel from dispatch, and other sources. All options were considered and the combined efforts of the entire group of individuals contributed to the ultimate decision making by the pilot. In his flight planning Mr. O'Shea used data that was about 16 hours old but added 20 knots of head wind to all forecast winds and since all flight planning is based on forecasts, not on actual weather conditions, this was not unusual, nor unsafe.

On cross-examination he replied that elementary work definition did not include the addition of oil and that subsection 605.85(4) of the CARs also did not permit this procedure. On further cross-examination, this witness confirmed that the oil problem continued throughout the flight until destination in Toronto and that no emergency was declared. He further confirmed that the expected low fuel warning appeared on the approach to Toronto.

The next witness was Captain W. M. Kuilder who is a captain on the A320 and A330 with 13,000 hours and 31 years of experience including considerable military experience. In September 1998 he was the director of flight operations for the airline as well as a training captain. He testified that he taught Captain Murray the proper procedures for removing and replacing the oil filler cap in another location in Venice, where they both added oil together. He testified that the pilot is authorized to add oil and that two signatures are required to verify this act. He further testified that oil is available in the cockpit for this purpose and that he had discussed oil replenishment by pilots with maintenance crew, without receiving objections. He explained the ECAM system which monitors the aircraft and described the various levels of alert, ranging from green, amber, to red. He was unaware of any other airline company that supplied oil in the cockpit for use by the pilots. He verified that the amber indicator on the ECAM was a caution and that the XX indicator indicates an unreliable reading of the engine condition. When asked about the possibility of simultaneous indication errors in both pressure as well as in quantity of oil occurring simultaneously, he stated that this was possible. He stressed, however, that in the absence of other indicators of a problem, the unreliable indicator XX could not be interpreted as a problem.

The final witness was the Applicant, Captain Donald W. Murray, who was sworn and testified that he has 17,000 hours of experience, including nine and a half year in the air force, and ten years in civilian commercial aviation. He has 4,000 hours on the A320 and A330 and is rated as a check pilot on the A320 and a training captain on the A330. He said that in his training he was shown how to add oil. He knew where the oil was kept and how to secure a ladder to perform this manoeuvre. He has done so in the past, and on this occasion felt that he had locked the caps securely and remembers giving them a final tug until they felt secured. On arriving in Toronto, he reviewed his addition of oil to the engines and felt it was done properly, and did not feel that the problem in the readings of volume and pressure were related to difficulties with the oil cap. He testified that his interpretation of the manual provided to him indicated that XX indication means a faulty transducer only and that subsequent flickering was probably an electrical problem common to power sources of this kind. He stated that he informed Belfast air traffic control that he may need to return, but upon receiving further advice from his company experts, and after complete discussion with the two other pilots in the cockpit, decided to continue the flight. He assumed that the maintenance crew he spoke to would have called the engineers from the airbus manufacturer to obtain assistance. He stated that the advice given to him clearly indicated that he could carry on with the flight, that it was probably a transducer problem, and that his only concern should be the decision with respect to fuel availability, and deciding whether to proceed to Toronto or land at an earlier destination. He stated that his indicators showed no change throughout the eight-hour flight and only on landing did he realize that there was a further more serious problem. He felt that his training was deficient in this area.

On cross-examination he admitted that he had checked the oil in Barcelona, and the levels were not sufficient for ETOPS flight, but when checked by his ECAM unit, were quite satisfactory. He understood the ECAM report was intended for maintenance and was not the responsibility of the pilot. He stated that if the indicators noted in the air had occurred on the ground prior to take-off he would not have continued the flight. His decision to continue the flight was based on the fact that he felt that the air bus manufacturer had supplied the technical assistance and that the low pressure indicator was not corroborated by any other indicators on board. He, himself, was absolutely certain the engine was healthy because of the normal oil temperature and because of the absence of any other abnormalities. He stated the manual for the A330s states that if the oil temperature is normal the engine is probably functioning normally. His initial training was entirely on the A320 and he transitioned later to the A330. He stated on cross-examination that he would not make a different decision today although he now knows more clearly what the XX determination means. He feels that he knows how to add oil and feels competent to do so on this aircraft.


Mr. Pratt, for the Minister, referred to the reasons for suspension of the Applicant's licence.

  1. He performed aeroplane servicing for which he was not qualified, that is, oil servicing of the aircraft.

    Mr. Pratt noted that the ETOPS check list was not completed at this time, that the instruction to fill to 22 quarts on each side was not adhered to since only one and two quarts were added to left and right engines respectively and that the need to notify maintenance if over three quarts are added were also not complied with. In addition, there were no dual signatures on the check list and, thus, no one had checked the placement of the oil caps. At least one of the engineers stressed that had he known that a pilot had added the oil, he would have recommended landing at once to check the placement of the oil caps. Section 605.85 of the CARs confirms that no pilot can add oil to commercial aircraft, and that this service can only be performed by AME licensed individuals. Three days after this event the company issued a directive to all pilots advising them not to perform oil servicing of their aircraft. In any event, a pilot, whether he feels he can and has the authority to add oil, may not do so unless he is qualified for the task, and in this case it was obvious that the oil caps had not been replaced properly.
  2. That the pilot exercised poor judgement and airmanship in the operation of the aircraft by continuing the transoceanic flight Skyservice 551 from Belfast, Ireland to Toronto, Canada without having clear indication that the #2 engine oil system was operating normally.

    Mr. Pratt argued that the pilot did not know with certainty information about the oil system from the very earliest moments of the flight. This situation remained unchanged throughout the duration of the flight. The inspector on board reported abnormalities to the crew at 80 knots during the take-off, and at 1,000 feet above ground level. He argued that it would have been more prudent for the aircraft to have entered a holding pattern while attempting to sort out its problems, rather than proceeding on a long flight over water. Mr. Pratt advised that although the pilot had suffered from the loss of his licence, he nonetheless had conducted himself quite professionally in receiving adequate training, supervision, and testing sufficient to have his licence already reinstated.

In his closing argument Mr. Roland Cook for the Applicant argued that the Minister had failed to prove the burden of incompetency and that there was never a threat to safety throughout the flight. He argued that there was inadequate investigation of the facts before the suspension of the Applicant's licence, and that the Applicant had no opportunity to defend himself before the suspension went into effect. He stated that all the pilots on board supported the decision to continue and that this decision was made only after obtaining all relevant information from all possible sources on the ground as well as in the air. The pilot demonstrated excellent cockpit resource management and his decisions were based on the information known to him, and the advice given to him by the supporting staff.

The Applicant's representative then introduced Exhibit D-1, A330 FCOM Bulletin No. 04, dated March 1994 which deals with in-flight engine shutdowns, advising pilots to delay their in-flight engine shutdowns until all parameters are monitored satisfactorily. Abnormal indications require amplified guidelines for fault validation. The bulletin suggests placing engines in their idle position before a total shutdown.


All the pilots who gave evidence in this case were experienced, capable, conscientious, and appeared quite sincere in their provision of evidence. Ms. Tricia Bischoff, by her own admission, had been a flight safety officer for only six months at the time of the event and was the most junior in experience level on the aircraft in question. She produced Exhibit M-l, the report of an incident investigation, which she conducted on behalf of her company.

The report is based on information provided to her by others and consists of her own conclusions and recommendations. It would have been of greater assistance to the Tribunal if those interviewed for the production of this report were present to give their evidence first hand and if expert witnesses could have been produced to answer the direct questions that produced the conclusions therein. One can understand the difficulty and expense of providing such evidence but in the absence, I cannot grant total validity to this document.

The other evidence and exhibits appeared more reliable, particularly the evidence of Inspector Geoffrey H. Scott and his Exhibit M-3. This exhibit consists of a transcription of notes taken of his observations throughout the flight during the course of the routine inspection. His testimony confirmed that the Applicant, Donald W. Murray, had indeed personally added oil to each of the two engines prior to take-off, and that erroneous indicators appeared on his instruments. The latter required considerable in-cockpit discussion and decision making as well as consultation with ground personnel and specialist engineers on the A330. Notwithstanding the fact that the pilot-in-command was not dissuaded from his decision to continue the flight, he nonetheless was in error in accepting the risk of continuing a long flight in the absence of adequate indications of oil pressure and oil volume in the #2 engine. At the very least he might have landed at the first convenient safe airport rather than risk his flight under these conditions. The fact that both oil caps were found loosely hanging by their safety chains clearly indicates that these were not replaced properly by the last person to handle them, and that was Donald Murray. I find this failure to clearly indicate the lack of his qualifications to perform oil service on his aircraft whether he was authorized to do so or not. By his own admission he was shown this procedure on only one occasion and this was clearly not enough to ensure its safety.

In all my experience I have never been a witness to such extensive use of resource management by a pilot, and the Applicant is to be highly commended for the manner in which he conducted himself in attempting to solve the problems he faced. He used all available sources of assistance by communicating openly and clearly with everyone he needed to. Despite this fact he was unable to communicate that he, himself, had done the oil servicing prior to take-off. Had this information been communicated there would have been no doubt that the advice given him would have been the safe one of landing at the first available airport. It is regrettable that despite the extensive information gathering performed so competently by Captain Murray, he was, nonetheless, not given the correct recommendations, and he, himself, as captain, did not make the correct decision to land. The aviation industry as a whole has much to learn from this episode and I was informed in the course of the Review Hearing that changes have already been effected to ensure that there is no recurrence of this event.

From the evidence given I must conclude that the Minister acted correctly in applying suspension to the Applicant's certificate AA123163. The conditions for reinstatement were clearly explained in the letter to the Applicant, dated September 29, 1998. I find these conditions to be reasonable and in the interests of aviation safety. I understand that Mr. Murray has not only complied with these conditions of reinstatement, but has done so in an exemplary and highly professional manner. He has already received his certificate and is performing his flying duties.


I confirm the Minister's decision to suspend Mr. Donald W. Murray's airline transport pilot licence.

Dr. Samuel S. Birenbaum
Civil Aviation Tribunal

[1] amended 1999-09-01.

[2] amended 1998-09-01.