On 12 March 2009 a Cougar Helicopters' Sikorsky S-92A (C-GZCH) on a flight from St John’s Newfoundland to the Hibernia offshore oil platform as CHI 91 experienced a main gear box malfunction. During an attempt to return, it became clear that a ditching would have to be attempted but this subsequently occurred at a high rate of descent 35nm east of St John’s. The helicopter was severely damaged and seventeen of the eighteen occupants drowned and the sole survivor sustained serious injuries.
An Investigation was carried out by the Transportation Safety Board of Canada (TSB). The accident helicopter was fitted a Solid State MPFR (Multi Purpose Flight Recorder) which recorded both Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) data. Recovery and data download was successful with the exception of an absence of recording from about 44 seconds before impact until just under 2 seconds from impact. Useful data was also successfully recovered from the Non Volatile Memory of both FCCs, both EECs, the HUMS, the Terrain Avoidance and Warning System (TAWS) and the Maintenance Data Computer. The Investigation did not find evidence of any pre-existing condition that would have prevented normal operation.
It was noted that the Captain, who had been PF for the flight, had gained a command on type with the Operator 16 months prior to the accident and had accumulated 5997 total flying hours which included 1061 hours on type. The First Officer had joined the Operator just over a year prior to the accident following military service as a rotary wing pilot and had 2854 total flying hours which included 94 hours type.
It was established that 13 minutes after levelling off at the intended cruise altitude of 9000 feet QNH approximately 54 nautical miles from the St. John's, a main gearbox oil pressure warning light had illuminated. An emergency was declared and a descent, and diversion back towards St. John's was commenced. The descent was continued to level at 800 feet QNH where an airspeed of 133 KIAS was maintained. Ten minutes later, approximately 35 nm from St. John's, the flight crew reported that they were ditching and less than a minute later, the helicopter struck the water in a slightly right-bank, nose-high attitude banked to the right with a low forward speed and a high rate of descent. The fuselage was severely damaged and sank quickly. It was found that all occupants had survived the impact but all except the only survivor had drowned prior to the rescue of that survivor approximately 1 hour and 20 minutes after impact occurred. The water surface temperature was 0.2°C
No signals were detected from either the aircraft ELT or the Personal Locator Beacons (PLBs) worn by the occupants of the helicopter. The use of PLBs is not required by Canadian Regulation but east coast offshore operators require them to be carried by both pilots and passengers. The ones carried by occupants of the accident aircraft were designed to be automatically activated to transmit on 121.5 MHz when immersed in fresh or salt water and remaining near the surface but since 1 February 2009, the COSPAS-SARSAT satellite system has not monitored this frequency, instead monitoring only newer technology 406 MHz PLBs and ELTs. Seven days after the accident, the wreckage was recovered and transported to St. John’s.
The track flown track to the point of turnback (A) and the impact position (B) - reproduced from the Official Report
The decision by the aircraft commander to attempt a return to St. John’s was reviewed given that the Quick Reference Handbook (QRH) response to an MGB failure is “land immediately”. It was considered that “the decision to land or ditch immediately could hinge on the pilots' interpretation of the "land immediately" definition and their assessment of the risks associated with landing immediately versus prolonging flight to reach a more suitable landing area”. It was noted that one factor which may influence a pilot's decision-making process is the consideration of a helicopter's run-dry capability before control may be lost. It was considered that “in the offshore environment, the decision to ditch or prolong flight will weigh heavily on a pilot who must consider the risks of both options” and unless they have had “repeated exposure to similarly dangerous situations, the stress of a potential ditching scenario could have a significant adverse effect on his/her ability to properly assess the situation, resulting in less effective and potentially disorganized attempts to consider alternative solutions”. Given the reliability of modern helicopters, such exposure is unlikely and in addition, pilots will often succumb to confirmation bias in which the focus of an individual will be primarily on “cues that support the most desired course of action” and this results in many offshore helicopter pilots trying to make it to shore unless they are faced with “compelling indications of a catastrophic failure such as unusual noises and/or vibrations”.
Examination of the evidence led to the finding that the MGB had continued to operate for approximately 11 minutes after a sudden and total loss of lubricating oil pressure. Examination of its components showed damage due to frictional heating caused by the continued operation without oil. This frictional heating had “led to the plastic collapse of the tail take-off pinion's teeth, eventually causing the loss of drive to the tail rotor shafts”. It was found that two of the three MGB filter bowl assembly titanium studs had sheared allowing the filter bowl to displace’ possibly as the result of damage to the studs during the removal or installation of the filter bowl.
The Findings of the Investigation as to Causes and Contributing Factors were formally recorded as follows:
- Galling on a titanium attachment stud holding the filter bowl assembly to the main gearbox (MGB) prevented the correct preload from being applied during installation. This condition was exacerbated by the number of oil filter replacements and the re-use of the original nuts.
- Titanium alloy oil filter bowl mounting studs had been used successfully in previous Sikorsky helicopter designs; in the S-92A, however, the number of unexpected oil filter changes resulted in excessive galling.
- Reduced preload led to an increase of the cyclic load experienced by one of the titanium MGB oil filter bowl assembly attachment studs during operation of CHI91, and to fatigue cracking of the stud, which then developed in a second stud due to increased loading resulting from the initial stud failure. The two studs broke in cruise flight resulting in a sudden loss of oil in the MGB.
- Following (an occurrence in Australia) Sikorsky and the Federal Aviation Administration (Federal Aviation Administration (FAA)) had relied on new maintenance procedures to mitigate the risk of failure of damaged mounting studs on the MGB filter bowl assembly and did not require their immediate replacement.
- Cougar Helicopters did not effectively implement the mandatory maintenance procedures contain in Aircraft Maintenance Manual Revision 13 and, therefore, damaged studs on the filter bowl assembly were not detected or replaced.
- Ten minutes after the red MGB OIL PRES warning, the loss of lubricant caused a catastrophic failure of the tail take-off pinion, which resulted in the loss of drive to the tail rotor shafts.
- The S-92A rotorcraft flight manual (RFM) MGB oil system failure procedure was ambiguous and lacked clearly defined symptoms of either a massive loss of MGB oil or a single MGB oil pump failure. This ambiguity contributed to the flight crew's misdiagnosis that a faulty oil pump or sensor was the source of the problem.
- The pilots misdiagnosed the (nature of the) emergency due to a lack of understanding of the MGB oil system and an over-reliance on prevalent expectations that a loss of oil would result in an increase in oil temperature. This led them to incorrectly rely on MGB oil temperature as a secondary indication of an impending MGB failure.
- By the time that the crew of CHI91 had established that MGB oil pressure of less than 5 psi warranted a "land immediately" condition, the Captain had dismissed ditching in the absence of other compelling indications such as unusual noises or vibrations.
- The Captain's decision to carry out pilot flying (PF) duties, as well as several pilot not flying (PNF) duties, resulted in excessive workload levels that delayed checklist completion and prevented the captain from recognising critical cues available to him.
- The pilots had been taught during initial and recurrent S-92A simulator training that a gearbox failure would be gradual and always preceded by noise and vibration. This probably contributed to the Captain's decision to continue towards St John’s.
- Rather than continuing with the descent and ditching as per the RFM, the helicopter was levelled off at 800 feet asl, using a higher power setting and airspeed than required. This probably accelerated the loss of drive to the tail rotor and significantly reduced the probability of a successful, controlled ditching.
- The Captain's fixation on reaching shore combined with the first officer's non-assertiveness prevented concerns about CHI91's flight profile from being incorporated into the captain's decision-making process. The lack of recent, modern, crew resource management (Crew Resource Management) training likely contributed to the communication and decision-making breakdowns which led to the selection of an unsafe flight profile.
- The throttles were shut off prior to lowering the collective, in response to the loss of tail rotor thrust. This caused significant main rotor rpm droop.
- The pilots experienced difficulties controlling the helicopter following the engine shut-down, placing the helicopter in a downwind autorotative descent with main rotor rpm and airspeed well below prescribed RFM limits. This led to an excessive rate of descent from which the pilots could not recover prior to impact.
The Findings of the Investigation as to Risk included the following:
- Certification standards for Category ‘A’ rotorcraft do not require a capability of continued safe operation for 30 minutes following a failure that leads to loss of MGB lubricant if such failures are considered to be extremely remote, placing passengers and crew at risk.
- In distant offshore operations, including the East Coast of Canada, a 30-minute run dry MGB capability may not be sufficient to optimize eventual landing opportunities.
Inadequate systems knowledge related to abnormal and emergency conditions increases the risk of pilots relying on previously learned knowledge. This could lead to unintentional errors in interpreting symptoms of a system malfunction.
- The decision not to identify time critical actions as memory items in the S-92A MGB malfunction procedure could lead to delays in carrying out actions that are vital to the safe continuation of flight.
- The decision not to automate an emergency system activation, such as the MGB oil bypass system, in the S-92A, increases the risk that critical actions will be omitted or delayed unnecessarily.
- The lack of established standards for landing guidance definitions used in abnormal and emergency procedures leaves the definitions open to misinterpretation.
- The lack of specific guidance and/or recommendations in the RFM pertaining to optimum airspeed and torque setting could result in the selection of a flight profile that accelerates the catastrophic failure of a gearbox that has lost oil pressure.
- The combination of abnormal and emergency procedures into a single procedure, which focuses first on the abnormal condition, increases the risk that critical emergency actions will be delayed or omitted.
- If manufacturers do not clearly identify critical aircraft performance capabilities in flight manuals, such as run dry time, there is increased risk that pilots will make decisions based on incomplete or inaccurate information during abnormal and emergency situations.
- The omission of caution or warning messages from a quick reference legend could result in delays in locating the appropriate abnormal or emergency response in a pilot checklist.
- The use of non-current publications such as RFM, standard operating procedures (SOPs) and checklists, increases the risk that critical steps of an approved procedure will be omitted or delayed.
- Under the current regulations, CAR 703 and 704 operators are not required to provide CRM. As a result, there is an increased risk that crews operating under CAR 703 or 704 will experience breakdowns in CRM.
- The current CRM regulation and standard for CAR 705 operators have not been updated to reflect the latest generation of CRM training or to include CRM instructor accreditation. As a result, there is a risk that flight crews may not be trained in the
latest threat and error management techniques.
- The current basic survival training (BST) standards in Canada lack clearly defined, realistic training standards and equipment requirements. This could lead to differences in the quality of training and affect occupant survivability.
- An interval of 3 years between recurrent BST may result in an unacceptable amount of skill decay between recurrent training sessions. This skill decay could reduce the probability of successful egress from a submerged helicopter.
- Passenger Transportation Suit Systems (PTSS) designed to meet the standard for marine abandonment have high buoyancy and flotation capabilities. While useful in a marine abandonment situation, these features may interfere with a successful egress from a submerged helicopter.
- There are minimal regulations and standards pertaining to offshore helicopter flight crew suit use and maintenance. This increases the risk that flight crews will be inadequately protected following a ditching or crash at sea.
- Offshore helicopter flight crew suits that are not a high visibility colour reduce the probability of detection by search and rescue crews following a ditching or crash at sea. This could significantly delay rescue at night or in bad visibility.
- Without regulations and standards pertaining to personal locator beacons (PLB) for helicopter occupants, inappropriate PLB types may be selected for helicopter transportation, resulting in delays locating a person floating in the ocean.
- The use of improper passenger transportation suit system (PTSS) fitting techniques may result in unacceptable levels of water ingress and a subsequent rapid loss of body temperature, following a ditching or crash at sea.
- There is no requirement for occupants of a helicopter to be equipped with EUBAs for prolonged over water flight. As a result, occupants are exposed to an increased risk of drowning following a ditching or crash at sea.
- The lack of regulation requiring pilots to wear helmets and visors places them at greater risk of incapacitation due to head injuries following a ditching or crash. This type of injury jeopardises a pilot's ability to assist in the safe evacuation and survival
of the passengers.
- Ditching in adverse weather conditions, and sea states in excess of the capability of the emergency flotation system (EFS), places passengers and crew at risk.
Other Findings included that the survivor probably lived through the accident due to his age, fitness, mental preparation, recent helicopter underwater escape training (HUET), previous cold water acclimatisation and a strong will to survive.
The Investigation identified four ‘Safety Issues’ as follows:
- Large, multiengine transport helicopters (Category ‘A’ rotorcraft) certified under the "extremely remote" criteria may not be capable of continued operation for 30 minutes with only residual main gear box lubrication.
- Given today's operating environments, it may now be technically feasible and economically justifiable to produce a helicopter that can operate in excess of 30 minutes following a massive loss of main gear box lubricant.
- Helicopter crews and passengers in Canada remain at risk where helicopters are operated over sea states exceeding the capability of their Emergency Flotation Systems.
- Without a supplemental breathing system, occupants have very little time to egress from a submerged or capsized helicopter before breaking their breath-holds in cold water.
The following five Safety Recommendations were made as a result of the Investigation:
On 09 October 2009:
- that the Department of Transport require commercial air operators to provide contemporary crew resource management (CRM) training for Canadian Aviation Regulations (CARs) subpart 703 air taxi and CARs subpart 704 commuter pilots. [A09-02]
At the publication of the Final Report:
- that the Federal Aviation Administration, Transport Canada and the European Aviation Safety Agency remove the "extremely remote" provision from the rule requiring 30 minutes of safe operation following the loss of main gearbox lubricant for all newly constructed Category ‘A’ transport helicopters and, after a phase-in period, for all existing ones. [A11-01]
- that the Federal Aviation Administration assess the adequacy of the 30 minute main gearbox run dry requirement for Category ‘A’; transport helicopters. [A11-02]
- that Transport Canada prohibit commercial operation of Category ‘A’ transport helicopters over water when the sea state will not permit safe ditching and successful evacuation. [A11-03]
- that Transport Canada require that supplemental underwater breathing apparatus be mandatory for all occupants of helicopters involved in overwater flights who are required to wear a Passenger Transportation Suit System. [A11-04]
Four Safety Issues were also formally identified by the Investigation as:
- Category A rotorcraft certified under the “extremely remote” criteria
may not be capable of continued operation for 30 minutes with only residual main gear box lubrication.
- Given today’s operating environments, it may now be technically
feasible and economically justifiable to produce a helicopter that can operate in excess of 30 minutes following a massive loss of main gear box lubricant.
- Helicopter crews and passengers in Canada remain at risk where
helicopters are operated over sea states exceeding the capability of their Emergency Flotation Systems.
- Without a supplemental breathing system, occupants have very little
time to egress from a submerged or capsized helicopter before breaking their breath-holds in cold water.
The Final Report was authorised for release on 29 December 2010.
Accidents and Incidents
On 12 March 2009, a Sikorsky S-92A crew heading offshore from St. John's, Newfoundland declared an emergency and began a return after total loss of main gear box oil pressure but lost control during an attempted ditching. The Investigation found that all oil had been lost after two main gear box securing bolts had sheared. It was noted that ambiguity had contributed to crew misdiagnosis the cause and that the ditching had been mishandled. Sea States beyond the capability of Emergency Flotation Systems and the limited usefulness of personal Supplemental Breathing Systems in cold water were identified as Safety Issues.
On 23 August 2013, the crew of a Eurocopter AS332 L2 Super Puma helicopter making a non-precision approach to runway 09 at Sumburgh with the AP engaged in 3-axes mode descended below MDA without visual reference and after exposing the helicopter to vortex ring conditions were unable to prevent a sudden onset high rate of descent followed by sea surface impact and rapid inversion of the floating helicopter. Four of the 18 occupants died and three were seriously injured. The Investigation found no evidence of contributory technical failure and attributed the accident to inappropriate flight path control by the crew.
On 11 March 2018, an Airbus AS350 engine failed during a commercial sightseeing flight and autorotation was initiated. The pilot then noticed that the floor-mounted fuel cut-off had been operated by part of the tether system of one of the five passengers but there was insufficient time to restore power. On water contact, the automatic floatation system operated asymmetrically and the helicopter submerged before the occupants could evacuate. Only the pilot was able to release his harness and escape because the unapproved adapted passenger harnesses had no quick release mechanism. The Investigation found systemic inadequacy of the operator s safety management system.
On 3 July 2010, an AW139 helicopter was climbing through 350 feet over Victoria Harbour Hong Kong just after takeoff when the tail rotor detached. A transition to autorotation was accomplished and a controlled ditching followed. All occupants were rescued but some sustained minor injuries. The failure was attributed entirely to manufacturing defects but no corrective manufacturer or regulatory action was taken until two similar accidents had occurred in Qatar (non-fatal) and Brazil (fatal) the following year and two interim Safety Recommendations were issued from this Investigation after which a comprehensive review of the manufacturing process led to numerous changes.
- EASA Study on Helicopter Ditching and Crashworthiness, EASA.2007.C16
- UK CAA CAP 641 Review of Helicopter Offshore Safety and Survival, published February 1995
- Human Performance in Immersion Suits, by J Power, A Simões Ré, National Research Council of Canada – Institute for Ocean Technology, May 2010
- TP13822E - Survival in Cold Waters: Staying Alive, C. Brooks, TSB Canada, January 2003
- Offshore Helicopter Safety Report, Michael Taber, 2010
- Life Rafts and Lifeboats: An Overview of Progress to Date, Chapter 9A of NATO RTO-AG-HFM-152 ‘Survival at Sea for Mariners, Aviators and Search and Rescue Personnel’, by C. Brooks, February 2008