2014 OHSTC 7

A) Appellants’ submissions

[17] Counsel for the appellants offers a simple description of the salient facts relative to the circumstances of the refusals. The ALS was not functioning and the flight refused by the flight attendants was to a major U.S. city, therefore a country where major terrorist activity involving aircraft operation had occurred in the past. The flight attendants themselves were concerned with [text redacted] inability to use said ALS [text redacted] and thus inability to follow standard operating procedures associated with the operation of a functioning ALS, or alternate operating procedures. Notwithstanding the non-functioning ALS system, no alternative procedures were discussed during the required pre-flight briefing. On this last point, counsel referred to the uncontradicted evidence from Service Director Vergara to the effect that during the standard, and actually mandatory pre-flight briefing with the captain, no procedure was described for operating the flight without a functioning ALS [text redacted]. Mr. Vergara’s testimony was that the captain merely advised that the ALS was not functioning and described the applicable MEL provisions.

[18] Central to counsel for the appellants arguments are the nature and purpose of the ALS [text redacted]. Along those lines, testimony was received that prior to the New York incidents of 9-11, there were no real issues relative to cockpit doors, and that it is only after those events that were developed the reinforced or “hardened” flight deck doors [text redacted].

[19] [Text redacted].

[20] [Text redacted].

[21] [Text redacted]. In point of fact, counsel has argued that a conclusion can be derived from all the witnesses that were heard in this case, regardless of their status, that conclusion being that there are no standard operating procedures in place for cabin crew when a plane is operating without a functioning ALS [text redacted].

[22] Counsel for the appellants derived from a number of indicators that there is a widespread expectation that the ALS will be needed for its safety functions, as supported at least by industry actions and the mere fact that the employer is providing training and recurrent training on this, and that from a general standpoint, it can be argued that dangerous conditions will arise if a safety device has no back-ups and is not functioning. In doing so, counsel noted that Air Canada witness De Savigny replied to the undersigned that the logical outcome to the hypothetical situation put forth of [text redacted] certain conditions and a non-functional ALS, would be catastrophic, to wit a crash. That being said, the indicators noted by counsel to the effect that a functioning ALS is indispensable are the following.

[23] There is first argued that measures and actions by the regulator and the industry demonstrate that they expect the ALS to be needed for its safety functions. This is supported by the fact that regulations and standards governing commercial aviation, access to flight deck and the ALS do contemplate [text redacted] threats to safety and security that the ALS and its associated SOPs are designed to address, something the HSO qualified as “absolutely serious stuff”. As such, relevant regulations include the Canadian Aviation Regulations (CARS) dealing with admission to flight deck (s.705.27), closing and locking of flight deck door (s.705.45), doors and locks (s.705.80), training (s.705,124) and standard operating procedures (s.705.138). Furthermore, Standard 725.124(14) made pursuant to the CARS provides for emergency procedures training for flight crew members on [text redacted] threats to safety and security that the ALS and its associated SOPs are designed to address, prompting counsel to conclude that if those possibilities are not reasonably to be expected, then the regulator, industry and Air Canada (which has not sought to change the regulations) are then to be themselves seen as unreasonable. Relative to this first indicator, counsel noted that Air Canada witness Ms. Anand testified that the requirements in the CARS to train for these eventualities were because “industry suspects it may happen”.

[24] A second set of indicators noted by the appellants relate to the same expectation by Air Canada that the ALS will be needed for its safety functions, as shown by its training and standard operating procedures (SOPs). Regarding the matter of relevant training, counsel noted that the evidence shows that Air Canada flight attendants receive rigorous training in safety procedures, including emergency and security procedures both at the initial stage of their employment and also as part of the required annual recurrent training. Flight attendants are thus trained on how to deal with [text redacted] certain conditions, as shown by the Air Canada training matrix filed as exhibit and evidencing compliance with Transport Canada training requirements.

[25] Among other things, the matrix refers to [text redacted]. The training received by flight attendants also covers a review of accidents incurred at Air Canada and other operators and addresses the hazards to flight safety where communication is not effective. Counsel further stressed that Ms. Anand, who testified for Air Canada, made the point that Air Canada’s training of its flight attendants on the previously mentioned subjects is in accordance with the CARS and Commercial Air Service Standards and tries to exceed the requirements set by regulations. Furthermore, the CARS require annual recurrent training [text redacted].

[26] [Text redacted].

[27] [Text redacted].

[28] [Text redacted]. (These paragraphs describe Air Canada’s standard operating procedures (“SOPs”) for flight attendants; and training information provided to them by Air Canada with respect to pertinent safety, security and emergency issues.)

[29] While counsel for the respondent Air Canada may have derided such action as being unrealistic in such threatening circumstances, counsel for the appellants stressed that contrary to Air Canada counsel’s raised doubts, the employer evidently believed in such procedure since it trained its employees on it, just as it also provides training on the use of the ALS [text redacted].

[30] As part of the training provided to flight attendants that refers to flying accident and incident examples such as the Helios and Peach Air cases, “Crew Resource Management” (CRM) was deemed crucial as it stresses the importance of standard operating procedures and communication among all crew members. In this respect, counsel pointed to Air Canada witness Ms. Anand stressing that in CRM training, situational awareness is key, meaning awareness of crew member responsibilities and how to act or react if they are not following procedure with communication being of key importance. The training by Air Canada does not, however, include training on [text redacted] alternate standard operating procedures.

[31] Regarding the importance and cost to the employer in providing training and equipment as well as establishing procedures, counsel for the appellants pointed once more to testimony from the respondent’s witness (Anand) to the effect that training of flight attendants involves judgment calls regarding choosing and prioritizing which materials to provide, with the probability of occurrence of events being a factor in deciding what to include in said training. As such, counsel submitted that given the significant cost to the employer of the equipment, the training in its use, the actual training materials as well as the establishment of procedures, the decision by Air Canada to devote those resources to the ALS would demonstrate its seriousness and that it has been made in recognition of the important safety issues involved. Stated differently, it is the conclusion of counsel on this point that Air Canada has put in place such equipment, training and procedure because it expects them to be needed.

[32] [Text redacted]. The response by the employer was however the same as that which was provided to the refusing employees or HSO Pollock to the effect that the procedure provided pursuant to the MEL was acceptable and therefore the employer did not give suit to the recommendation.

[33] [Text redacted]. (The redacted portion of these paragraphs describes evidence of a certain type of occurrences that could require the use of the ALS and associated SOPs to avoid or mitigate safety or security threats.) The evidence provided by the appellants to the HSO as well as in the course of the hearing by the undersigned, uncontested as it may be by the respondent, is that whether in a general sense involving air carriers at large or just at Air Canada [text redacted] has happened in the past and it is counsel’s position that there is no reason to believe that it will not happen in the future, even where the employer may take measures to prevent or limit to a maximum such occurrence.

[34] [Text redacted].

[35] [Text redacted].

[36] [Text redacted]. (The redacted portion of these paragraphs describes evidence of a certain type of occurrences that could require the use of the ALS and associated SOPs to avoid or mitigate safety or security threats.) Those incidents, which involve Air Canada and many other air carriers, as established by various reports and studies from diverse sources such as the FAA (Federal Aviation Administration), AAIB (UK Air Accidents Investigation Branch), ATSB (Australian Transportation Safety Board), Air Canada and Transport Canada, serve to establish first [text redacted]. That being said, the details of each or many of those incidents, while possibly of informative interest, is not necessary to the understanding and evaluation of counsel’s submissions.

[37] [Text redacted].The contrary would mean that there would be no need for the continued procedures restricting access to the flight deck. In the case at hand, the flight was to Boston and Air Canada witness De Savigny agreed, according to counsel, that security threats are still present and pertain to large U.S. cities like Boston, as shown by the recent Boston Marathon bombing and with respect to Canadian transportation, as evidenced by the recent arrest of a group charged with plotting to bomb a Via Rail train. According to counsel, there has been no suggestion in any of the proffered evidence that security threats are no longer significant in commercial aviation, and while no data was provided on unruly passengers or more serious security threats, counsel made the point that flight attendants receive training to deal with both.

[38] Counsel addressed the HSO’s response as well as the respondent’s position relative to the MEL by stating that the MEL is not an exhaustive guide to safety, that it does not establish that an aircraft is airworthy and that it does not address occupational health and safety matters under the Code. Referring to CARS and Standard 625, counsel points out that Transport Canada notes that “application of the MEL does not eliminate the need for the pilot to make his own assessment of the airworthiness of the aircraft, but it does indicate certain circumstances where operation is definitely not permitted”, and thus argues that where an aircraft with unserviceable equipment is not compliant with the MEL, its operation is not permitted, yet a pilot may decide that an aircraft is not airworthy even though it may be in compliance with the MEL.

[39] In point of fact, counsel submitted that the procedures set out in the MEL are primarily pertaining to maintenance and operations and thus of limited relevance to flight attendants. According to counsel, support may be found for this last conclusion in the MMEL (Master Minimum Equipment List) approved by Transport Canada in accordance with CARS 605.07 and which serves to allow individual operators to develop their own individual MEL addressing their own particular aircraft equipment configuration and operational conditions while not being less restrictive than the MMEL. In this respect, counsel pointed to the MMEL and the provisions in the MEL identifying personnel concerned therein by the letters “M” for maintenance and “O” primarily for pilots. Regarding the HSO’s recognition and the position by the respondent relative to the two days repair deferment of the ALS, counsel noted that there are no procedures in the MEL for flight attendants flying without a functioning ALS and no evidence as to the rationale for allowing aircraft to operate for two days in this manner. Counsel completed its submissions on this particular point by adding that under the circumstances of the case at hand, there was no evidence to suggest that the reasons for a functioning ALS raised by the refusing employees [text redacted] would be or have been suspended for the two flight days while the aircraft is or would have been flying without said functioning ALS.

[40] Counsel pointed to the fact that Air Canada, in seeking to manage the risks of organizational accidents, has adopted a theoretical model that is referred to as the “swiss cheese model” whereby the presumption underlying a need for “defences in depth” vis-à-vis potential accidents is that every layer of defence contains holes that are not static and consequently change with every removed layer bringing the possibility of an accident closer. Under that model then, removal of a safety device would increase the likelihood of an accident, this being in line with the employer’s training materials that say that probabilities of accidents increase as resources are penetrated. Noting that witness for Air Canada Ms. Anand had agreed in her testimony that the circumstances of these cases attested to multiple failures, those being unserviceable safety equipment and a lack of procedure for the operation of the flight with the unserviceable equipment, counsel put forth the position that the flight that the appellants refused to operate would, in their case, have operated (it did with other employees) with significant layers of defence removed, in circumstances where it was reasonably to be expected that those defences could be required. As such, when applying the “Swiss Cheese” model of accident causation analysis used by respondent Air Canada, the flight was to be seen as dangerous.

[41] Using the definition of danger at subsection 122(1) of the Code as the basis for its submissions on the law, counsel for the appellants summarily defined the central issue to be determined as being whether it is reasonable to expect that the safety equipment at issue and its associated procedures could be required in order to prevent injury to persons on board the aircraft, including the refusing flight attendants. Factually, and in line with the “danger” definition, the case is presented by counsel as concerning an existing condition to wit, the ALS, a piece of safety equipment which was not functioning on the aircraft on which the refusing employees were scheduled to work. In this regard, counsel noted that the fact that the ALS was not functioning or that its sole purpose is safety is not disputed. [Text redacted]. In this regard, counsel underlined that there had been no suggestion by anyone that the ALS could have been restored to functionality during flight if needed.

[42] In light of this and inspired by voluminous references to applicable case law, counsel delineated its legal submissions on three elements:

1. 1) the test of danger is met where safety measures are deficient. When either safety equipment or procedures are removed or unavailable, danger is present within the meaning of the Code, a particular concern arising when employees are unable to apply their training in safety procedures because the safety equipment is not available.
2. 2) the Code is preventive in purpose, and thus it is not necessary that hazards or injuries resulting from them occur frequently, only that their occurrence be reasonably possible.
3. 3) compliance with a regulatory scheme, in this particular instance compliance with the MEL, does not serve to eliminate the danger.

[43] As stated above, in support of its submissions on the law, counsel referred to voluminous case law. Relative to Verville v.Canada (Correctional Services) 2004 FC 767, counsel noted that the Court had stated the following points:

• the Code is not limited to specific factual situations existing at the time of refusal;
• the condition or activity involved in the refusal does not need to cause injury every time it occurs; rather it must be capable of causing injury at any time, not necessarily every time;
• it is not necessary to establish precisely the time when the hazard, condition or activity will occur, but only to ascertain in what circumstances it could be expected to cause injury and establish that such circumstances will occur in the future, not as a mere possibility, but as a reasonable one;
• hazards or conditions based on unpredictable human behaviour are covered by the definition. In the words of the Court, “if a hazard or condition is capable of coming into being or action, it should be covered by the definition” (para. 41).

[44] Furthermore, counsel also noted that the Court had recognized that there is more than one way to establish a reasonable expectation of injury in a particular situation, injury that may occur in circumstances that may somewhat differ. As such, quoted are the words of the Court at paragraph 51 of said decision to the effect that “a reasonable expectation could be based on expert opinion or even opinions of ordinary witnesses having the necessary experience when such witnesses are in a better position than the trier of fact to form the opinion”. Applied to the case at hand, counsel notes that the opinions of regulators, industry, Air Canada and the Montreal workplace health and safety committee are unanimous with respect to the need for the ALS as a safety device and its associated procedures. [Text redacted].

[45] Counsel also argued that the Federal Court of Appeal had found that the absence of safety equipment needed to protect against a potential danger represents a danger under the Code. Reference in this regard is made to Martin v. Canada (Attorney General) 2005 FCA 156 stating at paragraph 37:

I agree that a finding of danger cannot be based on speculation or hypothesis. However, when attempting to ascertain whether a potential hazard or future activity could reasonably be expected to cause injury before the hazard could be corrected or the activity altered, one is necessarily dealing with the future. Tribunals are regularly required to infer from past and present circumstances what is expected to transpire in the future. The task of the tribunal in such cases is to weigh the evidence to determine whether it is more likely than not that what an applicant is asserting will take place in the future.

Based on the above and applied to the present case, counsel therefore argues that the question here is whether the potential hazards [text redacted] are mere speculation or hypothesis, or whether they are likely to take place in the future. Counsel argues that they have taken place in the past and that there has been no evidence presented that anything would prevent them from taking place in the future. There is an elaborate regulatory system in place and a system of Air Canada training, equipment and procedures that anticipate that these hazards will take place in the future. The fact that the employer and the regulator have already implemented the ALS as a safety measure serves to reduce the speculative or hypothetical nature of the hazards occurring.

[46] It is counsel’s opinion that the Tribunal reached a similar conclusion in Armstrong v. Canada (Correctional Services), 2010 OHSTC 6, relative to the unavailability of safety equipment, and in Frighetto v. Group 4 Securicor, (2011 OHSTC 7) regarding the removal of safety procedures, or the alteration of such to the point of actual elimination, this time based on the notion of unpredictability of human behaviour, or the removal of a “level of security” without adequate replacement, as found in Brazeau and Securicor Ltd. (2004) CLCAOD no.49, based on what is commonly referred to as the hierarchy of controls or preventative measures set at section 122.2 of the Code and standing for the position that when preventative measures exist to protect employees against a hazard, and an employer fails to take them, the result is danger.

[47] In the case at hand, counsel points to the particular concern of the removal of safety equipment, the ALS, which would have made it impossible for the refusing employees to act according to their training and to follow safety procedures, something that was found to constitute a danger by the appeals officer in Securicor Canada Limited and Canadian Auto Workers Union Local 4266-A, Decision no 06-002, who stated at paragraph 18 that “the inability of an employee to be able to act according to her training was a danger at the time of the work refusal”. Moreover, in that same decision, the appeals officer stated at paragraph 24 that “methodology imposed on the guard and custodian varied from standard safety procedures (…) without any mitigating measures to minimize the additional risk that was created by the change”, this being interpreted by counsel as signifying that the actual existence of an employer’s safety procedures and training indicates that when those procedures and training are not available, there is danger. The conclusion drawn by counsel for the appellants on the basis of what precedes is that the present case can be assimilated to the Securicor decision just referred to and that as in that case, the refusing employees in the present appeals are trained in safety procedures using the ALS, but they are not trained in any such procedures in circumstances where the ALS is not functioning. Furthermore, no mitigating measures were taken to minimize the additional risk created by the absence of a functioning ALS, such factors leading to a conclusion of danger.

[48] [Text redacted]. Counsel for the appellants dealt with this in the final part of its submissions, putting the accent on the Code’s primary objective and principle in determining the existence of danger, that being its preventive nature, as expressed at section 122.1 of the Code, which states that “the purpose of this Part is to prevent accidents and injury to health arising out of, linked with or occurring in the course of employment to which this Part applies”, and thus enunciating generally, on the basis of previous decisions by appeals officers, that danger can be found despite the absence or infrequency of past injuries or hazards, and that a hazard may be reasonably expected to occur in the future despite never having occurred in the past, statistical frequency not being required, as stated in Rathwell v. Air Canada, 2011 OHSTC 15, paragraph 66 in the following words: “ […] there is no requirement in the Code definition of danger that it be frequent”, and more forcefully in a previous CIRB decision (Lequesne (Re), [2004] CIRBD No 276, at paragraph 84) as follows:

[A]n accident or incident is an event that happens by chance or without apparent cause at some unforeseeable time. … A remote possibility is a possibility nonetheless. Part II does not provide a “remote possibility” as a rationalization for unsafe work conditions.

[49] Noting that the test adopted by case law to determine the presence of danger requires only that there be a “reasonable possibility” that a hazard would cause injury in the future, not a certainty or likelihood, and that such possibility remains reasonable even when infrequent, counsel noted that in the event of [text redacted]which would require use of the ALS, the severity of injury is likely to be high and flight attendants do not have the option of withdrawing themselves from the aircraft while it is in flight. Counsel thus concluded on this point that while the frequency of occurrences when a functioning ALS is required for safety reasons may be low, the risk is nonetheless always present, the consequences may be high in severity, and because of those circumstances, injury is highly susceptible of happening in the future if the ALS is not functioning.

[50] As a concluding point, counsel referred to the respondent’s position, as well as that of HSO Pollock, that the MEL allowed the ALS to be inoperative with the flight proceeding as scheduled. Arguing that compliance with a regulatory scheme does not eliminate danger, counsel submitted that the MEL is actually not relevant to the present case, indicates only “certain circumstances where operation is definitely not permitted”, does not prevent a pilot from making the assessment that a MEL-compliant aircraft is not airworthy, and that while the MEL may concern airworthiness, it does not take into account occupational health and safety issues. Noting that an aircraft would not be allowed to operate because of aviation safety concerns, where not in compliance with the MEL, thus eliminating the opportunities of work refusal by flight attendants, counsel pointed out that danger findings have been made in flight attendant refusals where there was no issue of airworthiness and no question that the aircraft was operating within the requirements of the MEL (Rathwell, supra), claiming in particular that the respondent had been unsuccessful in the making of the same argument relative to compliance with the MEL in Canadian Union of Public Employees, Air Canada Component v. Air Canada, 2008 FC 1299, at paragraphs 3, 29 and 32 in which the Federal Court accepted that the aircraft concerned met the requirements of the MEL, but nevertheless overturned the appeals officer’s “no danger” finding on the basis of the latter’s unreasonable (“contradiction”) decision relative to the legal test of “danger”.

[51] Counsel noted that there have been other instances where the same argument relative to compliance with regulations was made and not accepted, noting that at the center of the rejection laid the fact that the objective of the Code and that of the Regulations made under a different legislation were different, with the Code taking precedence in matters relative to occupational safety and health.

[52] As stated above, the appellants are seeking that the HSO decisions be rescinded and replaced by a finding of “danger” that would thus require the undersigned to fashion and order a remedy. On that, the appellants rely on the preventive purpose of the Code to suggest that where “danger” is found to exist because of lacking safety measures, the appropriate remedy needs to be prospective in order to protect employees faced with similar circumstances in the future. The appellants thus are of the view that upon my finding a “danger”, directions be issued to Air Canada to:

1. discontinue the use of the FIN #380 aircraft until the cockpit security ALS is fully operative;
2. cease and desist from dispatching aircraft with inoperative ALS;
3. order such further relief and remedies as may be advised by counsel or deemed appropriate by the undersigned;

and in the alternative, given that the work refusals concerned an Embraer 175 aircraft and that the evidence shows that Embraer 175 and 190 aircrafts involve the same ALS and procedures, that I issue a direction to the respondent Air Canada that it:

4. cease and desist from dispatching Embraer 175s and 190s with inoperative Cockpit Security Automatic Latching Systems.

B) Respondent’s submissions

[53] The respondent’s submissions are premised on the precept that the right to refuse to work provided under section 128 of the Code is a wholly personal right to the refusing employee(s) which must be based on the dual subjective and objective component that a refusing employee must have a reasonable cause to believe that the danger claimed to justify the refusal exists. As such, this serves to introduce a later expressed opinion formulated by counsel that such personal right, even where a refusing employee is represented by and the latter’s case is supported and even presented by a union, may not serve or be used to advance a position or positions based on elements other than those that are personal to the refusing employee(s), meaning thus that what I may consider in my determination is the situation as experienced by the refusing employee(s) at the time of the refusal.

[54] This being said, while the general concept of “danger” is defined at subsection 122(1) of the Code as “any existing or potential hazard or condition or any current or future activity that could reasonably be expected to cause injury or illness to a person exposed to it before the hazard or condition can be corrected, or the activity altered (…)”, counsel made it a point at the outset to underline the fact that numerous court pronouncements have served to pinpoint key elements that must be satisfied in seeking to establish the existence of a danger. As such, there can be a finding of “danger” under the Code only where the hazard is real as opposed to a merely hypothetical or speculative one. According to counsel, support for this can be found in the Federal Court decision in Verville, itself referring to the Federal Court of Appeal’s pronouncement in Martin, which stated that while a precise timeframe within which a condition, hazard or activity will occur need not be established to found a danger, the definition of the concept in the Code only requires that one ascertains in what circumstances it (condition, hazard or activity) could be expected to cause injury and that it be established that such circumstances will occur in the future, not as a mere possibility but as a reasonable one.

[55] By the same token, according to counsel, the state of the law as regards the criteria for assessing the presence of “danger”, which counsel reduces to the risk or hazard not needing to occur in every instance but being reasonably capable of occurring at any time, is summarized by the Federal Court in Canada Post Corporation v. Pollard, 2007 FC 1362, as follows:

[66] As a matter of law, in order to find that an existing or potential hazard constitutes a “danger” within the meaning of Part II of the Code, the facts must establish the following:

1. the existing or potential hazard or condition, or the current or future activity in question will likely present itself;
2. an employee will be exposed to the hazard, condition, or activity when it presents itself;
3. exposure to the hazard, condition, or activity is capable of causing injury or illness to the employee at any time, but not necessarily every time; and
4. the injury or illness will likely occur before the hazard or condition can be corrected or the activity altered.

[67] The final element requires consideration of the circumstances under which the hazard, condition or activity could be expected to cause injury or illness. There must be a reasonable possibility that such circumstances will occur in the future. […]

[68] In Martin C.A., cited above, the Federal Court of Appeal provided additional guidance on the proper approach to determine whether a potential hazard or future activity could be expected to cause injury or illness. At paragraph 37 of its reasons, the Court observed that a finding of “danger” cannot be grounded in speculation or hypothesis. The task of an appeals officer, in the Court’s view, was to weigh the evidence and determine whether it was more likely than not that the circumstances expected to give rise to the injury would take place in the future.

[56] In the opinion of counsel, of all the factors formulated by the Court in the Pollard decision, in the present appeals it is the last factor (injury must be expected to occur before the hazard is corrected) that is most critical to the determination of these cases. Along this line, an essential component of the respondent’s position is that the definition of “danger” in the Code allows also for the interpretation, one would say a contrario, that an otherwise potentially dangerous situation can continue to exist (therefore not seen as a “danger”) where there is no reasonable possibility of injury occurring before the hazard is corrected, the essential part of respondent’s position being that since certain events that have in themselves the potential to cause injury, should they occur, are not reasonably likely to occur before the hazard that is the inoperative ALS can be corrected, a conclusion of “danger” would not be justified. Recognizing the fact that there are inherent dangers in all modes of transportation, including airplane accidents where the picture of catastrophic results is conveyed, the answer provided by the latter to the question: why is it acceptable from a health and safety perspective that “aircraft still fly ?” serves to illustrate what is central to the respondent’s position in this case to wit, “it is because the actual risk of such a catastrophic occurrence is extremely low, and that such events usually arise from an exceedingly rare confluence of different remotely possible scenarios”.

[57] As already stated above, the parties hold differing views as to the danger that I must evaluate. According to counsel for the respondent, it would be incorrect to consider that said danger is the inoperative ALS, as counsel claims is suggested by the employees. Rather, again according to counsel, it is not the inoperative automatic door latch per se that needs to be assessed as the danger, but the “fear” of what might occur if something else also happens with the ALS being inoperative. That something else, to quote the words of counsel at paragraph 33 of the latter’s written submissions in referring to what he indicates was identified by the refusing employees and “articulated” by HSO Pollock, was that the inoperative door lock was a danger [text redacted] because “there is no way for the cabin crew to follow our SOPs [text redacted]” [text redacted].

[58] According to counsel for the respondent, even this does not represent the actual danger feared by the employees since they have been trained to deal with pilot incapacitation, and although left unsaid, one would assume, threatening actions directed at the cockpit. [Text redacted].

[59] Referring to the Martin court pronouncement that for a conclusion of danger, these events must be more likely than not to occur before the hazard which is the inoperable ALS is fixed, counsel noted that according to the Transport Canada approved MEL, the timeframe for this to occur would be at the most two flight days, although in reality, it would be much narrower since for each of the refusing attendants, their real exposure to the hazard would have been the duration of the flight, which was approximately 90 minutes, and even closer to sixty minutes [text redacted].

[60] The two flight days’ timeframe central to HSO Pollock’s conclusion as well as to the respondent’s position in this regard originates from the provisions of the Transport Canada Embraer Master Minimum Equipment List (MMEL) developed by the aircraft manufacturer, which allows the operation of the airframe with certain limitations and the Air Canada MEL, also Transport Canada approved. From those, an inoperative ALS must be corrected within two flight days, causing counsel to reiterate that the risk to be analyzed is the potential for occurrence of the workers’ concerns on the flight in question, or on a subsequent flight involving that particular aircraft, within two flight days from the time the malfunction was observed, thus buttressing respondent’s position as to the extremely limited possibility of occurrence to the extent of being hypothetical. As MMEL and MEL considerations are central to the respondent’s position in the present cases, counsel has thus devoted a considerable part of his submissions to those documents and their contents, mostly for the purpose of demonstrating that while, under the provisions of those documents, which he repeatedly insisted are Transport Canada approved, it is possible for an aircraft (airframe) to continue flying with certain inoperative equipment, those documents do address safety concerns in respect of the operation of the Embraer.

[61] While counsel has quoted profusely from those documents and I have had opportunity to read those quotes in the latter’s submissions as well as the actual documents which were filed as exhibits, it is not necessary for the undersigned to reproduce those in their entirety here and I will only reproduce part of those to illustrate the point being made by counsel, point which quite evidently is based on the fact that the said documents repeatedly speak of “safety” and “acceptable level of safety”. It is important to note that counsel’s comments on the MMEL and MEL are premised by the statement that “an inoperative ALS in no way affects the airworthiness of an aircraft. [Text redacted].The aircraft will fly and access to the cockpit is restricted. If the MEL dealt only with airworthiness, a “two flight” fix threshold would be unnecessary”, thereby again alluding to the position taken by the respondent in these cases that the actual danger feared or invoked by the refusing employees does not concern the inoperative equipment per se but rather their incapacity to adhere to the standard operating procedures they have been trained on in the extremely limited chance of certain occurrences within or towards the Flight Deck.

[62] Repeatedly in the submissions by counsel as well as in the various quotes from the MMEL and MEL, the word “airworthiness” is used but not defined. For a better understanding of what follows, I have opted to insert here a dictionary definition of the term “airworthy” as found in the Canadian Oxford Dictionary, wherein it is stated that an aircraft is airworthy as being “fit to fly”, which I understand as at least meaning being capable of flying and maintaining flight. With this being said, the safety considerations and purpose of the MMEL and MEL are stated in some of the quotes provided by counsel as follows:

[63] One must note at this stage that what precedes represents, according to the overall submissions of the respondent, the situation in existence at the time of the refusals to work by the appellants. It is also stated in the document, as had been retained by HSO Pollock, that “MEL conditions and limitations do not relieve the operator from determining that the aircraft is in condition for safe operation with items of equipment inoperative”, something that counsel submits was the case at the time of the refusals where he notes, under the descriptive “pilot assessment”, that at the time of refusals, three different pilots had reviewed the situation and determined that the aircraft could be safely operated, not only from an airworthiness perspective, but also taking into consideration the concerns of the refusing employees, and that one ought not to draw an adverse inference from the fact that those pilots were not called to testify at the hearing. Counsel did not however elaborate on what would constitute a redundant system to the non-functioning ALS.

[64] Additionally, the respondent submits that Transport Canada’s overview in the MEL approval process also imparts an integral consideration of safety, and that inclusion of items in the approved MMEL and the MEL has involved a complete evaluation of the safety or rather the acceptable level of safety for continued operation of the aircraft according to MEL conditions, such that relative to those included items, as the ALS, which may be inoperative, a determination has already been made by Canada aviation regulatory authority that operation of the aircraft under such conditions does not constitute an unacceptable safety hazard in and of itself.

[65] As a means of furthering its submissions on this, counsel referred the undersigned to the Embraer MMEL, and noted that under title Dispatch with inoperative equipment, it is stated that the “MEL is an alleviating document”, the purpose of which not being to encourage the operation of aircraft with inoperative equipment, as “it is never desirable that aircraft be dispatched with inoperative equipment and such operations are permitted only as a result of careful analysis of each item to ensure that the level of safety is maintained […]” where in establishing the equipment necessary for any given safe operation where certain equipment is inoperative, the MMEL Review Group must consider various factors that include “the consequence to the aircraft and its occupants of further failures, change in crew workload and/or degradation in crew efficiency and degradation in crew capability to cope with adverse internal and external environment conditions”, and, on the proposed approval of a particular MMEL, its decision will be based on the criterion that the level of safety required by the standards specified for the design and operation of the aircraft type can be maintained. Items that are inserted in an MMEL need to have been assessed from an acceptable level of safety standpoint and that assessment may involve a number of methods of justification, including a Quantitative Safety Analysis and a Qualitative Analysis.

[66] In the case of the quantitative analysis, the level of safety acceptability, taking into account the increasing dependency of modern aircraft on the safe operation of complex systems, is based on the principle that the hazard resulting from an event should be inversely proportional to the probability of its occurrence. As such, said safety assessment would serve to establish “the major, hazardous or catastrophic situations or failure conditions which the system is capable of producing and the allowable probability of occurrence”. A distinction is made in this respect on the basis of critical or non-critical failure of systems. “For those systems whose failure is critical, i.e., results in hazardous or catastrophic situations, a numerical probability analysis is usually required to demonstrate compliance with the allowable probability of occurrence.” For those critical functions systems, their inoperability is to be taken into account in the safety assessment and, where it is not possible to establish the additional risk resulting from occasional flights with such equipment inoperative in light of the allowable probability of occurrence established during the certification process, “then a safety analysis must be carried out involving a quantitative analysis of the likely risk of the worst effects that can result from additional failures, events and/or environmental conditions occurring during a flight” with a particular inoperative item.

[67] On the other hand, “for non-critical components/systems, the safety assessment may be greatly simplified” with the risk of any specific failure condition being a function of failure rate, the number of such systems and the time of exposure to risk. Referring once more to the same document (Embraer MMEL), attention is drawn by counsel to the fact that if an item is to be found acceptable for inclusion in the MMEL, “a qualitative analysis must be used to consider the impact that the proposed inoperative item has on all other aspects of the aircraft’s operation. The qualitative analysis must consider the impact on crew workload, the impact of multiple MMEL items, and the complexity of maintenance and/or operational procedures. In brief then, the voluminous references by counsel to the Embraer MMEL seek to demonstrate that the MMEL development process by the aircraft manufacturer, as well as the Transport Canada approval process of such, take into consideration the safety aspect of operating the aircraft with certain inoperative items.

[68] In his considerable reference to the Embraer MMEL, counsel also pointed out that the said document generally defines the purpose of an MEL, such as the Air Canada MEL relative to its Embraer aircraft generally and the aircraft directly involved in this particular case. An MEL is thus described as:

a joint operations and maintenance document prepared for or by an air operator to:

• identify the minimum equipment and conditions for an aircraft to maintain conformity with the standards of airworthiness and to meet the operating rules for the type of operation;
• define the operational procedures (underlining added) necessary to maintain the required level of safety and to deal with inoperative equipment;
• define maintenance procedures necessary to maintain the required level of safety and procedures necessary to secure any inoperative equipment.

[69] Having regard to this, reference is also made by counsel to Transport Canada General Operating and Flight Rules, which describe MELs as being “lists of systems and equipment installed in the aircraft, annotated to show the degree to which defects may be allowed for a limited period”, and state a consideration that has been recognized as central to this matter by HSO Pollock as well as by the respondent to the effect that “application of the MEL does not eliminate the need for the pilot to make his own assessment of the airworthiness of the aircraft, but it does indicate certain circumstances where operation is definitely not permitted.” On this matter of “pilot assessment”, as noted above, the respondent has argued that three different pilots had reviewed the situation at the time of the refusals and determined that the aircraft could be safely operated, to quote the words of counsel, “not only from an airworthiness perspective, but taking into consideration the refusing F/As concerns.” Having regard to counsel’s submissions regarding the MMEL and the Air Canada MEL, the latter’s summation of the respondent’s position is that Air Canada does not say that any event that meets MEL requirements, as is the case here, can never constitute a “danger” within the meaning of such defined term in the legislation, but that absent specific extraneous factors (underlining added) which might be present on a particular day, the impact of an inoperative flight deck door has in fact been determined not to be a safety hazard affecting the safe operation of the aircraft within the limitation period specified in the MEL.

[70] It is the position promoted by the respondent that the acceptance of the Embraer MMEL by Transport Canada means that a determination has already been made by Canada aviation regulatory authority that operation of the aircraft with an inoperative ALS does not automatically constitute an unacceptable safety hazard. In short then, the position taken by the respondent would be that during flight, all other conditions, be they material or human, remaining as they should be, or put another way, there occurring no extraneous factor or “next worse failure” or there being little probability of such occurrence, the fact of an inoperative ALS would not constitute a safety issue when considered during the repair deferment period provided under the applicable MEL. In this respect, counsel argued that appellants’ counsel had erroneously asserted that the Federal Court had found in Canadian Union of Public Employees, Air Canada Component v. Air Canada, 2008 FC 1299, that MEL compliance would not ensure maintenance of a “no danger” finding where the apparent contradiction by the appeals officer in interpreting the actual definition of “danger” would lead to an unreasonable result. Rather, according to counsel, where the Court had formulated a conclusion on that contradiction, it had not dealt with any other issue, including the impact of MEL compliance.

[71] As repeatedly mentioned above, central to the position adopted by respondent Air Canada is the notion of likelihood of occurrence, in that the danger invoked by the refusing employees combines the fact of an inoperative piece of equipment and certain events [text redacted].

[72] In this respect, counsel argues that, contrary to appellants’ position, statistical data needs to be considered relevant and that as such, it is not sufficient to consider that since there is a known possibility that the events just mentioned can occur, that this must automatically translate into a “danger” existing, or the fact that a recognized “safety” device malfunctions or is inoperative prima facie constitutes a danger. Noting that even with vast improvements in safety over the years, all modes of transportation present inherent dangers, and that as for all other modes of transportation, “there are airplane accidents”, counsel asks and answers the questions as to why, from a health and safety perspective, such modes remain acceptable, and in the case of aircraft, “still fly” , by stating “that it is because the actual risk of such catastrophic occurrence is extremely low, and that such events usually arise from an exceedingly rare confluence of different remotely possible scenarios”. With this in mind, it is the view of counsel for respondent Air Canada that the case law submitted by the appellants in support of their position is of little relevance since the Code definition of “danger” stipulates that the event (“hazard, condition or activity”) with the potential to cause injury must be reasonably likely to occur before corrective action can be taken and in the cases cited by the appellants, the employers had taken the position that the hazard complained of was not intended to be corrected, this meaning that the analysis of risk of injury “before the hazard could be corrected” had not even been contemplated in those cases.

[73] According to counsel, the steps of the needed analysis are well described in the Correctional Service Canada (CSC)Millhaven Institution appeal decision (Decision No. 06-026) where the appeals officer stated at paragraph 58:

• […] that a danger exists where the employer fails, to the extent reasonably practicable, to:
• (a) eliminate a hazard, condition or activity;
• (b) control a hazard, condition or activity within safe limits; or
• (c) ensure employees are personally protected from the hazard, condition or activity;
  and one determines that:
• (d) there are circumstances in which the remaining hazard, condition or activity could reasonably be expected to cause injury or illness to any person exposed thereto before the hazard, condition or activity can be corrected or altered; and that the circumstances will occur in the future as a reasonable possibility as opposed to a mere possibility or a high probability.

Given what immediately precedes, respondent counsel challenges, as not reflecting the requirements of the Code or the definition of “danger” found therein, the proposition by the appellants that the mere existence of the employer’s safety procedures and training signifies that there is danger when those procedures and training are not available and that the test to determine whether a danger exists is met “when safety measures are deficient” to wit, when safety equipment or procedures are removed or unavailable, and when employees are unable to follow their training in safety procedures because of said unavailability.

[74] It is the respondent’s position that the mere fact that a safety measure may not be available does not, in and of itself, equate to a danger. As required by the proper analysis described above, there remains the requirement that the hazard be probable as opposed to being speculative, and that it be reasonably expected to occur before it can be corrected. Furthermore, the fact that employees have received training on a safety procedure and are unable to do what they have been trained to do similarly does not equate to danger.

[75] [Text redacted].

[76] [Text redacted].

[77] On the “Swiss Cheese” model of accident causation analysis used by the respondent, counsel objected to the appellants’ characterization to the effect that “when one thing goes wrong, more things go wrong”, opting rather for the proposition under the model that if one thing does not go wrong, the catastrophic event will not occur. Counsel expressed the opinion that the appellants falsely claimed that the flight at the center of this case was “dangerous” under the said model because it was or would have operated with significant layers of defence removed, in circumstances where it was reasonably to be expected that those defences could be required, and in doing so misstated the concept.

[78] According to counsel’s submissions, the said model is intended to demonstrate that there are multiple layers of defences that can prevent the occurrence of a catastrophic event, one such defence being capable in and of itself of succeeding in that prevention. Relative to the actual case at hand of flight AC 362, counsel put forth that there was only one layer of defence missing, that being the ALS, and thus for a catastrophic event to occur or have occurred, other layers of defence would have to fail or, in counsel’s terms, “other holes” (would) have to open and align [text redacted].

[79] According to counsel, the Helios case used by Air Canada in its training and which concerns a decompression and hypoxia situation that ended in the crash of the Helios Airways Boeing 737-300 and the death of all 121 passengers and crew members, constitutes a good illustration, under the “Swiss Cheese” model, of the storm of events necessary to produce such serious consequences. In that case, the post-accident investigation revealed thirteen errors which led to the crash and in counsel’s view, the remediation of any of these errors likely would “have averted the tragic result”. Along the same line, counsel describes “decompression”, rapid or progressive, as being in and of itself a rare occurrence and he refers to documentary evidence provided by the appellants to support this. As such, a study titled Quick Response by Pilots Remains Key to Surviving Cabin Decompression (Stanley R. Mohler, M.D.) published by the Flight Safety Foundation indicates:

Statistics compiled by the U.K. Civil Aviation Authority showed that 77 occurrences of decompression were reported in all types of pressurized aircraft from 1990 through 1999. From 1985 through 1999, 164 decompression occurrences were reported to the Transportation Safety Board of Canada and from 1990 through 1999, the Australian Bureau of Air Safety Investigation recorded five decompression occurrences. In the United States, statistics compiled by the FAA Civil Aeromedical Institute (CAMI) showed that 355 occurrences of aircraft decompression were reported from 1974 through 1983, an average of about 35 a year.

According to counsel, applying this U.S. data and extrapolating from the 54.3 million flights over the 1993/1998 six year period, this would put the U.S. rate of decompression at approximately 1 event per 255,000 flights. Similarly, applied to the 1.7 million Air Canada flights between 2003 and 2010, approximately 7 decompression events, or 1 per year, would be expected to occur.

[80] Still relative to the “Swiss Cheese” accident causation analysis model, counsel affirmed that the probability of a [text redacted] certain condition is extremely remote and that for the scenario contemplated in the refusals that make up the present case to occur, numerous circumstances would need to be present in addition to the ALS being inoperative. [Text redacted]. Applying the analysis model as did Air Canada witness Ms. Anand, with any of these variables not present during the limited duration of the flight, the feared hazard would not reasonably materialize. [Text redacted]. Counsel recognized that there could be additional factors that could raise the probability of such a feared event occurring on any particular day.

[81] He points out however that on the day of their refusals, the appellants failed to identify any such factors. [Text redacted] and there was nothing inherently dangerous about an inoperative ALS, the possibility being anticipated by the MEL with an operating procedure being in place to address such a situation, although on this last point, no particulars were offered.

[82] Concluding on this point, it is counsel’s view that the limited capacity of flight attendants to do something in the event of a [text redacted] must enter into the equation, given their stated concern in exercising their right of refusal as being [text redacted].

[83] [Text redacted].

[84] Recalling that the Transport Canada approved MMEL sets out the considerations relevant to determining whether a specific inoperative piece of equipment may bring about the grounding of an aircraft and spells out that “the risk of any specific failure condition is a function of failure rate, the number of such systems and the time of exposure to risk”, counsel expressed the view that in this case, there was no reasonable possibility of the danger materializing, as the risk is so remote due to the number of factors which are required to occur simultaneously in a fixed time window that the safety risk is negligible to the point that Canada’s “Air regulator” has approved a two day time window for repair. Counsel’s conclusion on this point adheres to the central argument of the respondent relative to the extremely remote possibility of circumstances materializing while the ALS is inoperative. According to counsel, if the safety risk has been determined to be so negligible, the event cannot implicitly and intuitively rise to the level of being a “danger” within the meaning of the Code.

[85] One of the appellants, Ms. Caron, added the risk of [text redacted] a certain condition with the ALS inoperative, as a motive for refusal. In this regard, counsel for the respondent put forth the opinion that in order to meet the definition of “danger”, it was incumbent upon the employee to demonstrate that such a risk was reasonably probable, taking into account as a relevant consideration the duration of the flight that the employee was scheduled to work on. Counsel’s position on this is simply that no cogent evidence has been adduced regarding the reasonableness of such a risk.

[86] [Text redacted].

[87] [Text redacted].

[88] [Text redacted]. Thus was brought to the fore the question of whether the employer had established written or standard operating procedures for such a situation, a question on which counsel for the respondent was straightforward in stating that witnesses in the case were consistent in establishing that the employer has no precise written procedure in respect of an inoperative ALS.

[89] Counsel elaborated on this by pointing to the testimony of respondent witnesses De Savigny and Anand who had testified that an alternate procedure to deal with the issues arising from the inoperative ALS would be expected to be part of the pre-flight briefing by the Captain, at which time alternate [text redacted] procedures were to be discussed. The evidence shows that the Captain based his decision to go ahead with the flight on the MEL and its two days of repair deferment and so informed service director Vergara. Counsel for the respondent admits that alternate [text redacted] protocols were probably not discussed at the time of the refusals, something he tries to explain by pointing to service director Vergara dealing, in his conversation with the Captain, [text redacted]. In this light, counsel argues that it is readily observable that such a conversation may not have taken place and, somewhat gratuitously, offers the opinion that it would in all probability not have dissuaded the employee from his course of action. Counsel further makes the important admission that it is correct that there is no alternative [text redacted] to a certain safety function of the ALS and that there are no standard operating procedures in this regard.

[90] A final point of counsel for the respondent’s submissions deals with what the latter has referred to as the “proper focus of the appeal”, and seeks to caution the undersigned to ensure that he focuses solely on the factual situation facing the workers at the time of their refusals as well as their own articulation of the perceived danger at the root of their individual refusals. In this respect, counsel argues that it is not because employees designate a union to appeal a decision on their behalf and to represent them that the appeal expands to cover potential dangers or concerns that were not on their minds when they exercised their right of refusal. Stated differently, counsel again informs the undersigned that he must exercise caution to ensure that an appeal is not used to advance labour relations goals of a union rather than the particular health and safety concerns of the refusing employees, and that I must be diligent, should I grant the appeals, in crafting a remedy that respects the said principle.

[91] While counsel stated that the respondent is not claiming that the purpose of the refusing employees consists in the advancement of labour relations goals, he submits that the apparent interests of the Union herein have been confused with those of the workers and that it is important that they be kept separate. Counsel bases his opinion in this respect on the choice of terminology by counsel for the appellants, such as “CUPE submits…” as opposed to “the workers submit...” and on certain documentation filed in evidence by the latter and which may have a coverage that exceeds the specific particulars of the refusals being considered in the present cases.

[92] The disposition sought by the respondent is obviously that I uphold the findings of “no danger” arrived at by HSO Pollock. In the alternative however, the respondent is of the opinion that the additional remedies that are being sought not be granted. Specifically, the remedy sought that no aircraft of any kind be permitted to operate with a malfunctioning cockpit door lock would completely disregard the fact that individual circumstances may affect safety on any day, since the respondent did not, and actually could not take the position that an inoperative door can never be a danger, because this would have to be considered with other circumstances specific to other situations and thus in combination might constitute a contributing factor that would take an otherwise safe event to the level of foreseeable hazard.

[93] Additionally, counsel notes that the remedy could apply only to the respondent’s fleet of aircraft, thus not affecting other carriers operating Embraer airframes or other types in Canadian airspace or worldwide, causing one to wonder whether a faulty door lock could be seen as a danger only where Air Canada aircraft are concerned. The alternative that Air Canada would propose to the remedy sought would be that within a fixed period of time, it be directed to propose measures that would reduce the possible negative consequences of an inoperative cockpit door lock, such as an enhanced communications protocol between the pilot and the flight attendants. By way of summarizing his submissions and position that the appeals should be dismissed, counsel for the respondent delineates the issue that I must decide as being whether the refusing flight attendants could reasonably be expected to be injured before the cockpit door lock could be fixed. In the latter’s opinion, this should be answered in the negative. In counsel’s view, consideration of statistical evidence is determinative [text redacted].

[94] [Text redacted].

[95] [Text redacted]. As such then, the unavoidable conclusion is that it was not more likely, and actually was highly improbable, that the refusing flight attendants would be injured before the cockpit door latch could be fixed, thus not meeting the definition of “danger”.

C) Reply

[96] In reply submissions, counsel addresses at length the respondent’s own submissions and conclusions on the general basis that they either are founded on a definition of “danger” that is narrower than that which is found in the Code and contrary to the interpretation of that concept by the Courts and appeals officers, are contrary to the evidence concerning the ALS and its associated procedures, their effectiveness and necessity and thus ignore the efforts by aircraft manufacturers, regulators and commercial aviation operators that have gone into the design of the ALS and associated procedures as well as the training for their use, fail to acknowledge that the purposes of the MMEL and MEL are not that of the Code, thus seeking that the undersigned defer to those texts in determining whether non-functioning safety equipment constitutes a “danger”, and also defer to the assessments made by pilots who did not testify at the hearing and the characterization of what they may have said. Furthermore, counsel for the appellants points to erroneous statements by the respondent regarding the definition of “danger”, the role of the appeals officer and some of the evidence.

[97] On the question of the narrower definition of “danger” proposed by the respondent, the appellants note that while Air Canada contends that a factor of the definition is missing in the circumstances of this case, that being “that injury must be expected to occur before the hazard is corrected”, the actual definition is broader in that it provides that injury must be expected to occur “before the hazard or condition can be corrected, or the activity altered”. Applying this to the facts of the case, the ALS cannot be repaired in flight and as such, if it or its associated procedures are needed on a flight to prevent injury, and it is not functioning, injury will thus “occur before the hazard or condition can be corrected, or the activity altered” to wit, before the ALS is repaired, and thus the factor claimed to be absent by the respondent is actually present in the circumstances of these refusals. Counsel for the appellants points out in this regard that the real argument by the respondent is not that there is a factor of the definition of “danger” that is absent, but rather that it is statistically unlikely on any given flight that the catastrophic events that could be prevented by the ALS or associated procedures will occur, and thus that the ALS and associated procedures are not necessary on any given flight, particularly ones of short duration, thereby negating the actual purpose of the said ALS and associated procedures which is to protect against events and human actions or reactions which are by nature unpredictable.

[98] Additionally, the appellants describe Air Canada’s argument that it is not the inoperative ALS which represents the danger but rather “the fear of what might occur if something else also happens” while the ALS is inoperative as a distinction without a difference. According to the latter, any safety equipment or procedure is designed to protect against such “something else happening”, and therefore any concern with the failure or lack of safety equipment or procedures is a concern about “what might occur if something else also happens” while the safety equipment or procedures are not available, said absence of such equipment and procedures considered as effective in protecting safety being recognized in and of itself as creating a danger. It is the reply submission of the appellants that like other safety equipment and procedures such as seatbelts, sidearms, two-person armoured truck personnel, the ALS and its associated procedures exist because they are effective against anticipated hazards that have occurred in the past on commercial aircraft and can occur again.

[99] On the question of the necessity and effectiveness of the ALS and its associated procedures, it is the appellants reply submission that one can derive from Air Canada’s arguments that they are founded on an erroneous premise that the ALS and its associated procedures are unnecessary and ineffective, or of no use, which would explain the latter’s attempt at narrowing the definition of “danger”. This however is contradicted, in the opinion of the appellants, by the significant amount of resources and expenditures that go into the installation of the ALS, establishment of standard operating procedures for its use, training in those procedures and compliance with the regulatory standards requiring the ALS and associated procedures.

[100] [Text redacted].

[101] [Text redacted]. The Appellant argues that Air Canada’s submissions imply that the training and SOPs for the use of the ALS are “all frivolous”, an implication directly contradicted by all witnesses, including Ms. Anand for Air Canada, to the effect that these safety procedures are serious and important. On the usefulness or uselessness of the ALS and associated procedures with respect to certain safety and security issues, the evidence indicates that flight attendant could “make a difference”.

[102] In reply, counsel for the appellants also points to what he describes as Air Canada’s erroneous argument that the role of the appeals officer is displaced by the MMEL. Counsel thus points to the considerable reliance placed by the respondent on the MMEL and its seeking that the undersigned accept that the two flight days “repair interval” addresses safety considerations and that consequently, there can be no danger as defined by the Code, as the flight is MMEL or MEL compliant, “absent specific extraneous factors which might be present on a particular day”. Such an argument is wrong in the opinion of counsel for the appellants, since the safety equipment and procedures in issue in this case are to deal with unpredictable events and the “specific extraneous factors which might be present” to create a danger cannot be known in advance. Couching Air Canada’s argument as being essentially that there is no danger to a flight attendant from a non-functioning ALS unless the flight attendant operates the flight and is subsequently injured on said flight because of the non-functioning ALS, an “after the fact” position that counsel argues has been rejected at case law, more particularly in the Verville and Martin Federal Court and Federal Court of Appeal decisions cited previously.

[103] As to the Code versus the MMEL and MEL relationship, counsel for the appellants notes that Air Canada argues that the MMEL and MEL deal with more than airworthiness, as evidenced by a number of passages in the preamble of Transport Canada MMEL cited previously where the word “safety” is used repeatedly. The appellants do not dispute the fact that the MMEL pertains to safety. However counsel argues that the MMEL deals with safety or safety of flight from the perspective of airworthiness under the Canadian Aviation Regulations (CARS) and not the Code. What constitutes an “acceptable level of safety” under the Airworthiness Regulations cited in the MMEL preamble or a “required level of safety” pursuant to Transport Canada’s Civil Aviation Regulations Directorate is not necessarily what is required or acceptable under the Code which deals with safety of persons who are employees. In regard to such distinction, counsel for the appellants points to Transport Canada’s actual statement through its Civil Aviation Regulatory Committee (CARC) to the effect that:

After consideration, the CARC concluded that the Canada Labour Code sufficiently addresses A-OSH issues and that the MMEL/MEL policy manual is meant to address flight safety and should not be unduly burdened with requirements which are appropriately covered by other legislation.

[104] Counsel thus draws the conclusion that while Transport Canada has effectively approved the MMEL, this cannot be said to bring the manufacturer’s MMEL in compliance with the requirements of the Code. As to the two flight days repair interval rationale, it is counsel’s opinion that neither the respondent’s evidence nor its submissions provide any founded information. It is counsel’s view that Air Canada has failed to consider the MMEL from the perspective of the Code, and that from said perspective, the central question becomes whether there is any reason to consider that the ALS is less necessary to protect the health and safety of flight attendants during the two flight day repair interval in the MEL than at other times. According to counsel for the appellants, no such reason has been given in the present case.

[105] As to the claim by the respondent that three pilots had assessed the flight as safe from both the MEL (airworthiness) as well as the refusing employees perspectives and that the undersigned should defer to this assessment, the appellants note that none of those pilots testified at the hearing into the present appeals, a hearing that is de novo and as such is intended to consider anew all the information received by the HSO without being bound by the latter’s conclusions. According to counsel, an approach such as this by the respondent is simply misleading and ignores the fact that none of the said pilots gave any rationale for the two flight-day repair interval and were satisfied with merely accepting the MEL and its categorization of the repair interval for the ALS.

[106] A further reply argument by the appellants is directed at what counsel claims are incorrect statements by the respondent regarding the definition of danger and the role of the appeals officer, which counsel argues are an attempt at limiting the scope of my inquiry, one being that I am bound by the materials considered by the HSO, contrarily to my authority to conduct a de novo hearing. In essence, it is the appellants’ view that contrarily to Air Canada’s contention that I must assess the reasonableness of the employees’ refusals, focusing on both the factual situation as well as the employees’ own articulation of the perceived danger, the actual issue under appeal, when one looks at both subsection 129(7) and 146.1(1) of the Code, is whether the circumstances of the work refusal constitutes “danger” within the meaning of the Code, not whether the workers had reasonable cause to refuse to work, and thus I am not limited to the employees’ own articulation of the basis of their refusal, and that I am to decide such issue on a balance of probability, regardless of the appellants’ use of words such as “probable’, “potential” or “probably” in their submissions, terminology that the respondent claims demonstrates the “hypothetical” and “speculative” nature of the danger claimed by the refusing employees.

[107] Finally, counsel for the appellants points to a number of factual inaccuracies and mischaracterizations in the respondent’s submissions. [Text redacted]. On training and standard operating procedures, while Air Canada has argued that “the fact that employees have received training on a safety procedure and are unable to do what they have been trained to do (due to the inoperative ALS [text redacted] …does not equate to danger” and that “the mere provision of preventative training [text redacted] does not elevate the risk beyond a potential or possible hazard”, counsel for the appellants argues that the purpose of training in safety procedures and first aid is designed to mitigate risks and that Air Canada training being directed at eventualities that it considers important, according to its own witness Anand, with the flight attendants being trained to expect and deal with potential and possible hazards for just that reason that they are potential and possible.

[108] As to the consistent evidence that there is no precise written procedure (standard operating procedures) with respect to an inoperative ALS but that the pre-flight briefing would serve to establish an alternative [text redacted] protocol, counsel for the appellants notes first that one cannot equate a standard operating procedure to an ad hoc or alternative procedure, second that the evidence demonstrates that no such alternative procedure was discussed in the pre-flight AC 362 briefing and that while the respondent may elect to put the blame for this on refusing employee Vergara’s apparent focus on the resuscitation of pilots aspect rather than on an alternative [text redacted] protocol, such blaming submission ignores the fact that the pilot conducts the briefing and is, according to the respondent’s own witnesses, responsible for advising on alternative procedures and third, that the respondent has explicitly admitted through its counsel that “there is no alternative [text redacted] with an inoperative ALS [text redacted] (and accordingly no SOP in this regard).”

[109] On the “swiss cheese” model of accident causation analysis, and the proposition by the respondent that this model would stand for the suggestion that there can never be an accident without what is characterized as a “perfect storm”, meaning that if one thing does not go wrong, then the catastrophic event will not occur, an affirmation counsel argues is directly in contradiction to Air Canada’s own witness Anand, counsel for the appellants contends that this constitutes an incorrect description of the model [text redacted].

[110] [Text redacted]. Noting that a variety of scenarios had been ignored by the respondent, counsel noted that the circumstances of these refusals demonstrated a greater number of known failures than what was proposed by Air Canada. The ALS was not functioning and thus standard operating procedures relative to a functioning ALS could not be followed, there were no back-up standard operating procedures and no alternate ad hoc communication procedures were discussed at the pre-flight briefing.

[111] On the matter of the suggestion by counsel for the respondent of a hidden Canadian Union of Public Employees (CUPE) agenda towards labour relations ends, and the Montreal workplace health and safety committee recommendation, rejected by the employer based on the MEL approach, that aircraft with inoperative ALS not be dispatched, counsel for the appellants submits that Air Canada is evidently troubled by a union representing its employees in health and safety matters and recognizes that such representation is a matter of dispute between the parties. However, in the latter’s opinion, neither this nor the Air Canada submissions on the subject are relevant to the determination of the present appeals. As for the Montreal committee’s recommendation, albeit rejected, it did represent a recognition by a joint employer-employee committee vested with a health and safety function, that the ALS and its associated procedure are both effective and necessary to prevent injury to flight attendants, a position consistent with Air Canada’s own procedures and training.

[112] A final reply submission concerns evidence adduced at the hearing concerning other aircraft types and airlines. While the refusals being considered in the present case relate to an Air Canada Embraer 175 airframe flight, considerable evidence was adduced relative to events and incidents involving a variety of airframes and airlines or carriers, and in its submissions, Air Canada formulated the proposition that incidents in other aircraft in different jurisdictions did not relate to the refusing employees concerns, lacked relevance and demonstrated CUPE’s use of this information to put forward its own agenda. In reply, counsel points to the multiplicity of studies on pilot incapacitation and aircraft safety that deal with evidence from multiple jurisdictions and aircraft types and that originate from a variety of organizations that cannot be seen as attempting to advance a labour relations agenda, noting in this regard that Air Canada has offered no evidence that would suggest some feature unique to the Embraer 175 or 190 airframe in preventing pilot incapacitation, admitting on the other hand that there have been pilot incapacitation events on Air Canada Embraers. In addressing this issue of diversified evidence, counsel submits that it is not the “refusing workers concerns” that are at issue, but rather the question of whether in the circumstances of the refusal there was danger.

[113] In counsel’s view, the Federal Court has indicated in Verville (supra) at para.51 , that such a determination can be arrived at in a variety of ways:

There is more than one way to establish that one can reasonably expect a situation to cause injury. One does not necessarily need to have proof that an officer was injured in exactly the same circumstances. A reasonable expectation could be based on expert opinions or even on opinions of ordinary witnesses having the necessary experience when such witnesses are in a better position than the trier of fact to form the opinion. It could even be established through an inference arising logically or reasonably from known facts.

[114] Finally, on the matter of a proper remedy, should the appeals succeed, the view expressed by the appellants is that a clear and specific direction is necessary to ensure protection of the employees. On the submission by Air Canada that the undersigned not order the remedy requested by the appellants that, in general terminology, aircraft, particularly Embraers, not be dispatched with inoperative ALS, because such remedy would be applicable solely to Air Canada’s fleet and not that of other carriers, thereby creating a disadvantage for the respondent, the appellants’ position is that this does not differ from any other order directed at a specific employer involved in a work refusal relative to inadequate safety equipment and procedures. As to the suggestion by Air Canada that directed remedial action should be that it be allowed to propose a remedy “that would reduce the possible negative consequences of an inoperative cockpit door lock, for [text redacted] a protocol to address one of the safety and security functions of the ALS and its associated SOPs, the appellants submit that this would do nothing [text redacted] to address another safety and security function of the ALS and its associated SOPs noting that not only has Air Canada not done anything to reduce the possible negative consequence of the inoperative ALS, but it has rejected the recommendation of its own joint workplace health and safety committee that aircraft not be dispatched with inoperative ALS.