2014 OHSTC 7
Case Nos.: 2010-40 & 2010-41
Aquiles Vergara, Olivier Waché and Catherine Caron, Appellants
Air Canada, Respondent
Indexed as: Vergara, Waché and Caron v. Air Canada
Matter: Appeals under subsection 129(7) of the Canada Labour Code against decisions issued by a health and safety officer
Decision: The decisions are rescinded
Decision rendered by: Mr. Jean-Pierre Aubre, Appeals Officer
Language of decision: English
For the Appellants: Mr. James Robbins, Cavalluzzo Shilton McIntyre & Cornish LLP, Barristers & Solicitors
For the Respondent: Mr. Stephen Bird, Bird Richard, Lawyers for Employers
Citation: 2014 OHSTC 7
 The following decision concerns appeals brought under subsection 129(7) of the Canada Labour Code (the Code) against decisions of absence of danger issued by Health and Safety Officer (HSO) Mary Pollock on September 28, 2010, relative to refusal to work action on September 14, 2010, by three Air Canada employees assigned, as cabin crew (flight attendant), to man Air Canada flight AC362 from Toronto to Boston, using an Embraer 175 aircraft identified as FIN #380.
 One of those refusing employees, Mr. Aquiles Vergara, was to act as Service Director on that flight with flight attendant Mr. Olivier Waché. HSO Pollock’s investigation report specifies that as Service Director, Mr. Vergara’s duties and responsibilities consisted in ensuring safety of the cabin, overseeing the work of a flight attendant, ensuring passenger safety and providing service to passengers. Following Mr. Vergara’s refusal, another employee was called in as a replacement Service Director for the same flight. When apprised of the reasons for the Vergara and Waché work refusals, the said replacement employee/Service Director, Ms. Catherine Caron, also exercised her right of refusal. In addition to the cabin crew, that flight was to be operated by a flight deck crew of two pilots, a captain and a first officer, there being no evidence that there was to be another person on the flight deck during the said flight. The appeals by the three employees have been consolidated for the purpose of hearing and decision.
 As can be derived mostly from the HSO investigation report as well as her testimony at the hearing, all three refusals were centered on the single fact that on that day and for that particular flight, Fin #380 had an inoperative Cockpit Security Door Automatic Locking System (ALS), such system being designed, following the events of September 11, 2001 [text redacted].
 The HSO report shows that refusing employee Aquiles Vergara raised a number of aspects to the danger being invoked, that being summarized by the HSO in the following manner: [text redacted] there is no way for the cabin crew (flight attendants) to follow our SOP’s (sic) (Standard Operating Procedures) [text redacted]. Therefore the danger is existent and it’s not safe to operate this flight.”
 In all three cases, the employer offered the same reply to the refusing employees to wit, that the flight could proceed as scheduled since under the Minimum Equipment List (MEL) provisions recognized by Transport Canada, the aircraft could fly with an inoperative cockpit door automatic locking mechanism and as deferred, the aircraft operator had two flight days under the said MEL to have the proper repairs done.
 HSO Pollock is a civil aviation occupational health and safety officer in the service of Transport Canada. Prior to joining Transport Canada, she was an airline employee for 27 years working successively as a flight attendant, service director, base manager and training manager. She joined Transport Canada as cabin standard inspector and transferred to airline inspection in 1995. In 2008, when the cabin inspectorate merged with aviation OSH, she became a health and safety officer. She is trained in aviation occupational health and safety and has received Transport’s recurrent training (2 years) on aviation OSH, including the Code, the recent Aviation OSH Regulations as well as RCMP levels 1 and 2 investigator’s training.
 Given the sensitive nature of some of the information gathered by the HSO and the need for ensuring that it be protected, a request was made to the undersigned and agreed to by both parties that HSO Pollock would be provided with legal representation for her testimony at the hearing. This explains the rather exceptional listing of Mr. Sid Restall as counsel representing HSO Pollock. It is important to note however that Mr. Restall’s role and participation were strictly limited to the testimony of the HSO and the protection of the documentation gathered and used by the HSO in arriving at her decision. The factual elements that based HSO Pollock’s decision of no danger in all three cases can be drawn from her investigation report as well as her testimony at the hearing. In point form, they are the following:
- the Embraer 175 aircraft involved in these three refusals to work (Fin #380) is certified to Transport Canada Regulations;
- the Minimum Equipment List is approved by Transport Canada and the Embraer 175 aircraft was operating under its requirements;
- on September 14, 2010, the aircraft Cockpit Security Automatic Latching System on Fin #380 was inoperative as it had been deactivated by Air Canada maintenance;
- where equipment onboard an aircraft is inoperative, the Flight Attendant Manual and the Flight Operations Manual (FOM) establish procedures that require a pre-flight briefing between the pilot and the service director in order to establish alternate procedures and modes of communication. In her testimony at the hearing, HSO Pollock made mention of this requirement but did not indicate whether such pre-flight briefing intended at defining alternative security measures, communications and procedures for operating the flight without a functioning ALS had occurred. [Text redacted];
- [text redacted]. In her testimony, HSO Pollock referred to Operations Procedures under the MEL requirements [text redacted];
- [text redacted];
- under the approved Flight Attendant Training Program, procedures concerning the use of the flight deck door are taught and those had been taught in the cases at hand. Furthermore, the training records of the employees involved in the present cases showed that all crew members had been trained on the Embraer aircraft;
- [text redacted];
- no other defects had been identified that would have prevented operating the flight under MEL conditions, save for the cockpit security door ALS. [Text redacted];
- [text redacted];
- [text redacted].
 At the hearing, the parties presented considerable evidence through their four witnesses as well as in documentary form, and while I have considered all the testimony as well as perused the documentation submitted, and will make reference to much of this both in summarizing the parties’ submissions and in making my determination, it is important to note at this stage that by and large, the evidentiary information gathered by HSO Pollock has proven accurate. [Text redacted].
 [Text redacted]. While I find it necessary for the undersigned to be fully informed in rendering my decision, I do not find it essential that such sensitive information be offered herein in more than general terminology for the purpose at hand, which is determining whether there existed a condition that constituted a danger to the health and safety of employees, thus avoiding the need to redact large portions of said decision.
 As stated above, the present appeals challenge the decisions rendered by HSO Pollock relative to a set of facts and circumstances involving an Air Canada flight scheduled to depart Toronto for Boston on September 14, 2010, facts and circumstances three cabin crew members considered representing a danger to their health and safety that warranted their refusing to work. At the end of her investigation into the matter, HSO Pollock declared in her decisions that those facts and circumstances did not amount to a “danger” within the meaning of the Code, a finding that the appellants are seeking to have reversed by their appeals. Given the essence of these so-called “no danger” decisions, determining what the issue(s) before me is should be a somewhat simple exercise, which, given the de novo nature of this appeal process, could be succinctly stated by the simple question of whether, given those facts and circumstances, there existed a “danger” to the three employees at the time that they exercised their right to refuse to work.
 While arguing around that general question however, the parties have offered somewhat differing interpretations of what the “danger” is that I must determine existed or not. As such, the appellants describe the “danger” as combining the presence of a defective piece of equipment on the aircraft and potential circumstances during flight that could result in injury or worse. According to the appellants, the issue is thus about whether the non-functioning of safety equipment, to wit the Cockpit Security Automatic Latching System (ALS) on the Embraer 175 aircraft, results in “danger” as its purpose is to maintain safety [text redacted] by balancing competing safety and security requirements.
 The opposing respondent, on the other hand, in seeking that I maintain the HSO decisions, presents more narrowly the “danger” that it maintains does not exist, not as a multi-facetted set of elements, and not the actual inoperative door latch, but rather as the fear of what might occur if something else happens with the ALS being inoperative, [text redacted] certain occurrences described by the respondent are situations the employees have received training to deal with, that final outcome being potentially a catastrophic event.
 In determining whether a “danger” existed at the time, I will thus have to give consideration to these two somewhat differing interpretations, having in mind however that subsection 122(1) of the Code defines “danger” as follows:
“danger” means any existing or potential hazard or condition or any current or future activity that could reasonably be expected to cause injury or illness to a person exposed to it before the hazard or condition can be corrected, or the activity altered, whether or not the injury or illness occurs immediately after the exposure to the hazard, condition or activity, and includes any exposure to a hazardous substance that is likely to result in a chronic illness, in disease or in damage to the reproductive system;
and that the legislation that offers that definition states as its purpose the prevention of accidents and injury to health arising out of, linked with or occurring in the course of employment to which it applies, thus entailing a prospective rather than reactive approach to work place circumstances and conditions.
Submissions of the parties
 The parties fashioned their individual position relative to the outcome they are seeking to these appeals on the basis of the testimony provided by HSO Pollock and by four witnesses as well as voluminous documentation. Those witnesses were Mr. Aquiles Vergara, one of the appealing employees, Ms. Julie Pelletier, co-chair (employee side) Air Canada health and safety policy committee, Ms. Annette Anand, manager, Air Canada program design and delivery in-flight training, and Mr. William De Savigny, Air Canada Embraer fleet specialist.
 Both counsel presented their closing arguments verbally on May 29, 2013, and respectively supplemented those with extensive written arguments delivered to the undersigned on June 28, July 15 and 24, 2013. Those are part of the record. The salient facts as to how the HSO’s decisions came about are well known and have been described in detail in the descriptive background information provided above. It is thus not necessary to go over those once more. Likewise, and at the risk of being overly concise, the positions of the parties are straightforward.
 It is the view held by the appellants that on the basis of all the circumstances that existed at the time of the refusals, a danger existed to them as evidenced by the factual circumstances linked to their training and the object of such as well as the absence of alternate operating procedures [text redacted] and thus the HSO’s decisions should be rescinded. In opposition, the respondent is of the view that the same facts and circumstances do not support such a conclusion, that given the evidence, the incidents presented by the refusing employees with an inoperative ALS are entirely hypothetical and speculative, that while there is training on such situations feared by the appellants, such training does not equate to a reasonable expectation that such incidents will materialize, and that the present appeals may have as a purpose the advancement of certain labour union goals. The respondent is thus seeking that the HSO’s decisions be upheld by the undersigned. What follows are their submissions in greater detail, although necessarily summarized.
A) Appellants’ submissions
 Counsel for the appellants offers a simple description of the salient facts relative to the circumstances of the refusals. The ALS was not functioning and the flight refused by the flight attendants was to a major U.S. city, therefore a country where major terrorist activity involving aircraft operation had occurred in the past. The flight attendants themselves were concerned with [text redacted] inability to use said ALS [text redacted] and thus inability to follow standard operating procedures associated with the operation of a functioning ALS, or alternate operating procedures. Notwithstanding the non-functioning ALS system, no alternative procedures were discussed during the required pre-flight briefing. On this last point, counsel referred to the uncontradicted evidence from Service Director Vergara to the effect that during the standard, and actually mandatory pre-flight briefing with the captain, no procedure was described for operating the flight without a functioning ALS [text redacted]. Mr. Vergara’s testimony was that the captain merely advised that the ALS was not functioning and described the applicable MEL provisions.
 Central to counsel for the appellants arguments are the nature and purpose of the ALS [text redacted]. Along those lines, testimony was received that prior to the New York incidents of 9-11, there were no real issues relative to cockpit doors, and that it is only after those events that were developed the reinforced or “hardened” flight deck doors [text redacted].
 [Text redacted].
 [Text redacted].
 [Text redacted]. In point of fact, counsel has argued that a conclusion can be derived from all the witnesses that were heard in this case, regardless of their status, that conclusion being that there are no standard operating procedures in place for cabin crew when a plane is operating without a functioning ALS [text redacted].
 Counsel for the appellants derived from a number of indicators that there is a widespread expectation that the ALS will be needed for its safety functions, as supported at least by industry actions and the mere fact that the employer is providing training and recurrent training on this, and that from a general standpoint, it can be argued that dangerous conditions will arise if a safety device has no back-ups and is not functioning. In doing so, counsel noted that Air Canada witness De Savigny replied to the undersigned that the logical outcome to the hypothetical situation put forth of [text redacted] certain conditions and a non-functional ALS, would be catastrophic, to wit a crash. That being said, the indicators noted by counsel to the effect that a functioning ALS is indispensable are the following.
 There is first argued that measures and actions by the regulator and the industry demonstrate that they expect the ALS to be needed for its safety functions. This is supported by the fact that regulations and standards governing commercial aviation, access to flight deck and the ALS do contemplate [text redacted] threats to safety and security that the ALS and its associated SOPs are designed to address, something the HSO qualified as “absolutely serious stuff”. As such, relevant regulations include the Canadian Aviation Regulations (CARS) dealing with admission to flight deck (s.705.27), closing and locking of flight deck door (s.705.45), doors and locks (s.705.80), training (s.705,124) and standard operating procedures (s.705.138). Furthermore, Standard 725.124(14) made pursuant to the CARS provides for emergency procedures training for flight crew members on [text redacted] threats to safety and security that the ALS and its associated SOPs are designed to address, prompting counsel to conclude that if those possibilities are not reasonably to be expected, then the regulator, industry and Air Canada (which has not sought to change the regulations) are then to be themselves seen as unreasonable. Relative to this first indicator, counsel noted that Air Canada witness Ms. Anand testified that the requirements in the CARS to train for these eventualities were because “industry suspects it may happen”.
 A second set of indicators noted by the appellants relate to the same expectation by Air Canada that the ALS will be needed for its safety functions, as shown by its training and standard operating procedures (SOPs). Regarding the matter of relevant training, counsel noted that the evidence shows that Air Canada flight attendants receive rigorous training in safety procedures, including emergency and security procedures both at the initial stage of their employment and also as part of the required annual recurrent training. Flight attendants are thus trained on how to deal with [text redacted] certain conditions, as shown by the Air Canada training matrix filed as exhibit and evidencing compliance with Transport Canada training requirements.
 Among other things, the matrix refers to [text redacted]. The training received by flight attendants also covers a review of accidents incurred at Air Canada and other operators and addresses the hazards to flight safety where communication is not effective. Counsel further stressed that Ms. Anand, who testified for Air Canada, made the point that Air Canada’s training of its flight attendants on the previously mentioned subjects is in accordance with the CARS and Commercial Air Service Standards and tries to exceed the requirements set by regulations. Furthermore, the CARS require annual recurrent training [text redacted].
 [Text redacted].
 [Text redacted].
 [Text redacted]. (These paragraphs describe Air Canada’s standard operating procedures (“SOPs”) for flight attendants; and training information provided to them by Air Canada with respect to pertinent safety, security and emergency issues.)
 While counsel for the respondent Air Canada may have derided such action as being unrealistic in such threatening circumstances, counsel for the appellants stressed that contrary to Air Canada counsel’s raised doubts, the employer evidently believed in such procedure since it trained its employees on it, just as it also provides training on the use of the ALS [text redacted].
 As part of the training provided to flight attendants that refers to flying accident and incident examples such as the Helios and Peach Air cases, “Crew Resource Management” (CRM) was deemed crucial as it stresses the importance of standard operating procedures and communication among all crew members. In this respect, counsel pointed to Air Canada witness Ms. Anand stressing that in CRM training, situational awareness is key, meaning awareness of crew member responsibilities and how to act or react if they are not following procedure with communication being of key importance. The training by Air Canada does not, however, include training on [text redacted] alternate standard operating procedures.
 Regarding the importance and cost to the employer in providing training and equipment as well as establishing procedures, counsel for the appellants pointed once more to testimony from the respondent’s witness (Anand) to the effect that training of flight attendants involves judgment calls regarding choosing and prioritizing which materials to provide, with the probability of occurrence of events being a factor in deciding what to include in said training. As such, counsel submitted that given the significant cost to the employer of the equipment, the training in its use, the actual training materials as well as the establishment of procedures, the decision by Air Canada to devote those resources to the ALS would demonstrate its seriousness and that it has been made in recognition of the important safety issues involved. Stated differently, it is the conclusion of counsel on this point that Air Canada has put in place such equipment, training and procedure because it expects them to be needed.
 [Text redacted]. The response by the employer was however the same as that which was provided to the refusing employees or HSO Pollock to the effect that the procedure provided pursuant to the MEL was acceptable and therefore the employer did not give suit to the recommendation.
 [Text redacted]. (The redacted portion of these paragraphs describes evidence of a certain type of occurrences that could require the use of the ALS and associated SOPs to avoid or mitigate safety or security threats.) The evidence provided by the appellants to the HSO as well as in the course of the hearing by the undersigned, uncontested as it may be by the respondent, is that whether in a general sense involving air carriers at large or just at Air Canada [text redacted] has happened in the past and it is counsel’s position that there is no reason to believe that it will not happen in the future, even where the employer may take measures to prevent or limit to a maximum such occurrence.
 [Text redacted].
 [Text redacted].
 [Text redacted]. (The redacted portion of these paragraphs describes evidence of a certain type of occurrences that could require the use of the ALS and associated SOPs to avoid or mitigate safety or security threats.) Those incidents, which involve Air Canada and many other air carriers, as established by various reports and studies from diverse sources such as the FAA (Federal Aviation Administration), AAIB (UK Air Accidents Investigation Branch), ATSB (Australian Transportation Safety Board), Air Canada and Transport Canada, serve to establish first [text redacted]. That being said, the details of each or many of those incidents, while possibly of informative interest, is not necessary to the understanding and evaluation of counsel’s submissions.
 [Text redacted].The contrary would mean that there would be no need for the continued procedures restricting access to the flight deck. In the case at hand, the flight was to Boston and Air Canada witness De Savigny agreed, according to counsel, that security threats are still present and pertain to large U.S. cities like Boston, as shown by the recent Boston Marathon bombing and with respect to Canadian transportation, as evidenced by the recent arrest of a group charged with plotting to bomb a Via Rail train. According to counsel, there has been no suggestion in any of the proffered evidence that security threats are no longer significant in commercial aviation, and while no data was provided on unruly passengers or more serious security threats, counsel made the point that flight attendants receive training to deal with both.
 Counsel addressed the HSO’s response as well as the respondent’s position relative to the MEL by stating that the MEL is not an exhaustive guide to safety, that it does not establish that an aircraft is airworthy and that it does not address occupational health and safety matters under the Code. Referring to CARS and Standard 625, counsel points out that Transport Canada notes that “application of the MEL does not eliminate the need for the pilot to make his own assessment of the airworthiness of the aircraft, but it does indicate certain circumstances where operation is definitely not permitted”, and thus argues that where an aircraft with unserviceable equipment is not compliant with the MEL, its operation is not permitted, yet a pilot may decide that an aircraft is not airworthy even though it may be in compliance with the MEL.
 In point of fact, counsel submitted that the procedures set out in the MEL are primarily pertaining to maintenance and operations and thus of limited relevance to flight attendants. According to counsel, support may be found for this last conclusion in the MMEL (Master Minimum Equipment List) approved by Transport Canada in accordance with CARS 605.07 and which serves to allow individual operators to develop their own individual MEL addressing their own particular aircraft equipment configuration and operational conditions while not being less restrictive than the MMEL. In this respect, counsel pointed to the MMEL and the provisions in the MEL identifying personnel concerned therein by the letters “M” for maintenance and “O” primarily for pilots. Regarding the HSO’s recognition and the position by the respondent relative to the two days repair deferment of the ALS, counsel noted that there are no procedures in the MEL for flight attendants flying without a functioning ALS and no evidence as to the rationale for allowing aircraft to operate for two days in this manner. Counsel completed its submissions on this particular point by adding that under the circumstances of the case at hand, there was no evidence to suggest that the reasons for a functioning ALS raised by the refusing employees [text redacted] would be or have been suspended for the two flight days while the aircraft is or would have been flying without said functioning ALS.
 Counsel pointed to the fact that Air Canada, in seeking to manage the risks of organizational accidents, has adopted a theoretical model that is referred to as the “swiss cheese model” whereby the presumption underlying a need for “defences in depth” vis-à-vis potential accidents is that every layer of defence contains holes that are not static and consequently change with every removed layer bringing the possibility of an accident closer. Under that model then, removal of a safety device would increase the likelihood of an accident, this being in line with the employer’s training materials that say that probabilities of accidents increase as resources are penetrated. Noting that witness for Air Canada Ms. Anand had agreed in her testimony that the circumstances of these cases attested to multiple failures, those being unserviceable safety equipment and a lack of procedure for the operation of the flight with the unserviceable equipment, counsel put forth the position that the flight that the appellants refused to operate would, in their case, have operated (it did with other employees) with significant layers of defence removed, in circumstances where it was reasonably to be expected that those defences could be required. As such, when applying the “Swiss Cheese” model of accident causation analysis used by respondent Air Canada, the flight was to be seen as dangerous.
 Using the definition of danger at subsection 122(1) of the Code as the basis for its submissions on the law, counsel for the appellants summarily defined the central issue to be determined as being whether it is reasonable to expect that the safety equipment at issue and its associated procedures could be required in order to prevent injury to persons on board the aircraft, including the refusing flight attendants. Factually, and in line with the “danger” definition, the case is presented by counsel as concerning an existing condition to wit, the ALS, a piece of safety equipment which was not functioning on the aircraft on which the refusing employees were scheduled to work. In this regard, counsel noted that the fact that the ALS was not functioning or that its sole purpose is safety is not disputed. [Text redacted]. In this regard, counsel underlined that there had been no suggestion by anyone that the ALS could have been restored to functionality during flight if needed.
 In light of this and inspired by voluminous references to applicable case law, counsel delineated its legal submissions on three elements:
- 1) the test of danger is met where safety measures are deficient. When either safety equipment or procedures are removed or unavailable, danger is present within the meaning of the Code, a particular concern arising when employees are unable to apply their training in safety procedures because the safety equipment is not available.
- 2) the Code is preventive in purpose, and thus it is not necessary that hazards or injuries resulting from them occur frequently, only that their occurrence be reasonably possible.
- 3) compliance with a regulatory scheme, in this particular instance compliance with the MEL, does not serve to eliminate the danger.
 As stated above, in support of its submissions on the law, counsel referred to voluminous case law. Relative to Verville v.Canada (Correctional Services) 2004 FC 767, counsel noted that the Court had stated the following points:
- the Code is not limited to specific factual situations existing at the time of refusal;
- the condition or activity involved in the refusal does not need to cause injury every time it occurs; rather it must be capable of causing injury at any time, not necessarily every time;
- it is not necessary to establish precisely the time when the hazard, condition or activity will occur, but only to ascertain in what circumstances it could be expected to cause injury and establish that such circumstances will occur in the future, not as a mere possibility, but as a reasonable one;
- hazards or conditions based on unpredictable human behaviour are covered by the definition. In the words of the Court, “if a hazard or condition is capable of coming into being or action, it should be covered by the definition” (para. 41).
 Furthermore, counsel also noted that the Court had recognized that there is more than one way to establish a reasonable expectation of injury in a particular situation, injury that may occur in circumstances that may somewhat differ. As such, quoted are the words of the Court at paragraph 51 of said decision to the effect that “a reasonable expectation could be based on expert opinion or even opinions of ordinary witnesses having the necessary experience when such witnesses are in a better position than the trier of fact to form the opinion”. Applied to the case at hand, counsel notes that the opinions of regulators, industry, Air Canada and the Montreal workplace health and safety committee are unanimous with respect to the need for the ALS as a safety device and its associated procedures. [Text redacted].
 Counsel also argued that the Federal Court of Appeal had found that the absence of safety equipment needed to protect against a potential danger represents a danger under the Code. Reference in this regard is made to Martin v. Canada (Attorney General) 2005 FCA 156 stating at paragraph 37:
I agree that a finding of danger cannot be based on speculation or hypothesis. However, when attempting to ascertain whether a potential hazard or future activity could reasonably be expected to cause injury before the hazard could be corrected or the activity altered, one is necessarily dealing with the future. Tribunals are regularly required to infer from past and present circumstances what is expected to transpire in the future. The task of the tribunal in such cases is to weigh the evidence to determine whether it is more likely than not that what an applicant is asserting will take place in the future.
Based on the above and applied to the present case, counsel therefore argues that the question here is whether the potential hazards [text redacted] are mere speculation or hypothesis, or whether they are likely to take place in the future. Counsel argues that they have taken place in the past and that there has been no evidence presented that anything would prevent them from taking place in the future. There is an elaborate regulatory system in place and a system of Air Canada training, equipment and procedures that anticipate that these hazards will take place in the future. The fact that the employer and the regulator have already implemented the ALS as a safety measure serves to reduce the speculative or hypothetical nature of the hazards occurring.
 It is counsel’s opinion that the Tribunal reached a similar conclusion in Armstrong v. Canada (Correctional Services), 2010 OHSTC 6, relative to the unavailability of safety equipment, and in Frighetto v. Group 4 Securicor, (2011 OHSTC 7) regarding the removal of safety procedures, or the alteration of such to the point of actual elimination, this time based on the notion of unpredictability of human behaviour, or the removal of a “level of security” without adequate replacement, as found in Brazeau and Securicor Ltd. (2004) CLCAOD no.49, based on what is commonly referred to as the hierarchy of controls or preventative measures set at section 122.2 of the Code and standing for the position that when preventative measures exist to protect employees against a hazard, and an employer fails to take them, the result is danger.
 In the case at hand, counsel points to the particular concern of the removal of safety equipment, the ALS, which would have made it impossible for the refusing employees to act according to their training and to follow safety procedures, something that was found to constitute a danger by the appeals officer in Securicor Canada Limited and Canadian Auto Workers Union Local 4266-A, Decision no 06-002, who stated at paragraph 18 that “the inability of an employee to be able to act according to her training was a danger at the time of the work refusal”. Moreover, in that same decision, the appeals officer stated at paragraph 24 that “methodology imposed on the guard and custodian varied from standard safety procedures (…) without any mitigating measures to minimize the additional risk that was created by the change”, this being interpreted by counsel as signifying that the actual existence of an employer’s safety procedures and training indicates that when those procedures and training are not available, there is danger. The conclusion drawn by counsel for the appellants on the basis of what precedes is that the present case can be assimilated to the Securicor decision just referred to and that as in that case, the refusing employees in the present appeals are trained in safety procedures using the ALS, but they are not trained in any such procedures in circumstances where the ALS is not functioning. Furthermore, no mitigating measures were taken to minimize the additional risk created by the absence of a functioning ALS, such factors leading to a conclusion of danger.
 [Text redacted]. Counsel for the appellants dealt with this in the final part of its submissions, putting the accent on the Code’s primary objective and principle in determining the existence of danger, that being its preventive nature, as expressed at section 122.1 of the Code, which states that “the purpose of this Part is to prevent accidents and injury to health arising out of, linked with or occurring in the course of employment to which this Part applies”, and thus enunciating generally, on the basis of previous decisions by appeals officers, that danger can be found despite the absence or infrequency of past injuries or hazards, and that a hazard may be reasonably expected to occur in the future despite never having occurred in the past, statistical frequency not being required, as stated in Rathwell v. Air Canada, 2011 OHSTC 15, paragraph 66 in the following words: “ […] there is no requirement in the Code definition of danger that it be frequent”, and more forcefully in a previous CIRB decision (Lequesne (Re),  CIRBD No 276, at paragraph 84) as follows:
[A]n accident or incident is an event that happens by chance or without apparent cause at some unforeseeable time. … A remote possibility is a possibility nonetheless. Part II does not provide a “remote possibility” as a rationalization for unsafe work conditions.
 Noting that the test adopted by case law to determine the presence of danger requires only that there be a “reasonable possibility” that a hazard would cause injury in the future, not a certainty or likelihood, and that such possibility remains reasonable even when infrequent, counsel noted that in the event of [text redacted]which would require use of the ALS, the severity of injury is likely to be high and flight attendants do not have the option of withdrawing themselves from the aircraft while it is in flight. Counsel thus concluded on this point that while the frequency of occurrences when a functioning ALS is required for safety reasons may be low, the risk is nonetheless always present, the consequences may be high in severity, and because of those circumstances, injury is highly susceptible of happening in the future if the ALS is not functioning.
 As a concluding point, counsel referred to the respondent’s position, as well as that of HSO Pollock, that the MEL allowed the ALS to be inoperative with the flight proceeding as scheduled. Arguing that compliance with a regulatory scheme does not eliminate danger, counsel submitted that the MEL is actually not relevant to the present case, indicates only “certain circumstances where operation is definitely not permitted”, does not prevent a pilot from making the assessment that a MEL-compliant aircraft is not airworthy, and that while the MEL may concern airworthiness, it does not take into account occupational health and safety issues. Noting that an aircraft would not be allowed to operate because of aviation safety concerns, where not in compliance with the MEL, thus eliminating the opportunities of work refusal by flight attendants, counsel pointed out that danger findings have been made in flight attendant refusals where there was no issue of airworthiness and no question that the aircraft was operating within the requirements of the MEL (Rathwell, supra), claiming in particular that the respondent had been unsuccessful in the making of the same argument relative to compliance with the MEL in Canadian Union of Public Employees, Air Canada Component v. Air Canada, 2008 FC 1299, at paragraphs 3, 29 and 32 in which the Federal Court accepted that the aircraft concerned met the requirements of the MEL, but nevertheless overturned the appeals officer’s “no danger” finding on the basis of the latter’s unreasonable (“contradiction”) decision relative to the legal test of “danger”.
 Counsel noted that there have been other instances where the same argument relative to compliance with regulations was made and not accepted, noting that at the center of the rejection laid the fact that the objective of the Code and that of the Regulations made under a different legislation were different, with the Code taking precedence in matters relative to occupational safety and health.
 As stated above, the appellants are seeking that the HSO decisions be rescinded and replaced by a finding of “danger” that would thus require the undersigned to fashion and order a remedy. On that, the appellants rely on the preventive purpose of the Code to suggest that where “danger” is found to exist because of lacking safety measures, the appropriate remedy needs to be prospective in order to protect employees faced with similar circumstances in the future. The appellants thus are of the view that upon my finding a “danger”, directions be issued to Air Canada to:
- discontinue the use of the FIN #380 aircraft until the cockpit security ALS is fully operative;
- cease and desist from dispatching aircraft with inoperative ALS;
- order such further relief and remedies as may be advised by counsel or deemed appropriate by the undersigned;
and in the alternative, given that the work refusals concerned an Embraer 175 aircraft and that the evidence shows that Embraer 175 and 190 aircrafts involve the same ALS and procedures, that I issue a direction to the respondent Air Canada that it:
- cease and desist from dispatching Embraer 175s and 190s with inoperative Cockpit Security Automatic Latching Systems.
B) Respondent’s submissions
 The respondent’s submissions are premised on the precept that the right to refuse to work provided under section 128 of the Code is a wholly personal right to the refusing employee(s) which must be based on the dual subjective and objective component that a refusing employee must have a reasonable cause to believe that the danger claimed to justify the refusal exists. As such, this serves to introduce a later expressed opinion formulated by counsel that such personal right, even where a refusing employee is represented by and the latter’s case is supported and even presented by a union, may not serve or be used to advance a position or positions based on elements other than those that are personal to the refusing employee(s), meaning thus that what I may consider in my determination is the situation as experienced by the refusing employee(s) at the time of the refusal.
 This being said, while the general concept of “danger” is defined at subsection 122(1) of the Code as “any existing or potential hazard or condition or any current or future activity that could reasonably be expected to cause injury or illness to a person exposed to it before the hazard or condition can be corrected, or the activity altered (…)”, counsel made it a point at the outset to underline the fact that numerous court pronouncements have served to pinpoint key elements that must be satisfied in seeking to establish the existence of a danger. As such, there can be a finding of “danger” under the Code only where the hazard is real as opposed to a merely hypothetical or speculative one. According to counsel, support for this can be found in the Federal Court decision in Verville, itself referring to the Federal Court of Appeal’s pronouncement in Martin, which stated that while a precise timeframe within which a condition, hazard or activity will occur need not be established to found a danger, the definition of the concept in the Code only requires that one ascertains in what circumstances it (condition, hazard or activity) could be expected to cause injury and that it be established that such circumstances will occur in the future, not as a mere possibility but as a reasonable one.
 By the same token, according to counsel, the state of the law as regards the criteria for assessing the presence of “danger”, which counsel reduces to the risk or hazard not needing to occur in every instance but being reasonably capable of occurring at any time, is summarized by the Federal Court in Canada Post Corporation v. Pollard, 2007 FC 1362, as follows:
 As a matter of law, in order to find that an existing or potential hazard constitutes a “danger” within the meaning of Part II of the Code, the facts must establish the following:
- the existing or potential hazard or condition, or the current or future activity in question will likely present itself;
- an employee will be exposed to the hazard, condition, or activity when it presents itself;
- exposure to the hazard, condition, or activity is capable of causing injury or illness to the employee at any time, but not necessarily every time; and
- the injury or illness will likely occur before the hazard or condition can be corrected or the activity altered.
 The final element requires consideration of the circumstances under which the hazard, condition or activity could be expected to cause injury or illness. There must be a reasonable possibility that such circumstances will occur in the future. […]
 In Martin C.A., cited above, the Federal Court of Appeal provided additional guidance on the proper approach to determine whether a potential hazard or future activity could be expected to cause injury or illness. At paragraph 37 of its reasons, the Court observed that a finding of “danger” cannot be grounded in speculation or hypothesis. The task of an appeals officer, in the Court’s view, was to weigh the evidence and determine whether it was more likely than not that the circumstances expected to give rise to the injury would take place in the future.
 In the opinion of counsel, of all the factors formulated by the Court in the Pollard decision, in the present appeals it is the last factor (injury must be expected to occur before the hazard is corrected) that is most critical to the determination of these cases. Along this line, an essential component of the respondent’s position is that the definition of “danger” in the Code allows also for the interpretation, one would say a contrario, that an otherwise potentially dangerous situation can continue to exist (therefore not seen as a “danger”) where there is no reasonable possibility of injury occurring before the hazard is corrected, the essential part of respondent’s position being that since certain events that have in themselves the potential to cause injury, should they occur, are not reasonably likely to occur before the hazard that is the inoperative ALS can be corrected, a conclusion of “danger” would not be justified. Recognizing the fact that there are inherent dangers in all modes of transportation, including airplane accidents where the picture of catastrophic results is conveyed, the answer provided by the latter to the question: why is it acceptable from a health and safety perspective that “aircraft still fly ?” serves to illustrate what is central to the respondent’s position in this case to wit, “it is because the actual risk of such a catastrophic occurrence is extremely low, and that such events usually arise from an exceedingly rare confluence of different remotely possible scenarios”.
 As already stated above, the parties hold differing views as to the danger that I must evaluate. According to counsel for the respondent, it would be incorrect to consider that said danger is the inoperative ALS, as counsel claims is suggested by the employees. Rather, again according to counsel, it is not the inoperative automatic door latch per se that needs to be assessed as the danger, but the “fear” of what might occur if something else also happens with the ALS being inoperative. That something else, to quote the words of counsel at paragraph 33 of the latter’s written submissions in referring to what he indicates was identified by the refusing employees and “articulated” by HSO Pollock, was that the inoperative door lock was a danger [text redacted] because “there is no way for the cabin crew to follow our SOPs [text redacted]” [text redacted].
 According to counsel for the respondent, even this does not represent the actual danger feared by the employees since they have been trained to deal with pilot incapacitation, and although left unsaid, one would assume, threatening actions directed at the cockpit. [Text redacted].
 Referring to the Martin court pronouncement that for a conclusion of danger, these events must be more likely than not to occur before the hazard which is the inoperable ALS is fixed, counsel noted that according to the Transport Canada approved MEL, the timeframe for this to occur would be at the most two flight days, although in reality, it would be much narrower since for each of the refusing attendants, their real exposure to the hazard would have been the duration of the flight, which was approximately 90 minutes, and even closer to sixty minutes [text redacted].
 The two flight days’ timeframe central to HSO Pollock’s conclusion as well as to the respondent’s position in this regard originates from the provisions of the Transport Canada Embraer Master Minimum Equipment List (MMEL) developed by the aircraft manufacturer, which allows the operation of the airframe with certain limitations and the Air Canada MEL, also Transport Canada approved. From those, an inoperative ALS must be corrected within two flight days, causing counsel to reiterate that the risk to be analyzed is the potential for occurrence of the workers’ concerns on the flight in question, or on a subsequent flight involving that particular aircraft, within two flight days from the time the malfunction was observed, thus buttressing respondent’s position as to the extremely limited possibility of occurrence to the extent of being hypothetical. As MMEL and MEL considerations are central to the respondent’s position in the present cases, counsel has thus devoted a considerable part of his submissions to those documents and their contents, mostly for the purpose of demonstrating that while, under the provisions of those documents, which he repeatedly insisted are Transport Canada approved, it is possible for an aircraft (airframe) to continue flying with certain inoperative equipment, those documents do address safety concerns in respect of the operation of the Embraer.
 While counsel has quoted profusely from those documents and I have had opportunity to read those quotes in the latter’s submissions as well as the actual documents which were filed as exhibits, it is not necessary for the undersigned to reproduce those in their entirety here and I will only reproduce part of those to illustrate the point being made by counsel, point which quite evidently is based on the fact that the said documents repeatedly speak of “safety” and “acceptable level of safety”. It is important to note that counsel’s comments on the MMEL and MEL are premised by the statement that “an inoperative ALS in no way affects the airworthiness of an aircraft. [Text redacted].The aircraft will fly and access to the cockpit is restricted. If the MEL dealt only with airworthiness, a “two flight” fix threshold would be unnecessary”, thereby again alluding to the position taken by the respondent in these cases that the actual danger feared or invoked by the refusing employees does not concern the inoperative equipment per se but rather their incapacity to adhere to the standard operating procedures they have been trained on in the extremely limited chance of certain occurrences within or towards the Flight Deck.
 Repeatedly in the submissions by counsel as well as in the various quotes from the MMEL and MEL, the word “airworthiness” is used but not defined. For a better understanding of what follows, I have opted to insert here a dictionary definition of the term “airworthy” as found in the Canadian Oxford Dictionary, wherein it is stated that an aircraft is airworthy as being “fit to fly”, which I understand as at least meaning being capable of flying and maintaining flight. With this being said, the safety considerations and purpose of the MMEL and MEL are stated in some of the quotes provided by counsel as follows:
The Airworthiness Regulations require that all equipment installed on the airplane in compliance with the Airworthiness Standards and the Operating Rules must be operative. However the Rules also permit the publication of a Minimum Equipment List (MEL) where compliance with certain equipment requirements is not necessary in the interests of safety under all operating conditions. Experience has shown that with the various levels of redundancy designed into aircraft, operation of every system or installed component may not be necessary when the remaining operative equipment can provide an acceptable level of safety. […] The CTA/ANAC approved MMEL includes those items of equipment related to airworthiness and operating regulations and other items of equipment which the Administrator finds may be inoperative and yet maintain an acceptable level of safety by appropriate conditions and limitations; […] The MMEL is the basis for the development of individual operator MELS which take into consideration the operator’s particular aircraft equipment configuration and operational conditions. […]
An operator’s MEL may differ in format from the MMEL, but cannot be less restrictive than the MMEL. The individual operator’s MEL, when approved and authorized, permits operation of the aircraft with inoperative equipment.
Suitable conditions and limitations in the form of placards, maintenance procedures, crew operating procedures (underlining added) and other restrictions as necessary are specified in the MEL to ensure that an acceptable level of safety is maintained.
[…] In order to maintain an acceptable level of safety and reliability, the MMEL establishes limitations on the duration of and conditions of operation with inoperative equipment. […]
 One must note at this stage that what precedes represents, according to the overall submissions of the respondent, the situation in existence at the time of the refusals to work by the appellants. It is also stated in the document, as had been retained by HSO Pollock, that “MEL conditions and limitations do not relieve the operator from determining that the aircraft is in condition for safe operation with items of equipment inoperative”, something that counsel submits was the case at the time of the refusals where he notes, under the descriptive “pilot assessment”, that at the time of refusals, three different pilots had reviewed the situation and determined that the aircraft could be safely operated, not only from an airworthiness perspective, but also taking into consideration the concerns of the refusing employees, and that one ought not to draw an adverse inference from the fact that those pilots were not called to testify at the hearing. Counsel did not however elaborate on what would constitute a redundant system to the non-functioning ALS.
 Additionally, the respondent submits that Transport Canada’s overview in the MEL approval process also imparts an integral consideration of safety, and that inclusion of items in the approved MMEL and the MEL has involved a complete evaluation of the safety or rather the acceptable level of safety for continued operation of the aircraft according to MEL conditions, such that relative to those included items, as the ALS, which may be inoperative, a determination has already been made by Canada aviation regulatory authority that operation of the aircraft under such conditions does not constitute an unacceptable safety hazard in and of itself.
 As a means of furthering its submissions on this, counsel referred the undersigned to the Embraer MMEL, and noted that under title Dispatch with inoperative equipment, it is stated that the “MEL is an alleviating document”, the purpose of which not being to encourage the operation of aircraft with inoperative equipment, as “it is never desirable that aircraft be dispatched with inoperative equipment and such operations are permitted only as a result of careful analysis of each item to ensure that the level of safety is maintained […]” where in establishing the equipment necessary for any given safe operation where certain equipment is inoperative, the MMEL Review Group must consider various factors that include “the consequence to the aircraft and its occupants of further failures, change in crew workload and/or degradation in crew efficiency and degradation in crew capability to cope with adverse internal and external environment conditions”, and, on the proposed approval of a particular MMEL, its decision will be based on the criterion that the level of safety required by the standards specified for the design and operation of the aircraft type can be maintained. Items that are inserted in an MMEL need to have been assessed from an acceptable level of safety standpoint and that assessment may involve a number of methods of justification, including a Quantitative Safety Analysis and a Qualitative Analysis.
 In the case of the quantitative analysis, the level of safety acceptability, taking into account the increasing dependency of modern aircraft on the safe operation of complex systems, is based on the principle that the hazard resulting from an event should be inversely proportional to the probability of its occurrence. As such, said safety assessment would serve to establish “the major, hazardous or catastrophic situations or failure conditions which the system is capable of producing and the allowable probability of occurrence”. A distinction is made in this respect on the basis of critical or non-critical failure of systems. “For those systems whose failure is critical, i.e., results in hazardous or catastrophic situations, a numerical probability analysis is usually required to demonstrate compliance with the allowable probability of occurrence.” For those critical functions systems, their inoperability is to be taken into account in the safety assessment and, where it is not possible to establish the additional risk resulting from occasional flights with such equipment inoperative in light of the allowable probability of occurrence established during the certification process, “then a safety analysis must be carried out involving a quantitative analysis of the likely risk of the worst effects that can result from additional failures, events and/or environmental conditions occurring during a flight” with a particular inoperative item.
 On the other hand, “for non-critical components/systems, the safety assessment may be greatly simplified” with the risk of any specific failure condition being a function of failure rate, the number of such systems and the time of exposure to risk. Referring once more to the same document (Embraer MMEL), attention is drawn by counsel to the fact that if an item is to be found acceptable for inclusion in the MMEL, “a qualitative analysis must be used to consider the impact that the proposed inoperative item has on all other aspects of the aircraft’s operation. The qualitative analysis must consider the impact on crew workload, the impact of multiple MMEL items, and the complexity of maintenance and/or operational procedures. In brief then, the voluminous references by counsel to the Embraer MMEL seek to demonstrate that the MMEL development process by the aircraft manufacturer, as well as the Transport Canada approval process of such, take into consideration the safety aspect of operating the aircraft with certain inoperative items.
 In his considerable reference to the Embraer MMEL, counsel also pointed out that the said document generally defines the purpose of an MEL, such as the Air Canada MEL relative to its Embraer aircraft generally and the aircraft directly involved in this particular case. An MEL is thus described as:
a joint operations and maintenance document prepared for or by an air operator to:
- identify the minimum equipment and conditions for an aircraft to maintain conformity with the standards of airworthiness and to meet the operating rules for the type of operation;
- define the operational procedures (underlining added) necessary to maintain the required level of safety and to deal with inoperative equipment;
- define maintenance procedures necessary to maintain the required level of safety and procedures necessary to secure any inoperative equipment.
 Having regard to this, reference is also made by counsel to Transport Canada General Operating and Flight Rules, which describe MELs as being “lists of systems and equipment installed in the aircraft, annotated to show the degree to which defects may be allowed for a limited period”, and state a consideration that has been recognized as central to this matter by HSO Pollock as well as by the respondent to the effect that “application of the MEL does not eliminate the need for the pilot to make his own assessment of the airworthiness of the aircraft, but it does indicate certain circumstances where operation is definitely not permitted.” On this matter of “pilot assessment”, as noted above, the respondent has argued that three different pilots had reviewed the situation at the time of the refusals and determined that the aircraft could be safely operated, to quote the words of counsel, “not only from an airworthiness perspective, but taking into consideration the refusing F/As concerns.” Having regard to counsel’s submissions regarding the MMEL and the Air Canada MEL, the latter’s summation of the respondent’s position is that Air Canada does not say that any event that meets MEL requirements, as is the case here, can never constitute a “danger” within the meaning of such defined term in the legislation, but that absent specific extraneous factors (underlining added) which might be present on a particular day, the impact of an inoperative flight deck door has in fact been determined not to be a safety hazard affecting the safe operation of the aircraft within the limitation period specified in the MEL.
 It is the position promoted by the respondent that the acceptance of the Embraer MMEL by Transport Canada means that a determination has already been made by Canada aviation regulatory authority that operation of the aircraft with an inoperative ALS does not automatically constitute an unacceptable safety hazard. In short then, the position taken by the respondent would be that during flight, all other conditions, be they material or human, remaining as they should be, or put another way, there occurring no extraneous factor or “next worse failure” or there being little probability of such occurrence, the fact of an inoperative ALS would not constitute a safety issue when considered during the repair deferment period provided under the applicable MEL. In this respect, counsel argued that appellants’ counsel had erroneously asserted that the Federal Court had found in Canadian Union of Public Employees, Air Canada Component v. Air Canada, 2008 FC 1299, that MEL compliance would not ensure maintenance of a “no danger” finding where the apparent contradiction by the appeals officer in interpreting the actual definition of “danger” would lead to an unreasonable result. Rather, according to counsel, where the Court had formulated a conclusion on that contradiction, it had not dealt with any other issue, including the impact of MEL compliance.
 As repeatedly mentioned above, central to the position adopted by respondent Air Canada is the notion of likelihood of occurrence, in that the danger invoked by the refusing employees combines the fact of an inoperative piece of equipment and certain events [text redacted].
 In this respect, counsel argues that, contrary to appellants’ position, statistical data needs to be considered relevant and that as such, it is not sufficient to consider that since there is a known possibility that the events just mentioned can occur, that this must automatically translate into a “danger” existing, or the fact that a recognized “safety” device malfunctions or is inoperative prima facie constitutes a danger. Noting that even with vast improvements in safety over the years, all modes of transportation present inherent dangers, and that as for all other modes of transportation, “there are airplane accidents”, counsel asks and answers the questions as to why, from a health and safety perspective, such modes remain acceptable, and in the case of aircraft, “still fly” , by stating “that it is because the actual risk of such catastrophic occurrence is extremely low, and that such events usually arise from an exceedingly rare confluence of different remotely possible scenarios”. With this in mind, it is the view of counsel for respondent Air Canada that the case law submitted by the appellants in support of their position is of little relevance since the Code definition of “danger” stipulates that the event (“hazard, condition or activity”) with the potential to cause injury must be reasonably likely to occur before corrective action can be taken and in the cases cited by the appellants, the employers had taken the position that the hazard complained of was not intended to be corrected, this meaning that the analysis of risk of injury “before the hazard could be corrected” had not even been contemplated in those cases.
 According to counsel, the steps of the needed analysis are well described in the Correctional Service Canada (CSC)Millhaven Institution appeal decision (Decision No. 06-026) where the appeals officer stated at paragraph 58:
- […] that a danger exists where the employer fails, to the extent reasonably practicable, to:
- (a) eliminate a hazard, condition or activity;
- (b) control a hazard, condition or activity within safe limits; or
- (c) ensure employees are personally protected from the hazard, condition or activity;
and one determines that:
- (d) there are circumstances in which the remaining hazard, condition or activity could reasonably be expected to cause injury or illness to any person exposed thereto before the hazard, condition or activity can be corrected or altered; and that the circumstances will occur in the future as a reasonable possibility as opposed to a mere possibility or a high probability.
Given what immediately precedes, respondent counsel challenges, as not reflecting the requirements of the Code or the definition of “danger” found therein, the proposition by the appellants that the mere existence of the employer’s safety procedures and training signifies that there is danger when those procedures and training are not available and that the test to determine whether a danger exists is met “when safety measures are deficient” to wit, when safety equipment or procedures are removed or unavailable, and when employees are unable to follow their training in safety procedures because of said unavailability.
 It is the respondent’s position that the mere fact that a safety measure may not be available does not, in and of itself, equate to a danger. As required by the proper analysis described above, there remains the requirement that the hazard be probable as opposed to being speculative, and that it be reasonably expected to occur before it can be corrected. Furthermore, the fact that employees have received training on a safety procedure and are unable to do what they have been trained to do similarly does not equate to danger.
 [Text redacted].
 [Text redacted].
 On the “Swiss Cheese” model of accident causation analysis used by the respondent, counsel objected to the appellants’ characterization to the effect that “when one thing goes wrong, more things go wrong”, opting rather for the proposition under the model that if one thing does not go wrong, the catastrophic event will not occur. Counsel expressed the opinion that the appellants falsely claimed that the flight at the center of this case was “dangerous” under the said model because it was or would have operated with significant layers of defence removed, in circumstances where it was reasonably to be expected that those defences could be required, and in doing so misstated the concept.
 According to counsel’s submissions, the said model is intended to demonstrate that there are multiple layers of defences that can prevent the occurrence of a catastrophic event, one such defence being capable in and of itself of succeeding in that prevention. Relative to the actual case at hand of flight AC 362, counsel put forth that there was only one layer of defence missing, that being the ALS, and thus for a catastrophic event to occur or have occurred, other layers of defence would have to fail or, in counsel’s terms, “other holes” (would) have to open and align [text redacted].
 According to counsel, the Helios case used by Air Canada in its training and which concerns a decompression and hypoxia situation that ended in the crash of the Helios Airways Boeing 737-300 and the death of all 121 passengers and crew members, constitutes a good illustration, under the “Swiss Cheese” model, of the storm of events necessary to produce such serious consequences. In that case, the post-accident investigation revealed thirteen errors which led to the crash and in counsel’s view, the remediation of any of these errors likely would “have averted the tragic result”. Along the same line, counsel describes “decompression”, rapid or progressive, as being in and of itself a rare occurrence and he refers to documentary evidence provided by the appellants to support this. As such, a study titled Quick Response by Pilots Remains Key to Surviving Cabin Decompression (Stanley R. Mohler, M.D.) published by the Flight Safety Foundation indicates:
Statistics compiled by the U.K. Civil Aviation Authority showed that 77 occurrences of decompression were reported in all types of pressurized aircraft from 1990 through 1999. From 1985 through 1999, 164 decompression occurrences were reported to the Transportation Safety Board of Canada and from 1990 through 1999, the Australian Bureau of Air Safety Investigation recorded five decompression occurrences. In the United States, statistics compiled by the FAA Civil Aeromedical Institute (CAMI) showed that 355 occurrences of aircraft decompression were reported from 1974 through 1983, an average of about 35 a year.
According to counsel, applying this U.S. data and extrapolating from the 54.3 million flights over the 1993/1998 six year period, this would put the U.S. rate of decompression at approximately 1 event per 255,000 flights. Similarly, applied to the 1.7 million Air Canada flights between 2003 and 2010, approximately 7 decompression events, or 1 per year, would be expected to occur.
 Still relative to the “Swiss Cheese” accident causation analysis model, counsel affirmed that the probability of a [text redacted] certain condition is extremely remote and that for the scenario contemplated in the refusals that make up the present case to occur, numerous circumstances would need to be present in addition to the ALS being inoperative. [Text redacted]. Applying the analysis model as did Air Canada witness Ms. Anand, with any of these variables not present during the limited duration of the flight, the feared hazard would not reasonably materialize. [Text redacted]. Counsel recognized that there could be additional factors that could raise the probability of such a feared event occurring on any particular day.
 He points out however that on the day of their refusals, the appellants failed to identify any such factors. [Text redacted] and there was nothing inherently dangerous about an inoperative ALS, the possibility being anticipated by the MEL with an operating procedure being in place to address such a situation, although on this last point, no particulars were offered.
 Concluding on this point, it is counsel’s view that the limited capacity of flight attendants to do something in the event of a [text redacted] must enter into the equation, given their stated concern in exercising their right of refusal as being [text redacted].
 [Text redacted].
 Recalling that the Transport Canada approved MMEL sets out the considerations relevant to determining whether a specific inoperative piece of equipment may bring about the grounding of an aircraft and spells out that “the risk of any specific failure condition is a function of failure rate, the number of such systems and the time of exposure to risk”, counsel expressed the view that in this case, there was no reasonable possibility of the danger materializing, as the risk is so remote due to the number of factors which are required to occur simultaneously in a fixed time window that the safety risk is negligible to the point that Canada’s “Air regulator” has approved a two day time window for repair. Counsel’s conclusion on this point adheres to the central argument of the respondent relative to the extremely remote possibility of circumstances materializing while the ALS is inoperative. According to counsel, if the safety risk has been determined to be so negligible, the event cannot implicitly and intuitively rise to the level of being a “danger” within the meaning of the Code.
 One of the appellants, Ms. Caron, added the risk of [text redacted] a certain condition with the ALS inoperative, as a motive for refusal. In this regard, counsel for the respondent put forth the opinion that in order to meet the definition of “danger”, it was incumbent upon the employee to demonstrate that such a risk was reasonably probable, taking into account as a relevant consideration the duration of the flight that the employee was scheduled to work on. Counsel’s position on this is simply that no cogent evidence has been adduced regarding the reasonableness of such a risk.
 [Text redacted].
 [Text redacted].
 [Text redacted]. Thus was brought to the fore the question of whether the employer had established written or standard operating procedures for such a situation, a question on which counsel for the respondent was straightforward in stating that witnesses in the case were consistent in establishing that the employer has no precise written procedure in respect of an inoperative ALS.
 Counsel elaborated on this by pointing to the testimony of respondent witnesses De Savigny and Anand who had testified that an alternate procedure to deal with the issues arising from the inoperative ALS would be expected to be part of the pre-flight briefing by the Captain, at which time alternate [text redacted] procedures were to be discussed. The evidence shows that the Captain based his decision to go ahead with the flight on the MEL and its two days of repair deferment and so informed service director Vergara. Counsel for the respondent admits that alternate [text redacted] protocols were probably not discussed at the time of the refusals, something he tries to explain by pointing to service director Vergara dealing, in his conversation with the Captain, [text redacted]. In this light, counsel argues that it is readily observable that such a conversation may not have taken place and, somewhat gratuitously, offers the opinion that it would in all probability not have dissuaded the employee from his course of action. Counsel further makes the important admission that it is correct that there is no alternative [text redacted] to a certain safety function of the ALS and that there are no standard operating procedures in this regard.
 A final point of counsel for the respondent’s submissions deals with what the latter has referred to as the “proper focus of the appeal”, and seeks to caution the undersigned to ensure that he focuses solely on the factual situation facing the workers at the time of their refusals as well as their own articulation of the perceived danger at the root of their individual refusals. In this respect, counsel argues that it is not because employees designate a union to appeal a decision on their behalf and to represent them that the appeal expands to cover potential dangers or concerns that were not on their minds when they exercised their right of refusal. Stated differently, counsel again informs the undersigned that he must exercise caution to ensure that an appeal is not used to advance labour relations goals of a union rather than the particular health and safety concerns of the refusing employees, and that I must be diligent, should I grant the appeals, in crafting a remedy that respects the said principle.
 While counsel stated that the respondent is not claiming that the purpose of the refusing employees consists in the advancement of labour relations goals, he submits that the apparent interests of the Union herein have been confused with those of the workers and that it is important that they be kept separate. Counsel bases his opinion in this respect on the choice of terminology by counsel for the appellants, such as “CUPE submits…” as opposed to “the workers submit...” and on certain documentation filed in evidence by the latter and which may have a coverage that exceeds the specific particulars of the refusals being considered in the present cases.
 The disposition sought by the respondent is obviously that I uphold the findings of “no danger” arrived at by HSO Pollock. In the alternative however, the respondent is of the opinion that the additional remedies that are being sought not be granted. Specifically, the remedy sought that no aircraft of any kind be permitted to operate with a malfunctioning cockpit door lock would completely disregard the fact that individual circumstances may affect safety on any day, since the respondent did not, and actually could not take the position that an inoperative door can never be a danger, because this would have to be considered with other circumstances specific to other situations and thus in combination might constitute a contributing factor that would take an otherwise safe event to the level of foreseeable hazard.
 Additionally, counsel notes that the remedy could apply only to the respondent’s fleet of aircraft, thus not affecting other carriers operating Embraer airframes or other types in Canadian airspace or worldwide, causing one to wonder whether a faulty door lock could be seen as a danger only where Air Canada aircraft are concerned. The alternative that Air Canada would propose to the remedy sought would be that within a fixed period of time, it be directed to propose measures that would reduce the possible negative consequences of an inoperative cockpit door lock, such as an enhanced communications protocol between the pilot and the flight attendants. By way of summarizing his submissions and position that the appeals should be dismissed, counsel for the respondent delineates the issue that I must decide as being whether the refusing flight attendants could reasonably be expected to be injured before the cockpit door lock could be fixed. In the latter’s opinion, this should be answered in the negative. In counsel’s view, consideration of statistical evidence is determinative [text redacted].
 [Text redacted].
 [Text redacted]. As such then, the unavoidable conclusion is that it was not more likely, and actually was highly improbable, that the refusing flight attendants would be injured before the cockpit door latch could be fixed, thus not meeting the definition of “danger”.
 In reply submissions, counsel addresses at length the respondent’s own submissions and conclusions on the general basis that they either are founded on a definition of “danger” that is narrower than that which is found in the Code and contrary to the interpretation of that concept by the Courts and appeals officers, are contrary to the evidence concerning the ALS and its associated procedures, their effectiveness and necessity and thus ignore the efforts by aircraft manufacturers, regulators and commercial aviation operators that have gone into the design of the ALS and associated procedures as well as the training for their use, fail to acknowledge that the purposes of the MMEL and MEL are not that of the Code, thus seeking that the undersigned defer to those texts in determining whether non-functioning safety equipment constitutes a “danger”, and also defer to the assessments made by pilots who did not testify at the hearing and the characterization of what they may have said. Furthermore, counsel for the appellants points to erroneous statements by the respondent regarding the definition of “danger”, the role of the appeals officer and some of the evidence.
 On the question of the narrower definition of “danger” proposed by the respondent, the appellants note that while Air Canada contends that a factor of the definition is missing in the circumstances of this case, that being “that injury must be expected to occur before the hazard is corrected”, the actual definition is broader in that it provides that injury must be expected to occur “before the hazard or condition can be corrected, or the activity altered”. Applying this to the facts of the case, the ALS cannot be repaired in flight and as such, if it or its associated procedures are needed on a flight to prevent injury, and it is not functioning, injury will thus “occur before the hazard or condition can be corrected, or the activity altered” to wit, before the ALS is repaired, and thus the factor claimed to be absent by the respondent is actually present in the circumstances of these refusals. Counsel for the appellants points out in this regard that the real argument by the respondent is not that there is a factor of the definition of “danger” that is absent, but rather that it is statistically unlikely on any given flight that the catastrophic events that could be prevented by the ALS or associated procedures will occur, and thus that the ALS and associated procedures are not necessary on any given flight, particularly ones of short duration, thereby negating the actual purpose of the said ALS and associated procedures which is to protect against events and human actions or reactions which are by nature unpredictable.
 Additionally, the appellants describe Air Canada’s argument that it is not the inoperative ALS which represents the danger but rather “the fear of what might occur if something else also happens” while the ALS is inoperative as a distinction without a difference. According to the latter, any safety equipment or procedure is designed to protect against such “something else happening”, and therefore any concern with the failure or lack of safety equipment or procedures is a concern about “what might occur if something else also happens” while the safety equipment or procedures are not available, said absence of such equipment and procedures considered as effective in protecting safety being recognized in and of itself as creating a danger. It is the reply submission of the appellants that like other safety equipment and procedures such as seatbelts, sidearms, two-person armoured truck personnel, the ALS and its associated procedures exist because they are effective against anticipated hazards that have occurred in the past on commercial aircraft and can occur again.
 On the question of the necessity and effectiveness of the ALS and its associated procedures, it is the appellants reply submission that one can derive from Air Canada’s arguments that they are founded on an erroneous premise that the ALS and its associated procedures are unnecessary and ineffective, or of no use, which would explain the latter’s attempt at narrowing the definition of “danger”. This however is contradicted, in the opinion of the appellants, by the significant amount of resources and expenditures that go into the installation of the ALS, establishment of standard operating procedures for its use, training in those procedures and compliance with the regulatory standards requiring the ALS and associated procedures.
 [Text redacted].
 [Text redacted]. The Appellant argues that Air Canada’s submissions imply that the training and SOPs for the use of the ALS are “all frivolous”, an implication directly contradicted by all witnesses, including Ms. Anand for Air Canada, to the effect that these safety procedures are serious and important. On the usefulness or uselessness of the ALS and associated procedures with respect to certain safety and security issues, the evidence indicates that flight attendant could “make a difference”.
 In reply, counsel for the appellants also points to what he describes as Air Canada’s erroneous argument that the role of the appeals officer is displaced by the MMEL. Counsel thus points to the considerable reliance placed by the respondent on the MMEL and its seeking that the undersigned accept that the two flight days “repair interval” addresses safety considerations and that consequently, there can be no danger as defined by the Code, as the flight is MMEL or MEL compliant, “absent specific extraneous factors which might be present on a particular day”. Such an argument is wrong in the opinion of counsel for the appellants, since the safety equipment and procedures in issue in this case are to deal with unpredictable events and the “specific extraneous factors which might be present” to create a danger cannot be known in advance. Couching Air Canada’s argument as being essentially that there is no danger to a flight attendant from a non-functioning ALS unless the flight attendant operates the flight and is subsequently injured on said flight because of the non-functioning ALS, an “after the fact” position that counsel argues has been rejected at case law, more particularly in the Verville and Martin Federal Court and Federal Court of Appeal decisions cited previously.
 As to the Code versus the MMEL and MEL relationship, counsel for the appellants notes that Air Canada argues that the MMEL and MEL deal with more than airworthiness, as evidenced by a number of passages in the preamble of Transport Canada MMEL cited previously where the word “safety” is used repeatedly. The appellants do not dispute the fact that the MMEL pertains to safety. However counsel argues that the MMEL deals with safety or safety of flight from the perspective of airworthiness under the Canadian Aviation Regulations (CARS) and not the Code. What constitutes an “acceptable level of safety” under the Airworthiness Regulations cited in the MMEL preamble or a “required level of safety” pursuant to Transport Canada’s Civil Aviation Regulations Directorate is not necessarily what is required or acceptable under the Code which deals with safety of persons who are employees. In regard to such distinction, counsel for the appellants points to Transport Canada’s actual statement through its Civil Aviation Regulatory Committee (CARC) to the effect that:
After consideration, the CARC concluded that the Canada Labour Code sufficiently addresses A-OSH issues and that the MMEL/MEL policy manual is meant to address flight safety and should not be unduly burdened with requirements which are appropriately covered by other legislation.
 Counsel thus draws the conclusion that while Transport Canada has effectively approved the MMEL, this cannot be said to bring the manufacturer’s MMEL in compliance with the requirements of the Code. As to the two flight days repair interval rationale, it is counsel’s opinion that neither the respondent’s evidence nor its submissions provide any founded information. It is counsel’s view that Air Canada has failed to consider the MMEL from the perspective of the Code, and that from said perspective, the central question becomes whether there is any reason to consider that the ALS is less necessary to protect the health and safety of flight attendants during the two flight day repair interval in the MEL than at other times. According to counsel for the appellants, no such reason has been given in the present case.
 As to the claim by the respondent that three pilots had assessed the flight as safe from both the MEL (airworthiness) as well as the refusing employees perspectives and that the undersigned should defer to this assessment, the appellants note that none of those pilots testified at the hearing into the present appeals, a hearing that is de novo and as such is intended to consider anew all the information received by the HSO without being bound by the latter’s conclusions. According to counsel, an approach such as this by the respondent is simply misleading and ignores the fact that none of the said pilots gave any rationale for the two flight-day repair interval and were satisfied with merely accepting the MEL and its categorization of the repair interval for the ALS.
 A further reply argument by the appellants is directed at what counsel claims are incorrect statements by the respondent regarding the definition of danger and the role of the appeals officer, which counsel argues are an attempt at limiting the scope of my inquiry, one being that I am bound by the materials considered by the HSO, contrarily to my authority to conduct a de novo hearing. In essence, it is the appellants’ view that contrarily to Air Canada’s contention that I must assess the reasonableness of the employees’ refusals, focusing on both the factual situation as well as the employees’ own articulation of the perceived danger, the actual issue under appeal, when one looks at both subsection 129(7) and 146.1(1) of the Code, is whether the circumstances of the work refusal constitutes “danger” within the meaning of the Code, not whether the workers had reasonable cause to refuse to work, and thus I am not limited to the employees’ own articulation of the basis of their refusal, and that I am to decide such issue on a balance of probability, regardless of the appellants’ use of words such as “probable’, “potential” or “probably” in their submissions, terminology that the respondent claims demonstrates the “hypothetical” and “speculative” nature of the danger claimed by the refusing employees.
 Finally, counsel for the appellants points to a number of factual inaccuracies and mischaracterizations in the respondent’s submissions. [Text redacted]. On training and standard operating procedures, while Air Canada has argued that “the fact that employees have received training on a safety procedure and are unable to do what they have been trained to do (due to the inoperative ALS [text redacted] …does not equate to danger” and that “the mere provision of preventative training [text redacted] does not elevate the risk beyond a potential or possible hazard”, counsel for the appellants argues that the purpose of training in safety procedures and first aid is designed to mitigate risks and that Air Canada training being directed at eventualities that it considers important, according to its own witness Anand, with the flight attendants being trained to expect and deal with potential and possible hazards for just that reason that they are potential and possible.
 As to the consistent evidence that there is no precise written procedure (standard operating procedures) with respect to an inoperative ALS but that the pre-flight briefing would serve to establish an alternative [text redacted] protocol, counsel for the appellants notes first that one cannot equate a standard operating procedure to an ad hoc or alternative procedure, second that the evidence demonstrates that no such alternative procedure was discussed in the pre-flight AC 362 briefing and that while the respondent may elect to put the blame for this on refusing employee Vergara’s apparent focus on the resuscitation of pilots aspect rather than on an alternative [text redacted] protocol, such blaming submission ignores the fact that the pilot conducts the briefing and is, according to the respondent’s own witnesses, responsible for advising on alternative procedures and third, that the respondent has explicitly admitted through its counsel that “there is no alternative [text redacted] with an inoperative ALS [text redacted] (and accordingly no SOP in this regard).”
 On the “swiss cheese” model of accident causation analysis, and the proposition by the respondent that this model would stand for the suggestion that there can never be an accident without what is characterized as a “perfect storm”, meaning that if one thing does not go wrong, then the catastrophic event will not occur, an affirmation counsel argues is directly in contradiction to Air Canada’s own witness Anand, counsel for the appellants contends that this constitutes an incorrect description of the model [text redacted].
 [Text redacted]. Noting that a variety of scenarios had been ignored by the respondent, counsel noted that the circumstances of these refusals demonstrated a greater number of known failures than what was proposed by Air Canada. The ALS was not functioning and thus standard operating procedures relative to a functioning ALS could not be followed, there were no back-up standard operating procedures and no alternate ad hoc communication procedures were discussed at the pre-flight briefing.
 On the matter of the suggestion by counsel for the respondent of a hidden Canadian Union of Public Employees (CUPE) agenda towards labour relations ends, and the Montreal workplace health and safety committee recommendation, rejected by the employer based on the MEL approach, that aircraft with inoperative ALS not be dispatched, counsel for the appellants submits that Air Canada is evidently troubled by a union representing its employees in health and safety matters and recognizes that such representation is a matter of dispute between the parties. However, in the latter’s opinion, neither this nor the Air Canada submissions on the subject are relevant to the determination of the present appeals. As for the Montreal committee’s recommendation, albeit rejected, it did represent a recognition by a joint employer-employee committee vested with a health and safety function, that the ALS and its associated procedure are both effective and necessary to prevent injury to flight attendants, a position consistent with Air Canada’s own procedures and training.
 A final reply submission concerns evidence adduced at the hearing concerning other aircraft types and airlines. While the refusals being considered in the present case relate to an Air Canada Embraer 175 airframe flight, considerable evidence was adduced relative to events and incidents involving a variety of airframes and airlines or carriers, and in its submissions, Air Canada formulated the proposition that incidents in other aircraft in different jurisdictions did not relate to the refusing employees concerns, lacked relevance and demonstrated CUPE’s use of this information to put forward its own agenda. In reply, counsel points to the multiplicity of studies on pilot incapacitation and aircraft safety that deal with evidence from multiple jurisdictions and aircraft types and that originate from a variety of organizations that cannot be seen as attempting to advance a labour relations agenda, noting in this regard that Air Canada has offered no evidence that would suggest some feature unique to the Embraer 175 or 190 airframe in preventing pilot incapacitation, admitting on the other hand that there have been pilot incapacitation events on Air Canada Embraers. In addressing this issue of diversified evidence, counsel submits that it is not the “refusing workers concerns” that are at issue, but rather the question of whether in the circumstances of the refusal there was danger.
 In counsel’s view, the Federal Court has indicated in Verville (supra) at para.51 , that such a determination can be arrived at in a variety of ways:
There is more than one way to establish that one can reasonably expect a situation to cause injury. One does not necessarily need to have proof that an officer was injured in exactly the same circumstances. A reasonable expectation could be based on expert opinions or even on opinions of ordinary witnesses having the necessary experience when such witnesses are in a better position than the trier of fact to form the opinion. It could even be established through an inference arising logically or reasonably from known facts.
 Finally, on the matter of a proper remedy, should the appeals succeed, the view expressed by the appellants is that a clear and specific direction is necessary to ensure protection of the employees. On the submission by Air Canada that the undersigned not order the remedy requested by the appellants that, in general terminology, aircraft, particularly Embraers, not be dispatched with inoperative ALS, because such remedy would be applicable solely to Air Canada’s fleet and not that of other carriers, thereby creating a disadvantage for the respondent, the appellants’ position is that this does not differ from any other order directed at a specific employer involved in a work refusal relative to inadequate safety equipment and procedures. As to the suggestion by Air Canada that directed remedial action should be that it be allowed to propose a remedy “that would reduce the possible negative consequences of an inoperative cockpit door lock, for [text redacted] a protocol to address one of the safety and security functions of the ALS and its associated SOPs, the appellants submit that this would do nothing [text redacted] to address another safety and security function of the ALS and its associated SOPs noting that not only has Air Canada not done anything to reduce the possible negative consequence of the inoperative ALS, but it has rejected the recommendation of its own joint workplace health and safety committee that aircraft not be dispatched with inoperative ALS.
 As a first point to this analysis, I believe I should clarify from the outset that I share the view expressed by respondent counsel that in dealing with the present matter, which concerns refusal action by employees, what needs to be at the center of the undersigned’s consideration are the individual circumstances of the refusing employees at the time of their exercising their right of refusal and that as such, I must not let myself be led astray by considerations or opinions expressed by parties that could have a wider coverage, impact or purpose than just those personal considerations and circumstances of the refusing employees.
 In this respect however, I also am of the view that in doing what the Code identifies as a summary inquiry into the circumstances of the direction or decision of a health and safety officer under appeal, in attempting to understand the substance of the issues before me and in rendering an informed and useful decision, I can and must take into account general information that, while not concerning specifically the circumstances of the employees concerned, may deal more generally with the substance of the issues at hand. I have felt compelled to make this statement at the present juncture due to the fact that in the present personal cases, most of the information provided to the undersigned for the purpose of decision has been of a general nature, useful for the determination but not specifically restricted to the individual circumstances of the individual refusing employees.
 Additionally, and quite briefly, it has been a point of contention by the respondent throughout the hearing of this matter that the appellants selecting CUPE to represent the former in these proceedings, CUPE in my understanding being the bargaining agent of the employees of the respondent, may have signified that the issues raised and conclusions sought have or may have deviated from that which would represent the specific interests of the refusing employees to some wider ranged labour relations purposes or goals. On this, I must first point out that as regards appeal proceedings, the Code is silent as to the representation of parties to such, meaning in my opinion that any party enjoys the freedom to seek and obtain representation of its choice, absent certain restrictions and limitations that could pertain to conflicting interests, such needing to be properly considered and decided upon by the appeals officer mandated to conduct the actual proceeding.
 Secondly, I must add that while I have remained attentive throughout to the said contention by counsel, and of the requirement that my determination remain directed at the circumstances of the refusing employees, I have not formed the opinion that wider labour relations purposes were the object of the case put forth by counsel acting for the appellants. For me to arrive at such a conclusion would require more than what respondent counsel has described as revealing “terminology” on the part of counsel for the appellants that would presumably serve to raise “red flags” or warnings, reference to certain past union or workplace committee actions that the undersigned would view as information destined to allow for a more complete understanding of the issues raised by the employees’ refusal action, or some specific remedial action part of a proposed selection suggested to the consideration of the undersigned.
 These appeals seek to have the undersigned overturn the conclusion of absence of danger arrived at by HSO Pollock by determining in the affirmative, to use the wording of counsel for the appellants, that non-functioning safety equipment on board an Embraer 175 aircraft results in danger within the meaning of the definition of said term at section 122 of the Code. To add some necessary substance to that statement, one needs to note from the start that what both parties are asking the undersigned to consider and what I have effectively considered in weighing the evidence and analyzing their submissions, is not whether the inoperative equipment, described as the Cockpit Security Automatic Latching System or ALS, in and of itself, constitutes or results in danger where the aircraft is standing idle on the tarmac, thus not in so-called operation and to which applies a regulatory borne system of repair deferment. Rather, the parties are asking the undersigned to consider and I have effectively considered whether the inoperation of that equipment creates or results in danger where said aircraft goes into operation, essentially in movement and flight, and circumstances, described as “extraneous” to the actual non-functioning apparatus, may occur where cabin crew members, flight attendants, may be needed to and prevented from properly communicating with and/or accessing the flight deck and thus prevented from providing to the flight deck crew, the pilots, the support and assistance for which the former have been trained, thereby creating a reasonable expectancy of injury, said circumstances being described by the respondent as being unlikely to the point of being hypothetical and speculative, and by the appellants as being real albeit rare.
 The hazards around which both sides have centered their submissions are [text redacted] certain safety and security conditions. Given this, I agree with what counsel for the respondent describes as being the danger claimed by the refusing employees to wit, that it is not the inoperative door latch, but rather the “fear of what might occur if something else also happens with the ALS inoperative”, and while I understand what counsel meant to say by using the word “fear”, it is important in my opinion to bring more specificity to the description by pointing out that “danger” is defined in the Code in terms of “hazard”, “condition” and “activity”, and that although the definition does not spell it out in so many words, that the said “hazard”, “condition” or “activity” must be looked at as occurring in the work place, therefore the cabin and the cockpit of the aircraft in the cases at hand.
 Although the parties did not spend much time in actually bringing precision to the actual notion of “danger” raised in the present cases, their submissions make it clear that what is considered as “hazard” or “condition” is made up of a combination of elements looked at as a whole, to wit first, a non-functional ALS coupled with the lack of standard operational procedures for such a situation, the absence of alternate procedures and the inability to apply SOPs that would normally apply to a functional ALS, [text redacted] combined with threats to safety and security that the ALS and its SOPs are designed to prevent. It is thus the combination of these elements that needs, in my opinion, to be viewed as the claimed “danger”. While through their lengthy submissions, both counsel have appeared to have a fairly common view in this respect, I feel it is necessary for the undersigned to indicate that I consider respondent counsel’s assertion that the actual real danger raised by the refusing employees is the risk of a catastrophic event as being overly reductive of the circumstances that have been put forth by the latter to claim potential injury, as prescribed by the Code. To return to the words of counsel for the respondent, in the world of air transportation, accidents are bound to happen, just as they will happen where other modes of transportation are concerned, and injury may result from those without the end result being a catastrophic event such as what those terms imply in the world of aviation.
 [Text redacted]. For our purpose, it is not necessary here to offer a more detailed description of its functioning.
 Additionally, the undisputed evidence is that the said ALS for FIN #380 was non-functional and would have remained non-functional for all of flight AC362 as neither party suggested that it could have been restored to functionality during the flight, if needed. This being said however, I cannot ignore in my determination the admission made by the respondent regarding an inoperative or non-functional ALS. The evidence is to the effect that at Air Canada, the use and functioning of the ALS is governed by a set of established standard operating procedures that flight attendants are required to follow [text redacted]. Those standard operating procedures are part of the training and recurrent training received by flight attendants.
 The situation however is different in the case of an inoperative ALS. In such a case, the evidence has shown and the respondent has readily recognized that there are in case of the function of the ALS with respect to some threats, no alternatives; and no alternative SOPs. [Text redacted]. Furthermore, the evidence from both sides was to the effect that as part of the required pre-flight briefing on the day of the flight that was the subject of the work refusal, the ALS and its non-functionality were discussed by Mr. Vergara and the Captain, and that in those circumstances, it was expected that alternate - [text redacted] procedures to deal with the issues arising from the inoperative ALS situation were to be part of the Captain’s briefing. Again, testimony has indicated and the respondent has recognized that such discussion on alternate
[text redacted] procedures probably did not occur. Whether this could be attributed or not to the fact that refusing employee Vergara may have at that time focused on what he perceived as his inability to [text redacted] does not serve to alleviate what I consider a clear shortcoming on the part of the Captain.
 [Text redacted].
 This being said, a number of provisions of the Code are central to the consideration of the issue raised by the present appeals. First, there is the actual definition of the term “danger”, previously cited, which comprises a number of elements, counsel for the respondent used the term “factors”, that need all to come into play in order for an affirmative conclusion of such to occur. Stated differently, all the elements of the definition need to be satisfied for a finding of “danger to be arrived at. Considering solely this definition, determining whether flight AC362 would present or have presented a danger to the refusing employees necessitates that I draw answer from the evidence and the parties’ submissions to the following questions:
- was there an existing or potential hazard or condition or any current or future activity in place on September 14, 2010 ?
- could exposure to such hazard, condition or activity be reasonably expected to cause injury or illness to a person exposed to such?
- could said injury or illness be caused before such (existing or potential) hazard or condition or (current or future) activity be corrected or altered, in other words, could the hazard, condition or activity be corrected or altered before injury or illness was caused?
With respect to this last question, it is important to mention anew that it is uncontested and is supported by the evidence that the non-functioning ALS at the center of the issue raised in this case could not have been restored to functionality during the flight about which refusals to work were registered.
 As a consequence, there are a number of conclusions that one can reach from the outset. First, one can safely conclude that with the pre-conditions described in the first two questions materializing (existence and exposure to a hazard, condition or activity capable of causing injury), the possibility of injury or worse occurring as a result of the remaining non-functioning ALS would be real before the hazard or condition could be corrected. Furthermore, as concerns the second question, given the condition claimed by the refusing employees to wit, admitted impossibility [text redacted] of performing certain functions to prevent threats to safety and security that could be performed with a functioning ALS and given the nature of the activity involved to wit, providing service onboard an aircraft in flight, on the assumption or hypothesis that the claimed hazard, condition or activity materialized, I have little doubt that exposure to such offers a reasonable expectation of injury, as has been supported by testimony at the hearing.
 There are, however, other provisions of the Code that need to enter into the equation in making my determination on whether there was a danger at the time of the refusals. First, any such determination must take into consideration the actual purpose of the legislation, stated at section 122.1 of the Code as being prevention rather than reaction and thus in some respect, marking a certain prospective characteristic to the notion of “danger” in the workplace. That provision states that the “purpose of this part is to prevent accidents and injury to health arising out of, linked with or occurring in the course of employment to which this part applies” (underlining added).
 In addition, without suggesting that the right of refusal to work guaranteed to employees coming under the purview of the Code is any less for persons employed on an aircraft, it is nonetheless important to note that in the case of said employees, subsections 128(3) and (4) of the Code state that the exercise of such refusal right, which is personal and intended to protect the person, may be curtailed for the sake of the safe operation of the vehicle that is the aircraft, regardless of whether there may be a danger to the said employee while the aircraft remains in operation. In other words, in the case of an aircraft in operation, the Code itself distinguishes to a certain extent between the actual safe operation of the vehicle that is the aircraft and the safety of the persons who may be at work onboard the aircraft while it is in operation, bringing evidently to the fore the arguments of both parties regarding the MEL and the notion of airworthiness.
 This does not mean that such persons may not refuse to work, but the legislation does however establish two phases of refusal, one when the aircraft is not in operation and refusal may be exercised in the same manner as for any other employee and for the same reasons, and another when the aircraft is in operation and where the exercise of such refusal right, which may or may not end in a finding of danger, is dependent upon the decision of the person in charge of the aircraft, in other words the pilot/captain, as to whether said employee may exercise such right. This also, in my opinion, serves to legitimize the prospective exercise of their right of refusal by the appellants in the circumstances where at the time they did, the aircraft not being in operation, there did not exist a danger in those circumstances but one was claimed to potentially exist where the aircraft would ultimately be in operation. One can also quite readily conceive, on the basic assumption that the circumstances recounted by the appellants to justify their refusals represent a danger, which I have yet to determine, that the claiming of a danger to the pilot/captain for the purpose of exercising that refusal right, would be somewhat problematic if not illusory. For the sake of clarity, subsections 128(3), (4) and (5) read as follows:
128. (3) If an employee on a ship or an aircraft that is in operation has reasonable cause to believe that
- (a) the use or operation of a machine or thing on the ship or aircraft constitutes a danger to the employee or to another employee, or
- (b) a condition exists in a place on the ship or aircraft that constitutes a danger to the employee,
- (c) the performance of an activity on the ship or aircraft by the employee constitutes a danger to the employee or to another employee,
the employee shall immediately notify the person in charge of the ship or aircraft of the circumstances of the danger and the person in charge shall, as soon as is practicable after having been so notified, having regard to the safe operation of the ship or aircraft, decide whether the employee may discontinue the use or operation of the machine or thing or cease working in that place or performing that activity and shall inform the employee accordingly.
(4) An employee who, under subsection (3), is informed that the employee may not discontinue the use or operation of a machine or thing or cease to work in a place or to perform an activity shall not, while the ship or aircraft on which the employee is employed is in operation, refuse under this section to operate the machine or thing, to work in that place or to perform that activity.
(5)For the purposes of subsections (3) and (4),
- (a) […]
- (b) an aircraft is in operation from the time it first moves under its own power for the purpose of taking off from a Canadian or foreign place of departure until it comes to rest at the end of its flight to its first destination in Canada.
 Having regard to this, I note the statement made by counsel for the respondent that the analysis I must make of this case is restricted to “the situation as experienced (“as it existed”) by the refusing employees at the time of their refusals”, a statement with which I am in agreement and to which counsel for the appellants has not objected. At the same time, given the wording of subsections 128(3), (4) and (5) above and my comprehension of such, for the purpose of determining the validity of the refusals for danger, I have considered and treated the situation of the refusing employees at the time of their refusals as encompassing both the aircraft pre-operation and operational phases, as doing otherwise and limiting my examination to the specific time of the exercise of the refusals, to wit when the aircraft was on the ground and non-operational for the purpose of the Code, the only conclusion that could be arrived at relative to the feared circumstances of the refusing employees would every time be a conclusion of absence of danger.
 Over the years since the Code underwent major amendments in 2000, the notion of “imminent” or immediate danger has been removed from the concept of danger. A considerable body of case law on “danger” and its determination has since been developed both by appeals officers and by the Courts, primarily the Federal Court and the Federal Court of Appeal. In presenting their case, both sides have supported their submissions by citing many of those precedents. I have found however that two decisions generally enunciate the guiding elements that one needs to observe in making such a determination. Those decisions are Verville and Martin and they have provided the undersigned with the necessary guidance in making my determination.
 The following can be derived from those decisions. In Verville, the Court noted that contrary to the pre-amendment definition of “danger” that indicated an intention that immediate work would not expose an employee to a dangerous situation, thus putting the accent on the short-term well-being of employees, the addition in the definition of words such as “potential” or “eventuel” and future activity meant that the Code is not limited to specific factual situations existing at the time of a refusal to work by an employee. In point of fact, the Court specifically stated that these two words qualifying hazard or condition in both versions of the definition (potential and éventuel) do not exclude a hazard or condition which may or may not happen based on human behaviour, stating that “if a hazard or condition is capable of coming into being or action”, it should be covered by the definition of “danger”. Furthermore, the Court also stated that it would not be reasonable to expect that injury would result every time a condition or activity occurred and, referring to the French text of the definition, that the words “susceptible de causer” indicate that the condition or activity “must be capable of causing injury at any time but not necessarily every time”.
 In addition, in the same decision, it is stated that in determining whether a danger exists, it is not the specificity of occurrence that needs to be established, but rather that there is a reasonable possibility of the circumstances liable to result in injury occurring. In the words of Madam Justice Gauthier:
 […] I do not believe either that it is necessary to establish precisely the time when the potential condition or hazard or the future activity will occur. I do not construe Tremblay-Lamer’s reasons in Martin […] to require evidence of a precise time frame within which the condition, hazard or activity will occur. Rather, looking at her decision as a whole, she appears to agree that the definition only requires that one ascertains in what circumstances it could be expected to cause injury and that it be established that such circumstances will occur in the future, not as a mere possibility but as a reasonable one.
Finally, and I find this to be essential in the present case, the Federal Court in the Verville decision gave clear indications on the manner of evidencing the reasonable potentiality of injury while also pointing out that similitude of injury causing circumstances is not a requirement. Madam Justice Gauthier noted that there is more than one way to establish that one can reasonably expect a situation to cause injury, (and that) one does not necessarily need to have proof that (a person) was injured in exactly the same circumstances. A reasonable expectation could be based on expert opinions or even opinions of ordinary witnesses having the necessary experience when such witnesses are in a better position than the trier of fact to form the opinion. It could even be established through an inference arising logically or reasonably from known facts.
 [Text redacted].
 Such statistical data constitutes evidence of past occurrence that one could describe as anecdotal, evidence that in Martin the Federal Court of Appeal has indicated can be considered in ascertaining the reasonable injury causing potentiality of certain circumstances:
I agree that a finding of danger cannot be based on speculation or hypothesis. However, when attempting to ascertain whether a potential hazard or future activity could reasonably be expected to cause injury before the hazard could be corrected or the activity altered, one is necessarily dealing with the future. Tribunals are regularly required to infer from past and present circumstances what is expected to transpire in the future. The task of the tribunal in such cases is to weigh the evidence to determine whether it is more likely than not that what an applicant is asserting will take place in the future.
It is important to note that the statistical data on pilot incapacitation in evidence concerns not only carriers in other jurisdictions and even other times, but also Air Canada for the period 2003/2010 where 17 cases of pilot incapacitation have reportedly occurred, a number corrected to 22 by counsel for the respondent, with at least one case of dual pilot incapacitation.
 [Text redacted].
 [Text redacted].
 [Text redacted]. (These paragraphs describe submissions and evidence concerning occurrence of conditions that could require flight attendants to use the ALS and associated SOPs. Evidence was offered regarding occurrence of those conditions with many of those instances actually concerning past Air Canada flights. The effect of these occurrences could constitute a condition that given certain circumstances, such as a non-functional ALS, could be viewed as “danger”.
 In this respect, counsel for the respondent has argued that the fact that at the time of the refusals, thus prior to the actual flight departing, there were no premonitory indications of possible [text redacted] conditions that could require flight attendants to use the ALS and associated SOPs, thus reducing even more the potential of something untoward occurring during that non-functional ALS flight that would constitute a reasonable expectative of injury. In my opinion, this has no impact on my determination since one would certainly expect that if such indications had existed, and in essence one must retain the unpredictability of such elements, corrective action of some sort would have been taken by the respondent, such as a change to the flight crew or the non-dispatch of the flight until the threat had dissipated. In this respect, I share the view expressed by counsel for the appellants [text redacted] that even where conditions described in paragraphs 137-139 do not affect all flight deck crew it is necessary for the security of the aircraft and therefore that of everyone onboard, including flight attendants, [text redacted] that the functions performed by the ALS be possible.
 The mainstay elements of the respondent’s position in this case in claiming that the potential of the danger raised by the refusing employees is so remote as to be hypothetical and speculative, are the rarity of pilot incapacitation and the MEL, or rather the MEL’s two day repair deferment provision in the case of the ALS that would found a conclusion that the hazard or condition and thus the injury or illness that could reasonably result would be so remote that there would be no reasonable probability of occurrence prior to the repair being effectuated. HSO Pollock, in her decision, was clearly influenced by the presence and impact of the MEL, as was, one needs to add, the captain of the flight who actually only invoked the MEL in dealing with refusing employee Vergara. Added to this would be the short duration of the flight concerned by the refusals which would serve, according to the respondent, to reduce even more the potential for occurrence of both the incident(s) on board the aircraft as well as the possibility of injury or illness. The appellants have argued that said MEL is irrelevant to the determination of this case as it does not address health and safety matters and concerns only the safe operation of the aircraft from an airworthiness perspective. The respondent has however maintained that the MEL deals with safety and since sanctioned by Transport Canada, suffices in ensuring, again given the short repair deferment period, in preventing a “danger” such as what is raised by the refusing employees and, as defined by the Code, as existing.
 It is thus necessary for the undersigned to comment on the nature of such MEL. First, the MMEL and the MEL are policy and procedures manuals, the result of the exercise by Transport Canada of its regulatory authority under the CARS (Canadian Aviation Regulations), therefore delegated authority, and any reference to the said MEL must take into consideration the position expressed by the Civil Aviation Regulatory Committee (CARC) of Transport Canada which has effectively recognized the distinction between the coverage by the Code of Aviation Occupational Health and Safety (AOSH), which is the subject of the work refusals and HSO decision in the present cases and the notion of “safety of flight” which concerns, as clearly expressed in the MEL and the MMEL, maintenance and operations from an airworthiness perspective. The CARC has thus stated that “[…] the Canada Labour Code sufficiently addresses AOSH issues and […] the MMEL/MEL Policy Manual is meant to address flight safety and should not be unduly burdened with requirements which are appropriately covered by other legislation”.
 Second, while I do have to recognize, as stressed by the respondent in referring the undersigned to the text of the MMEL and MEL, that these documents mention numerous times “safety” and “acceptable level of safety” and “required level of safety”, the said “safety” must be understood to relate to “airworthiness”, a concept that concerns, as previously mentioned, the capacity of the aircraft to fly and maintain flight, and thus does concern primarily the vehicle that is the aircraft, relative to its maintenance and operations, not occupational health and safety, which concerns the safety of persons at work onboard the vehicle, obviously in addition to the passengers. There is no doubt, when adhering to this perspective, that the actual operation of an aircraft with a non-functional ALS does not affect its capacity to fly, its airworthiness, whether this term is interpreted strictly or more generally, and counsel for the respondent has clearly adhered to that position in emphatically stating that the MMEL, and thus the MEL it gives rise to, address relative safety concerns in respect of the operation of the aircraft, and that an inoperative ALS in no way affects the airworthiness of the aircraft since, to use the words of counsel, [text redacted] with the MEL conditions met, the aircraft will fly and certain safety concerns are met.
 This begs the question however of what if [text redacted] other safety concerns are not met. There is no doubt that where an aircraft operates and continues to operate safely, the safety of its occupants, absent extraneous circumstances, is preserved because of the safety of flight. That is specifically recognized in a letter by the Chief of Regulatory Affairs at Transport Canada to the Air Canada Pilots Association, wherein it was stated relative to the exclusion of Code provisions from the MMEL/MEL that “there is a need to differentiate the approaches of OSH, with its focus on the health of individual employees, with those systemic approaches addressing overall flight safety”. In other words OSH safety is not the “safety” that the MEL and MMEL refer to. Consequently, I am of the view that the MEL and MMEL are of limited, if any, relevance to the determination of the issues at hand, issues that have to do with occupational health and safety, except for the fact that the MEL makes it clear that the need for pilot assessment of airworthiness, which may take into consideration many additional factors, is not eliminated.
 Much has been made in this case of the “Swiss Cheese” model of accident causation analysis used by the respondent which is based on the concept of multiple layers of defence against an accident, the “defences in depth” concept, which simplistically expressed, would see numerous modes or means of defence intervening against an outcome, with one failure being compensated by the intervention of other modes or means, each of those layers of defence containing figurative holes that are not static and realign as events develop to avoid or result in a final or disastrous outcome. Counsel for the respondent has argued that as long as one layer of protection remains, there cannot be a finding of danger. In this case, respondent’s position is that there was only one layer of defence (“one hole”) missing, that being the inoperative ALS. The appellants on the other hand have maintained that the removal of a single layer of defence increases the risk or likelihood of an accident. Respondent’s own witness recognized that where the flight in this case is concerned, multiple failures or holes were present, those being unserviceable safety equipment and the lack of standard operating procedures for the operation of the flight with the unserviceable equipment. I would add that the evidence is also that no alternate procedures for [text redacted] the SOPs associated with a functioning ALS were discussed or established at the pre-flight briefing by the Captain. This must also be viewed with the admission by the respondent that [text redacted] certain functions of the ALS were impossible with an unserviceable ALS.
 Finally, apart from evidence being offered relative to the need for flight attendants to maintain situational awareness at all times and the existence of certain [text redacted] protocols for flight attendants evidently surmising the capacity to act [text redacted] in a manner contemplated by the ALS and its associated SOPs no evidence was offered of other layers of defence being available, in the circumstances raised by the refusing employees, [text redacted] of certain threats to safety and security that would serve to counterbalance the removal of the significant layers of defence mentioned above for the operation of that flight where it would be reasonable to expect that these defences could be needed. In my opinion, the apparent good physical and/or psychological health of the flight deck crew or the lack of possible mechanical defects or shortcomings indications should not be viewed as Swiss Cheese layers of defence and this, for the reasons I previously mentioned.
 Furthermore, apart from the inference that the airworthiness/safe operation of the vehicle that is the aircraft would not be affected by the lack of a functioning ALS for two flight days, no evidence was offered, in my opinion, as to the rationale for allowing the aircraft to operate in this way, nor was there any suggestion that the potential reasons invoked by the refusing employees for their action, [text redacted] would not or could not, in the words of counsel for the appellants “would be suspended”, for the two flight days, indeed for the duration of that specific flight, while the aircraft would be flying without a functioning ALS. Counsel for the respondent did point out that witness for the respondent De Savigny explained that the MEL fix times are based upon a consideration of what he described as the “next worse failure” anticipated to occur with that particular defect unfixed, and that as such, according to counsel, the probability of occurrence of that ”next worse failure” was of critical importance in determining that the hazard could be reasonably expected, the Federal Court of Appeal in Martin saying “more likely than not”, to cause injury or illness before it could be corrected. I would only comment on this that in my opinion, given the purpose and intent of the MMEL and the MEL relative to maintenance and operation, the words used by Mr. De Savigny do not relate [text redacted] to the conditions that could require the use of the functioning ALS and associated SOPs.
 At the hearing and in written submissions, both parties devoted considerable attention to the training received by flight attendants in safety procedures, including emergency and security, be it at the initial stage of employment or recurrent annually. Stemming from the 9-11 events which resulted in the development of flight deck security doors and the ALS by the aviation industry, the consequent regulatory framework dealing with flight deck door addresses the possibility of [text redacted] certain types of threats. HSO Pollock’s report and testimony indicated that the CARS and standards (Commercial Air Service Standard) adopted pursuant to the CARS contemplated the threats to safety and security that the ALS and its associated SOPs are designed to prevent. Testimony at the hearing by Ms. Anand for the respondent was that the CARS training for these eventualities is because the “industry suspects it may happen.” The rigorous training given to Air Canada flight attendants covers safety procedures (emergency and security) dealing specifically, although not exclusively with the use of [text redacted] the ALS and procedures for the threats to safety and security that the ALS and its SOPs are designed to prevent.
 Having examined the material submitted in evidence regarding the training provided to the respondent’s employees, one is necessarily brought to the conclusion that much expenditure and effort has been devoted by the industry and the respondent to training, a considerable part dealing with emergency procedures and use of a functioning ALS, and that this must be because it is considered important. It was the testimony of Ms. Anand for the respondent that “we consider what it will cost but it doesn’t deter us from what we’ll train, safety”, and that the probability of occurrence was a factor in deciding what to include in such training. This being said, and both parties being in agreement as to the importance and content of the training given to flight attendants, I find myself in the presence of two very distinct positions as to the impact that this should have on my determination, actually two positions with which I have no fundamental disagreement.
 As to the fact that flight attendants are given training on hypoxia and resuscitation, counsel for the respondent has objected to this being considered, as appears to be the case for the appellants, as an indication in and of itself that a present and anticipated danger is existent. In the opinion of counsel, while flight attendants receive training on many possible scenarios, the mere provision of preventative training does not represent recognition of an existing danger and does not elevate the risk beyond a potential or possible hazard. I agree with counsel that the mere provision of preventative training does not automatically equate to more than recognition that what one is being trained to deal with might happen.
 For his part, counsel for the appellants’ position can be reduced to the simple approach that if the employer has devoted so much effort and expenditure to training its flight attendants, it has to be for a purpose. In his written submissions, counsel expresses the position as follows:
the equipment, training in its use, training materials and the establishment of procedures have all cost a significant amount of money. All of the evidence indicates that the decision to devote resources to the ALS was a serious one, made in recognition of the important issues of safety involved. The equipment, training and procedures are in place because Air Canada expects them to be needed.
I have no disagreement with that position, to the extent that the said expectation by the employer that the training, equipment and procedures will be needed does not constitute a certainty or apprehension that what the training is designed to apply to will occur, but merely that should it occur, the respondent’s flight attendants will have the “tools” necessary to act remedially in the situation.
 [Text redacted].
 [Text redacted]. (These paragraphs describe the nature and frequency of occurrences of certain conditions that could require flight attendants to use the ALS and associated SOPs.)
 This being said, both counsel have opposing views as to the meaning the undersigned should give to such data. For the respondent, the extreme rarity of such [text redacted] occurrences and even more so that of [text redacted] a particular type of occurrence takes the hazard or condition invoked into the realm of the speculative and hypothetical and that as such, in the circumstances of the present cases, it could not be reasonably expected to cause injury before corrective action was taken. For the appellants, the statistical data serves to show that [text redacted] a general type of occurrence has occurred in the past, and counsel has argued that nothing indicates that it will not or could not happen in the future. I share the view expressed by counsel for the appellants. Rarity, a notion that is common to the arguments made by both sides, appertains to frequency, not reality of occurrence, and frequency is not an element of “danger” as defined in the Code. Where one cannot determine when or how often an incident such as incapacitation will occur, the past may attest to the future, such that one can conclude that it is reasonably possible that it will occur in the future. In support, I cite again the words of the Federal Court of Appeal in Martin (supra):
[…] a finding of danger cannot be based on speculation or hypothesis. However, when attempting to ascertain whether a potential hazard or future activity could reasonably be expected to cause injury before the hazard could be corrected or the activity altered, one is necessarily dealing with the future. Tribunals are regularly required to infer from the past and present circumstances what is expected to transpire in the future. The task of the tribunal in such cases is to weigh the evidence to determine whether it is more likely than not that what an applicant is asserting will take place in the future.
 Having regard to my earlier conclusion to the effect that the “danger” that I am asked to determine represents, in the circumstances herein, a combination of elements [text redacted] (certain elements are identified in the decision) the argument by the respondent on the statistical data that the possibility of occurrence is so remote as to be hypothetical and speculative also raises the notion of foreseeability, given existing pre-flight conditions of the aircraft and the flight deck crew that would not have led one to envisage the possibility of that which the refusing employees feared occurring, happening during a limited duration flight and, under the MEL, a short repair deferment period. On this, I do not share the opinion of counsel for the respondent which is based on shortness of duration, as this would ignore, in my opinion, the nature of what an accident or incident is and, in this respect, I make mine the opinion formulated by Vice-Chairperson Pineau of the Canada Industrial Relations Board in K.G. Lequesne and Canadian National Railway Company, 2004 CIRBD 276, on what constitutes an accident using the definition of such in the Concise Oxford Dictionary:
An accident or incident is an event that happens by chance or without apparent cause at some unforeseeable time. (…) A remote possibility is a possibility nonetheless. Part II does not provide a “remote possibility” as rationalization for unsafe work conditions.
 I have not dealt at any length with the second reason for refusal invoked by refusing employee Caron, [text redacted]first, because the determination described above relative to an inoperative ALS would decide the appeal made by all three employees, and second, because that same rationale would apply to the second reason for refusal invoked by Ms. Caron.
 Briefly stated, the elements that I have retained from the evidence and the submissions of the parties to bring conclusion to this matter are, in short:
- an inoperative ALS that could not be returned to functionality during the flight that gave rise to the work refusals by the three appellants;
- [text redacted] the impossibility for flight attendants to perform the certain functions to deal with threats to safety and security with a non-functional ALS;
- the inability in the above circumstances for flight attendants to make use of their extensive and rigorous training to provide assistance to the flight deck crew members;
- the lack of standard operating procedures for flight attendants (cabin crew) to follow in the case of a non-functional ALS;
- no back-up equipment for a non-functional ALS in respect of [text redacted] certain safety and security functions;
- the absence of alternate procedures for [text redacted] performing certain safety and security functions of the ALS being discussed or determined by the Captain at the pre-flight briefing;
- the reasonable possibility of occurrence of [text redacted] certain conditions that could require flight attendants to use the ALS and associated SOPs due to various causes;
- the inapplicability of the MEL and thus the precedence of the Code as concerns matters and issues of occupational health and safety within the aircraft and thus not the actual operation of the said vehicle.
In light of all this, I have reached the conclusion that at the time of the refusals to work by the three employees concerned, there existed a potential hazard or condition relative to flight A362 that could reasonably be expected to result in injury to the refusing flight attendants before the hazard or condition could be corrected. Consequently there was a “danger” within the meaning of the Code.
 Subsection 145(2) of the Code stipulates that once a conclusion of danger has been reached, a direction will necessarily be issued for the purpose of correcting the hazard or condition or alter the activity that constitutes the danger, or protect the person(s) from the danger. The wording of the statute indicates that this obligation applies to the health and safety officer who makes the finding of danger. Subsection 145.1(2) of the Code on the other hand stipulates that for the purposes of appeals pursuant to section 146, an appeals officer has “all the powers, duties and immunity” of a health and safety officer, and pursuant to paragraph 146.1(1)(b), may issue any direction considered appropriate under subsection 145(2) or (2.1) of the Code, thus a direction directed at correcting the hazard or condition or alter the activity that constitutes the danger or protecting the person(s) from the danger. Therefore, an appeals officer has the same duty as a health and safety officer.
 This being said, one must be mindful that the wording of the Code implies that the direction shall issue where there is something to correct or to protect from. In the present cases, in anticipation of my possibly reaching the conclusion of danger that I have arrived at, both parties have suggested a number of remedial actions that could constitute an appropriate direction. In the case of the appellants, counsel has suggested a variety of directions ranging first from the obvious to wit, that I order that the aircraft at the center of these refusals, FIN #380, not be dispatched, meaning be grounded, until its cockpit security ALS be “fully operative”, to ordering that Air Canada cease and desist from dispatching any aircraft with an inoperative cockpit security ALS, or ordering any further relief and remedies that counsel may advise or the appeals officer deem appropriate, to finally, in the alternative, given the similarities between Embraer 175s and 190s, that I direct that Air Canada cease and desist from dispatching any such Embraer airframe with an inoperative cockpit security ALS. The respondent, not surprisingly, has requested that the additional remedies beyond the grounding of FIN # 380 not be granted first, because this would be going beyond the particular circumstances specific to the refusing employees, and thus beyond the conditions germane to these refusals, and secondly, because issuing such far reaching remedy would “completely disregard that individual circumstances may affect safety on any particular day”. In this regard, counsel pointed out that in the present cases “Air Canada did not (and in fact could not) take the position that an inoperative door can never be a danger. Rather it, combined with other circumstances, might be a contributing factor which takes an otherwise safe event to the level of foreseeable hazard”.
 While, in my opinion, this opinion by counsel for the respondent is somewhat too restrictive, I nonetheless agree with its general intent. Stated briefly, as was also stated previously, the object of the present appeals must and needs to be restricted to the circumstances of the refusing employees and the specific circumstances of their situations at the time of the refusals, and thus, in my opinion, remedial action suggested by the appellants that would exceed the particulars of the situation reviewed at appeal would not be appropriate. This being said however, consideration of what remedial action to order necessarily involves also considering whether, at the time of formulating such remedial action, therefore once the matter has been heard and determined at appeal, remedy in the circumstances of the refusals and the refusing employee(s) is still required.
 While the evidence clearly demonstrated, actually the matter was not even contested by the respondent, that at the time of the refusals by the appealing employees, the cockpit security ALS for FIN#380 was not functional and the flight actually was dispatched as such, the evidence in the present cases is also that while under the Embraer MEL, the respondent needed to have the cockpit security ALS repaired, and thus operational, within two flight days, the said FIN #380 ALS was again operational within one day of the refusals, and no evidence has been presented to the undersigned that at this time it is not operational. This being said, having in mind the wording of paragraph 146.1(1)(b) relative to my discretion to issue a direction that I would consider appropriate, it is my opinion that since the FIN#380 ALS is operational, no remedy need be ordered and thus no direction would be appropriate and consequently none will be issued.
 For all the reasons stated above, the decisions of absence of danger issued by Health and Safety Officer Pollock on September 28, 2010, are rescinded.
Report a problem or mistake on this page
- Date modified: