Unlikely things do happen during flights … and not always one at a time. Some of aviation’s most catastrophic accidents are the products of extended sequences of events and miscalculations, each almost prohibitively unlikely, yet combining to create an event that changes lives.
The immediate cause of the March 2009 crash of Cougar Helicopters Flight 91 (CHI91), a Sikorsky S-92A ferrying workers to a North Atlantic oil platform, was traced to a design flaw aggravated by real-world maintenance practices more intensive than those scheduled by the manufacturer, and compounded by certification standards based on unrealistic assumptions. Faulty decision-making arising from a misunderstanding of the aircraft’s systems and survival gear imperfectly matched to the environment of a ditched aircraft also contributed to the loss of 17 of the 18 people on board.
The Flight
CHI91 took off from St. John’s International Airport in Newfoundland (CYYT) at 9:17 a.m. on a scheduled flight to the Hibernia offshore oil platform, a trip of about 170 nautical miles (nm). Weather was good for the North Atlantic in March, with south winds gusting to 20 knots and 15 miles visibility under an 8,000-foot overcast. The aircraft was less than three years old and had been operated for 1,773 cycles, comprising slightly less than 2,200 hours.
Both pilots held Canadian airline transport pilot licenses with S-92A type ratings and current Group 4 (helicopter) instrument ratings. The 34-year-old captain was the pilot flying. He had 5,997 hours of flight time, including 1,061 in type, and was described as “a confident, skillful pilot, with a strong personality.”
The 48-year-old first officer had 2,854 hours of experience with 94 in type and had recently completed 24 years of military service, 11 of them flying the Sikorsky CH-124 Sea King. All 16 passengers were current in the survival training required for Canadian offshore oil workers and had been fitted with approved immersion suits.
Fifteen minutes after takeoff, the helicopter leveled at its filed altitude of 9,000 feet and an indicated airspeed of 112 knots. Power was set at 70 percent torque.
At 9:45:27 a.m., the captain made a Mayday call to the Gander Aircraft Control Centre reporting an indicated loss of main gearbox (MGB) oil pressure. During the next 30 seconds, the helicopter reversed course and began descending as Gander provided radar vectors back to CYYT, 54 nm to the west, and notified the Joint Rescue Coordination Centre in Halifax.
The pilot and first officer initially discussed ditching the aircraft, but indicated oil temperature remained normal and there were no unusual noises or vibrations. The captain chose to continue back to St. John’s at an 800-foot altitude, but at 9:55 a.m., almost 10 minutes after his original Mayday call, he interrupted a conversation with company dispatchers to announce that they were ditching immediately.
Based on information recovered from the aircraft’s monitoring systems, the helicopter went down less than 60 seconds later. The first fixed-wing patrol aircraft arrived 17 minutes after that and found two empty life rafts and two people on the surface, one waving at the aircraft and the other floating facedown. The sole survivor was rescued at 11:15 a.m. with seawater in his lungs and a core temperature of 86 degrees. The only other passenger who escaped could not be revived.
Investigation and Explanation
The wreckage was located two days later about 35 nm east of St. John’s at a depth of 550 feet. Recovery was accomplished with the aid of remotely operated submersibles and a salvage ship equipped with a sophisticated dynamic positioning system, heave-compensating 50-ton crane, and improvised cargo cage. The bodies of the remaining victims, most of the aircraft, and the multipurpose flight recorder (MPFR, a combined cockpit voice and flight-data recorder) were all retrieved during the next five days.
Transportation Safety Board of Canada investigators found that only one of the three titanium studs securing the MGB oil filter bowl remained intact. Two had fractured, allowing the bowl to slip and dump the gearbox oil. Scuff marks on the bowl showed that the lower-front stud had broken first, increasing the load on the lower aft until it also fractured. Heat damage was apparent throughout the assembly. The tail take-off pinion’s teeth had been destroyed, disrupting power transmission to the tail rotor.
Data recovered from eight internal electronic monitoring systems were correlated with the MPFR recordings. MGB oil pressure reached 0 at 9:47 a.m., two minutes after the warning light illuminated. The co-pilot pointed out three times between 9:50 a.m. and 9:52 a.m. that the emergency checklists identified the combination of the red warning light and indicated pressure below 5 pounds per square inch as a “land immediately” condition: the risks of continuing flight exceeded those of ditching under power.
The pilot responded that he wouldn’t ditch unless “the helicopter started to come apart.” Instead of reducing power and airspeed to minimize mechanical stress, he maintained 73 percent engine torque and 135 knots, hoping to reach shore as fast as possible.
He changed his mind after a sudden fluctuation in main rotor rpm at 9:55:15 a.m., reducing power to 34 percent and beginning a slow descent. Ten seconds later came a brief right yaw. After 19 seconds of pitch and bank excursions, yaw abruptly surged to 20 degrees per second as the tail rotor drive failed.
Three seconds later both engines shut down. A brief increase in collective passing through 400 feet caused a drop in main rotor rpm and rapid acceleration of the descent.
At 163 feet of altitude and 93 percent rpm, the pilot applied aft cyclic and full-up collective. Main rotor rpm was 81 percent and decaying at 90 feet; the descent rate was 2,300 feet per minute. The ship hit the water with 20 to 25 Gs of force, broke into three pieces, and sank.
Mechanical Concerns …
Based on its similarities to the S-60 Black Hawk, both Sikorsky and the FAA expected the S-92A MGB to be able to operate for at least 30 minutes without lubrication. The actual test came very late in the certification program — and the MGB failed catastrophically after 11 minutes, about the same interval as in CHI91.
Both Sikorsky and the FAA concluded that a loss of oil for any reason other than leaks from the cooler or supply lines was “extremely unlikely” — on the order of once per 10 million flight hours. Working from that assumption, they modified the design by incorporating a cooler bypass valve and then repeated the test, this time draining the system via an oil cooler leak. About 4.3 gallons of oil remained for splash lubrication, compared to the 1.3 gallons left after draining the MGB directly. The aircraft passed this test, and Sikorsky’s analysis of possible failure modes was eventually accepted en route to North American and European certification.
Field experience, however, began to show that the titanium studs were subject to galling that worsened each time the self-locking nuts were removed and reinstalled, especially if the same nuts were reused. The galling increased friction so that the specified torque on the nut no longer put the designed preload on the stud.
And while Sikorsky’s specification of 500-hour maintenance intervals during a 2,700-hour service life led it to expect five filter removals per unit, operators (including Cougar) adopted the practice of replacing the filter any time the impending bypass valve opened, a far more common event. In 2,200 hours of service, the accident helicopter’s filter had been replaced 11 times.
A similar failure in Australia had been blamed on a dubious field repair, but after the CHI91 accident, the FAA issued an Emergency Airworthiness Directive requiring immediate replacement of the titanium studs with steel equivalents. All 59 titanium studs returned to Sikorsky afterward had damaged threads.
… And Human Factors
The indication of normal MGB oil temperature was a crucial factor in the captain’s reluctance to ditch. Believing that rising temperature would provide a secondary indication of oil loss, he concluded that the pump must have failed, leaving oil to provide splash lubrication to the gearbox. The voice recording suggests that neither pilot understood that the temperature probe only transmits accurate indications when immersed in oil, making it unresponsive to a sudden complete loss.
During his years as a Sea King pilot, the first officer regularly trained in ditching procedures, including annual water landings. This likely contributed to his greater comfort with a precautionary landing at sea. However, a “lack of assertiveness” had slowed his upgrade to aircraft commander and then mission commander in the Canadian Forces, while the captain was described as strong-willed and confident. Both had done full-down autorotations in other helicopters but had only simulator practice in the S-92A, whose rotorcraft flight manual prohibits the maneuver.
Post-mortem examination showed that the pilots, who were not wearing helmets, suffered head and chest injuries that may have been incapacitating. Both drowned.
Eight of the 16 passengers had either no or minor traumatic injuries, while injuries to the remaining eight were serious but potentially survivable (principally lower-body fractures). All but one passenger, however, drowned.
The combination of injury and cold shock almost surely kept them from holding their breaths long enough to escape the rapidly sinking helicopter. The Transportation Safety Board raised the prospect that emergency underwater breathing aids, which provide an additional two to four minutes of air, might have significantly improved survival prospects. Canadian military maritime helicopter crews have had this equipment since 2001, but the program to introduce it to the civilian offshore fleet had not become operational at the time of the accident.
The Takeaway
An open-ocean ditching is a daunting prospect under any circumstances, not least in winter with water temperatures near freezing. However, prospects for successful evacuation and rescue are vastly better following a controlled touchdown under power than an autorotative or, worse, uncontrolled descent.
The Cougar S-92A had emergency floats that might have provided passengers and crew with a reasonable chance to deploy and board the life rafts and trigger the aircraft’s emergency locator transmitter. Most of the overwater pilots who contributed to Internet discussions about the accident, however, said that if faced with the same indications, they too would have tried to fly back to shore.
An unsuspected design flaw, a failure mode that lacked the expected symptoms, crew dynamics preventing the better-trained pilot from following the prescribed emergency procedure, immersion suits without supplemental air — it could be discouraging to realize we can fall victim to such a constellation of unlikeliness.
But just as many accidents are caused by multiple factors going wrong, many flights land safely because enough of those factors went right instead. Cutting one link does break the chain.
