A “complex web” of factors, including a total loss of oil in the transmission’s main gearbox (MGB), led to the fatal crash of a Cougar Helicopters Sikorsky S-92A in the Atlantic Ocean off Canada’s east coast, the Transportation Safety Board of Canada (TSB) says.
The TSB supplemented its final report on the March 12, 2009, accident with safety recommendations calling for major changes in helicopter operations, including one provision to require S-92s and other large transport helicopters to be capable of operating for at least 30 minutes after a massive loss of MGB oil.
The accident helicopter crashed en route from St. John’s, Newfoundland and Labrador, Canada, to the offshore Hibernia oil production platform. Both flight crewmembers and 15 of the 16 passengers drowned. One passenger, pulled from the water about 80 minutes after the accident, suffered serious injuries.
The helicopter departed from St. John’s International Airport at 0917 local time and, at 0932, leveled off at 9,000 ft; the amended instrument flight plan estimated a 1040 arrival time at the oil rig. At 0945, according to data from the flight data recorder (FDR), MGB oil pressure began decreasing. An amber “MGB OIL PRES” caution message illuminated and was followed almost immediately by a red “MGB OIL PRES” warning message, accompanied by the aural warning of “GEARBOX PRESSURE … GEARBOX PRESSURE.” The crew began checklist procedures, and by 0945, MGB oil pressure had decreased to less than 5 psi, down from the normal range of between 45 and 70 psi.
“The combination of the red ‘MGB OIL PRES’ warning message … and MGB oil pressure below 5 psi … constituted a ‘land immediately’ condition, as per the S-92A Rotorcraft Flight Manual,” the report said, noting that the captain declared an emergency and requested clearance from the Gander area control center (ACC) to return to St. John’s.
ACC began issuing radar vectors, and seconds later, after the pilots turned the helicopter back toward the airport — 54 nm (100 km) to the west — they began a descent. At 0947, MGB oil pressure was 0 psi. The pilots discussed emergency preparations with ACC and the company dispatcher, and at 0951, the first officer said that the helicopter was in a “land immediately” condition. The captain responded by saying he planned to level the helicopter at 1,000 ft, but the helicopter descended to 800 ft — to “provide approximately 300 ft of terrain clearance over the highest point of land on the direct track” to the St. John’s airport and about 600 ft above the highest point near Cape Spear, the piece of land closest to the helicopter’s position.
At 0952, in response to a question from the Cougar dispatcher, the crew said they believed a ditching was “possible” rather than “imminent” or “probable.”
The report said that at 0955, “there were indications that something had just happened to the helicopter, and the captain made an immediate decision to ditch. At that point, power to the multipurpose flight recorder (MPFR) was interrupted. No additional abnormalities were verbalized by the flight crew prior to the [MPFR] power interruption to indicate what triggered the sudden decision to ditch the helicopter.
“At 0956, less than one minute after the captain advised the Cougar dispatch center that they were ditching and 11 minutes after the loss of MGB oil pressure, [the helicopter] struck the water in a slight right-bank, nose-high attitude.”
The helicopter’s emergency flotation system did not deploy, and the helicopter sank rapidly. Only two of the 16 passengers and two crewmembers exited the helicopter, and when an offshore patrol boat arrived at the accident site at 1012, its crew saw two people and two life rafts floating on the water. One person waved at the aircraft, but the second “appeared to be face-down in the water,” the report said.
At 1037, a Cougar search-and-rescue helicopter departed St. John’s for the accident site; at 1055, the helicopter arrived at the site, and 20 minutes later, the survivor was pulled from the water. Soon afterward, a second search-and-rescue helicopter recovered the second passenger, who by that time apparently had died, the report said.
Much of the wreckage was located later in March, in waters about 169 m (554 ft) deep, and recovered.
‘Very Visible’ Safety Program
The captain, with 5,997 flight hours, including 1,061 hours in S-92s, had an airline transport pilot license for helicopters; type ratings in the Bell 206 and 212, Robinson R22, Eurocopter AS 332 and AS 350, and S-92A; and an instrument rating.
He began work for Cougar Helicopters as an AS 332 first officer in January 2005, and in September 2006, was qualified as an S-92A first officer; he upgraded to captain in September 2007. He completed a pilot proficiency check in January 2009.
The 2,854-hour first officer — a veteran of 24 years in the Canadian Forces — had 94 hours in type, and type ratings in S-61s, in addition to S-92As. He also had an instrument rating. During his military service, he served for 11 years as a Sikorsky CH-124 Sea King pilot, with “extensive experience in the offshore environment,” the report said, noting that he was “routinely exposed to ditching training, annually conducting landings on the water to condition personnel for a ditching situation.”
He began work for Cougar Helicopters in April 2008 and completed the S-92A initial conversion course the following month.
In the days preceding the accident, neither pilot had exceeded flight and duty time limits.
Cougar Helicopters was established in 1986 and, in 1990, began transporting workers to offshore oil platforms. The company estimates that worldwide, 97 percent of its flying time involves overwater operations. The report described Cougar Helicopters as being proactive in developing internal safety programs and noted that it was the first helicopter company in North America to receive ISO 9001:2000 certification, which later was upgraded to ISO 9001:2008.1
“The safety program at Cougar Helicopters is very visible and all the employees of the company, from the owner on down, actively promote safety in all its activities,” the report said, citing the corporate “just culture” and the company’s implementation of a safety management system, although it is not required by regulations to have one.
The helicopter was manufactured in 2006 and had total airframe time of 2,194 hours and 1,773 cycles. It was configured for two crewmembers and up to 17 passengers. The helicopter was certified and equipped as specified by regulations, and maintenance records did not indicate that there were any problems before the accident flight.
The MGB is part of the helicopter’s main transmission assembly. The oil filter bowl in the accident helicopter was attached to the MGB housing with “three equally spaced titanium alloy stud and self-locking nut assemblies,” the report said.
Manufacturers select the types of fasteners to be used, and Sikorsky chose titanium alloy studs “because these had been used successfully on other Sikorsky products. … Also, Sikorsky declared that there was no reported history of in-service titanium stud failures.”
The oil filter bowl fasteners included anodized titanium alloy studs, silver-plated steel nuts and cadmium-plated steel washers. Anodizing and plating are used to make parts more resistant to corrosion, wear and galling — defined in the report as a type of wear in which material is “removed or displaced from a surface”; titanium and titanium alloys are prone to galling, the report said.
MGB operations require the prescribed amount and quality of lubricating oil to reduce friction between contacting surfaces and prevent the components from overheating. An insufficient amount of oil typically results in increased oil temperature.
Maintenance records indicated that Cougar Helicopters changed oil filters in its S-92As about every 220 hours — more frequently than the aircraft maintenance manual’s requirement of 500 hours or, in some cases, 1,000 hours. The change intervals were consistent with the S-92A worldwide fleet average and resulted from operators’ attempts to avoid the clogging of an oil filter element and the associated overheating of the oil. The report noted, however, that the more frequent oil filter changes also required more frequent removals of the MGB hardware.
Data Gap
The helicopter’s MPFR recorded cockpit audio data as well as flight data. The device stopped recording about 44 seconds before the crash and resumed about 1.7 seconds before impact.
There was no indication of a problem that would have caused this abnormal operation of the MPFR.
In normal operations, a helicopter’s two primary alternating current (AC) generators supply power to the MPFR. An auxiliary power unit (APU) and generator provide power during emergencies and when the main rotor speed (Nr) decreases below 80 percent. Switching from one power source to another sometimes leads to a brief power interruption, the report said.
The investigation found that, before recording was interrupted, power was provided by the primary AC generators. Then, according to MPFR data, Nr decreased to about 80 percent; after recording resumed, the APU generator supplied power.
“The lack of FDR and CVR [cockpit voice recorder] information during the latter part of the accident flight hampered the investigation team’s ability to obtain an accurate understanding of the final seconds of the event and could have prevented the timely identification of safety-significant issues,” the report said.
Other data, including those from flight control computers, electronic engine controls and the enhanced ground proximity warning system, were used to reconstruct a portion of the flight profile. They indicated that, in the final seconds of flight, the helicopter had descended at a rate between 2,300 fpm and 5,100 fpm and struck the water with “high downward velocity” that broke apart the passenger cabin and floor.
Investigation
Investigators determined that the oil loss resulted in the failure of the tail-rotor take-off pinion, which in turn led to a loss of drive to the tail rotor and a subsequent autorotative descent. “While attempting to ditch, the helicopter struck the water and sank rapidly,” the report said.
‘Extremely Remote’
The report noted that the U.S. Federal Aviation Administration (FAA) had strengthened helicopter certification requirements in the 1980s, calling for helicopters to be equipped with gearboxes that were able to operate for 30 minutes after a massive oil loss — unless an equipment failure was considered to be “extremely remote.” In that case, the FAA did not require the manufacturer to demonstrate compliance with the 30-minute requirement.
“Neither Sikorsky nor the FAA considered the possibility that the MGB oil filter bowl attachment system could fail,” the report said. “On this basis, the FAA certified the S-92A, even though it had failed the initial loss of lubricant testing. By focusing on the ‘extremely remote’ concept, both the FAA and Sikorsky lost sight of the purpose of this rule.”
Transport Canada (TC) subsequently accepted the FAA’s certification.
Earlier Incident
The report also cited a July 2008 incident in which the crew of an S-92A en route to Broome, Western Australia, from an offshore oil facility conducted an emergency landing after receiving warnings of low MGB oil pressure. None of the 16 people in the helicopter was injured, and the helicopter was not damaged in the incident.
Records indicated that the MGB in the Australian helicopter had been removed and reinstalled 17 times during the aircraft’s 1,233 flight hours, and that about 58 flight hours before the incident, an MGB oil filter bowl mounting stud had fractured during the removal process. Although it was initially suspected that the incident resulted from a temporary repair, Sikorsky later told S-92A operators to give “extra attention … to the condition and torque of filter bowl fasteners,” and in September 2008, said that the titanium studs should be replaced with steel studs.
In October 2008, Sikorsky stopped using titanium studs in new S-92As and said that failed titanium studs in helicopters already in service should be replaced with steel studs; the following month, a revision of the aircraft maintenance manual (AMM) described mandatory inspection procedures for detecting damaged MGB mounting stud threads; and in January 2009, an alert service bulletin was issued requiring the replacements within 1,250 flight hours or one year.
Sikorsky asked operators to return the titanium studs that were removed, and “all of these studs, as well as the studs recovered from the occurrence helicopter and the other Cougar helicopters, had different severities of galling, which would be consistent with a difference in the number of times the nut was installed and removed,” the report said.
The report said that Cougar Helicopters “did not effectively implement the mandatory maintenance procedures in … AMM Revision 13, and therefore, damaged studs on the filter bowl assembly were not detected or replaced.”
After release of the TSB report, relatives of crash victims asked the Canadian minister of transport to investigate the S-92’s certification, arguing that TC “never should have certified as airworthy a helicopter that could not fly for at least 30 minutes after the complete loss of MGB oil” and “should have responded in 2008 after learning about the ‘Achilles heel’ of the S-92 MGB: titanium studs prone to failure.”
Recommendations
The report cited dozens of safety actions taken in the aftermath of the accident by regulatory authorities, the manufacturer and the operator, including an FAA directive to replace all S-92A MGB oil filter bowl titanium studs with steel studs, the development by Cougar Helicopters of a descent profile in the event of MGB oil pressure loss and the company’s upgrade of flight crew attire for overwater flights.
In addition, the TSB issued four safety recommendations, including one that called on the FAA, TC and the European Aviation Safety Agency to “remove the ‘extremely remote’ provision from the rule requiring 30 minutes of safe operation following the loss of [MGB] lubricant for all newly constructed Category A2 transport helicopters and, after a phase-in period, for all existing ones.”
The TSB also recommended that the FAA “assess the adequacy of the 30-minute [MGB] run-dry requirement,” noting that, if a flight crew ditches a helicopter in “hostile waters, such as those off the Canadian east coast, the occupants are at considerable risk.” Many offshore energy facilities are more than a two-hour flight from land, the TSB said.
In addition, the TSB recommended TC action to prohibit Category A transport helicopters from engaging in overwater commercial operations “when the sea state will not permit safe ditching and successful evacuation.”
TC also should require supplemental underwater breathing devices “for all occupants of helicopters involved in overwater flights who are required to wear a PTSS [passenger transportation suit system], designed to protect against hypothermia and help keep its wearer afloat,” the TSB said. Existing regulations require helicopter passengers to wear a PTSS during extended flights over cold water.
This article is based on TSB aviation investigation report A09A0016, Main Gearbox Malfunction/Collision With Water; Cougar Helicopters Inc; Sikorsky S-92A, C-GZCH; St. John’s, Newfoundland and Labrador, 35 NM E; 12 March 2009.
Notes
- ISO 9001 is the set of standards, developed by the International Organization for Standardization, for an internationally recognized quality management system.
- “Category A” transport category rotorcraft are multiengine rotorcraft designed to assure adequate performance capability for safe flight in case of an engine failure.