Presentation to the Canadian Aeronautics and Space Institute Aeronautics Conference
Wendy Tadros, Chair
Transportation Safety Board of Canada
April 26, 2011
Check against delivery
Slide 1: Title Page
Thank you for inviting me to speak today. And a special thanks to Professor Victor Ujimoto.
Slide 2: Introduction
On March 12, 2009, 18 people boarded a Sikorsky S-92 helicopter bound for the oil rigs of the North Atlantic. It started as a normal day.
But about 40 minutes later—just 35 nautical miles from St. John's, Newfoundland, something went tragically wrong, and the helicopter plummeted into the unforgiving waters of the Atlantic (TSB investigation report A09A0016).
Slide 3: Outline
This afternoon, I'm going to walk you through the history of Cougar Flight 91, explaining what happened during those final moments.
I'm also going to talk about the Transportation Safety Board of Canada (TSB): who we are, what we do, what we learned about the causes of this accident, and the recommendations we're making to improve helicopter safety.
As this is the first time Human Factors has been featured at this conference, I would like to use Cougar Flight 91 as a stepping stone to discuss a number of human factors issues. In this investigation, we looked carefully at the human factors, to analyze the complex interactions that day: interactions between the pilots, their equipment, and the environment.
What influenced their thinking?
Why did they make the decisions they made?
And what role did these play in the accident?
Slide 4: On Scene
In the hours after the helicopter crashed, our investigators were quickly en route to St. John's, to organize the recovery and begin the process of determining what happened.
Slide 5: About the TSB
That's our mandate: to advance transportation safety by conducting independent, professional investigations in each of four modes: marine, pipeline, rail and aviation. We seek out the causes of an accident, as well as the contributing factors, and we look for the risks in the system so we can make recommendations to reduce or eliminate them.
As a small organization—just 230 people nationwide—we punch above our weight, and we're recognized as a world leader in accident investigation. In part, that's due to our rigorous methodology, but it's also thanks to the people we work with.
They're experts and professionals from a wide variety of fields: aviation, rail and pipeline, fishermen, computer technicians, journalists, lawyers, engineers, and YES human factors—to name just a few.
Those experts … well, we're glad to have them. Because Cougar 91 was one of the most complex investigations the Board has ever undertaken.
Even once the wreckage was recovered, the process of examining it involved dozens of engineering tests, and thousands of hours of research and analysis.
Slide 6: Overview
Let me give you an overview.
Flight 91 departed St John's on March 12, 2009.
The trip to the Hibernia oil fields was expected to take a little over an hour, but at 9:45 local time, 28 minutes after take-off, the crew suddenly became aware they had trouble when a red warning message came on, indicating low oil pressure in the main gearbox. What the crew didn't know was that two of the three mounting studs on the main gearbox oil filter bowl had broken.
When these studs broke, the oil in the main gearbox escaped rapidly. With little or no oil, the gears began to overheat, and this led eventually to the failure of the gear driving the tail rotor.
Shortly after the gear failed, Flight 91 crashed into the Atlantic—just 11 minutes after the first indication of trouble.
That's the short version: studs broke, oil escaped, the gearbox overheated and, 11 minutes later, the tail rotor failed.
We learned all of this fairly early in the investigation—just over a week after the crash. And as soon as we knew it, we alerted the regulators and the helicopter manufacturer, and the studs have now been replaced on all Sikorsky S-92s worldwide.
Slide 7: The Whole Story
But the short version doesn't come close to telling the whole story, and at the TSB, our investigators are trained to look at the complete picture—the person, the machine, the environment, and the context—because at the TSB we recognize that we need to look below the surface if we want to fix the deeper problems in the system.
And concluding our investigation too soon—in effect, placing all the blame on failed titanium studs—would have been too simplistic. So in the months that followed, we dug deeper, and we found many underlying problems.
One of the keys was the recovery of a crucial piece of equipment: the flight recorder—which recorded both flight data and cockpit voices.
This data was absolutely crucial to understanding the events. Learning what information the crew received and when, and learning about the communication between the crew, allowed us to more fully understand the problem-solving and decision-making process that went on in the cockpit.
I'm now going to walk you through the history of the flight—this time in more detail and with an animation. Afterward, we'll look specifically at what we learned about the challenges facing the crew.
Slide 8: Animation
Here we have the aircraft en route at its cruising altitude of 9000 feet.
Then the crew got a main gearbox warning indicating they had a loss of oil pressure and the animation shows a close up of this.
The first warning was followed approximately 25 seconds later by a secondary indication of trouble, when the oil pressure dropped below 5 pounds per square inch (psi).
The crew turned around and began to descend. As they descended, they transmitted a Mayday and began working through the emergency checklist.
We are now going to jump ahead a few minutes, with the helicopter in level flight at 800 feet heading back to St. John's.
Suddenly, something dramatic happened that triggered a decision to ditch immediately.
The crew members advised air traffic control that they were ditching and gave the ditching command to prepare the passengers.
The aircraft was under control at first. However, the tail rotor failed when the gears controlling it began to break down.
You can see the tail rotor pinion and the stripped gears on the left.
For pilots, a tail rotor failure is one of the most difficult emergencies to control, and this was the first ever documented in a Sikorsky S-92. With no other option, the crew shut the engines down and began an emergency power-off landing.
At this point, the rate of descent was 2300 feet per minute and increasing.
From 90 feet, the helicopter fell to a severe impact with the water.
This was a crash—not a controlled ditching. The impact disabled the emergency flotation system, and the helicopter sank quickly.
Due to the crashworthy features of the S-92, all 18 people survived the impact with the water. Only 2 escaped the wreckage, and only 1 survived to tell his story.
Slide 9: A Complex Equation
What our work revealed—the complete picture I just mentioned—was a complex equation involving 16 causes and contributing factors. Yes, the broken studs began the chain of events that ultimately brought down the helicopter, but this accident depended on other factors, too—more than just mechanical problems—on human factors.
Slide 10: Key Human Factors
At the TSB, when we look back at what the people involved did or didn't do, we try to put ourselves in their places. We try to understand why they made the decisions they did—and why those decisions made sense to the crew given the context and the developing situation.
There are many, many human factors detailed in the TSB report. This afternoon, I'd like to look at just some of the challenges this crew faced—at some of the human factors at play that day.
To frame the events in your minds, consider the decision the crew had to make about whether or not to ditch that helicopter–after they turned around.
We know that if a helicopter capsizes, escape is very difficult. We also know that is why drowning is the number one cause of death in ditching or crashing accidents.
Against this background, I think the decision to ditch a helicopter in the North Atlantic—in March—must be one of the most difficult any crew would ever have to make.
And then there is the time in which this decision needs to be considered and made.
Nothing in an emergency is more precious than time. Crews need time to understand a situation, and they need time to react.
They also need guidance, very specific guidance. They get that from the rotorcraft flight manual, and from their emergency procedures.
In this accident, the S-92's flight manual had critical emergencies and non-critical malfunctions—combined in a single procedure. This made the procedures confusing and difficult to navigate.
In addition, some time-critical actions were not identified as memory items, contrary to basic emergency design principles.
We also found that the main gearbox oil system failure procedure itself was ambiguous and that it lacked clearly defined symptoms of either a massive loss of main gearbox oil or a single main gearbox oil pump failure.
This ambiguity contributed to a misdiagnosis by the flight crew: they believed the source of the problem was a faulty oil pump or sensor. They never thought they had lost all the oil in the main gearbox.
Slide 11: Key Human Factors (Cont'd)
Another aspect that we looked at was the crew's knowledge of the helicopter—specifically, the difference between what they had been trained to expect in an emergency versus what they actually experienced.
When the titanium studs broke, almost all the oil was lost within a matter of seconds. The red light you saw in the animation indicating "low" oil pressure is considered a primary indication of trouble, and according to their training, the crew would then look for a secondary indication, to confirm this. With a secondary indication, they were to land immediately.
The first such indication they'd been trained to expect was the presence of vibrations—but there weren't any.
The next secondary indication they were looking for was high oil temperature—without oil, engines run hot pretty quickly—but the oil temperature gauge read "normal."
The reason for that was a design issue. In order to operate properly, the sensor—what they call a "wet bulb"—must be submerged.
If oil is completely lost, the sensor's readings won't be reliable because it will be reading the ambient air temperature—not the engine temperature.
That information, however, was not included in the manuals, nor was it covered during crew training.
To make matters worse, the crew of Flight 91 had never been presented with a scenario in the simulator where the oil was lost so suddenly and so completely. They were seeing something for the first time.
But when we looked back, there was a secondary indication of trouble all along: the oil pressure below 5 psi.
In the S-92, the warning message you saw in the animation and the pressure gauge are independent. Therefore, low oil pressure is actually a secondary indication when the warning message is illuminated.
The crew, however, did not realize the significance of pressure below 5 psi as a secondary indication.
And so, based on their training and experience, and given the lack of other secondary indications of trouble, they elected to continue to shore at a high airspeed and power setting.
This choice of power setting and altitude likely accelerated the loss of drive to the tail rotor and significantly reduced the probability of a successful, controlled ditching.
We don't know—and we can't speculate—what they would have done had they recognized sooner that the problem was so serious.
But we do know that they hadn't been trained to expect anything like what they experienced.
Slide 12: Crew Resource Management (CRM)
The cockpit voice recording allowed us to look at another human factors issue: the interaction between the crew, or "crew resource management."
This issue isn't new, either. On screen, you'll see the wording of a recommendation from a previous TSB investigation.
When a King Air crashed at Sandy Bay, Saskatchewan in 2007, we looked at this issue in-depth and recommended contemporary crew resource management training (TSB investigation report A07C0001).
Slide 13: Cougar CRM
Crew resource management (CRM) came to the fore again in the Cougar accident. The first officer twice advised they were at "land immediately" and questioned the captain on the flight profile, but he did not challenge the decision to fly the aircraft "high and fast"—nor the captain's fixation with reaching shore.
So these concerns were never incorporated into the captain's decision-making process.
Our report finds that the lack of recent, modern CRM training likely contributed to communication and decision-making breakdowns in the cockpit.
That's what I mean by looking at the complete picture. It's only by looking at all of the factors that day that we can properly understand the crew's decision not to ditch and instead to head to St. John's.
Slide 14: Maintenance Procedures
This wasn't the first time that broken titanium mounting studs have been identified as a potential problem on the S-92 main gearbox oil filter bowl.
Eight months before Flight 91 crashed, an S-92 helicopter in Australia experienced the same massive loss of oil in the main gearbox, with similar indications as Flight 91.
Just like Flight 91, that helicopter was flying over water. Fortunately, they were able to make landfall without further incident seven minutes later.
The captain said afterward that, if a landing area had not been available, and had there been no other secondary indications of trouble, he too would have skipped ditching in favour of continued flight toward land—but at a lower altitude and airspeed.
An inspection revealed that, just like Flight 91, two of the three titanium studs on the oil filter bowl had fractured.
Sikorsky, in consultation with the United States Federal Aviation Administration (FAA), notified all operators worldwide of new mandatory inspection procedures—procedures aimed at finding and removing any other damaged studs.
In January 2009—two months before Flight 91 crashed—Sikorsky went further and said all titanium studs were to be replaced with steel ones within 1250 flying hours or one calendar year.
At the time of the accident, Cougar Helicopters had already ordered the new steel studs. They had not, however, effectively performed enhanced inspection and maintenance procedures. This risk, therefore, remained unaddressed until the day of the accident.
Slide 15: Residual Risks (Certification)
Multi-engine helicopters like the S-92 go through a rigorous design and certification process. This includes many tests to ensure that parts do not fail—or, if they do, the effect is predictable or minimized. Of the many requirements for the main gearbox, one was for it to be able to "run dry" for 30 minutes in the event of a massive loss of oil.
In the late 1980s, when the certification standards were set, this timeframe was picked to enhance landing opportunities. The S92 was certified years later, and when it came time to perform the run-dry test, there was a catastrophic failure after just … 11 minutes. Following the failed test, Sikorsky and the FAA reviewed the rules and reasoned that a total loss of oil would only happen if the oil cooler system failed.
Any other source of total oil loss was seen as, and I quote, "extremely remote." For this reason, they chose to redesign the main gearbox's lubrication system to include a bypass valve for the oil cooler instead of taking steps to redesign the gearbox. What they did not consider was a failure in the main gearbox oil filter bowl, or its titanium studs—exactly what happened to Flight 91.
So clearly, there is a problem with this certification rule. Moreover, the S‑92 is the only helicopter to be certified using the "extremely remote" provision.
Newfoundland's economy has always been closely linked to the sea. Regardless of the resource, though—first fish, now oil—people still need to get to work. That's part of what made this accident so tragic. Because the only way for these people to get to work was by helicopter.
Like commuters taking a city bus to get to the office, this was something they did regularly—and with that frequency, and that reliance, and that vulnerability, came an expectation of safety.
So when the TSB ultimately made four recommendations, we wanted to be sure they were aimed at making all helicopter flights over water as safe as possible.
Slide 17: Four Recommendations
As I said earlier, nothing in an emergency is more precious than time. If a sudden loss of oil occurred in an S-92 today, there would still be only 11 minutes before the gearbox fails. This is a direct result of the "extremely remote" provision. This provision needs to go. It's that simple.
Here, then, are our recommendations.
All Category A helicopters, including the S-92A, need to be able to fly for at least 30 minutes following a massive loss of main gearbox oil.
Moreover, with advances in technology, we want the FAA to look at today's operating environments—Hibernia, the Arctic, the North Sea … any of these extreme locations—and decide whether even 30 minutes is enough time.
Third, if a helicopter has to ditch in rough waters, its emergency flotation system should keep it afloat long enough for everyone to evacuate safely. If it can't do that—if a helicopter isn't up to the task—it shouldn't be operating. Period.
The fourth recommendation deals with preventing drowning. All 17 victims of Flight 91 died by drowning. Cold water does more than cause hypothermia. Cold water makes it almost impossible to hold your breath.
That is why passengers and crew on flights off the shore of Newfoundland are now being provided with an emergency underwater breathing apparatus.
But to make sure passengers in the rest of Canada have the same chance for survival, the Board wants emergency breathing equipment on all flights where survival suits are worn.
Slide 18: Summary
As I said earlier, a complex equation of 16 factors brought down Cougar Flight 91.
None of these stands out above the others. In fact, take any one of those factors away, and it is possible the accident might never have happened.
The good news is that, over the last two years, the causes of this specific accident have largely been addressed. The titanium studs have been replaced on all S-92s worldwide. Sikorsky has also designed, qualified, and fielded a new two-piece filter bowl, using six replaceable nut and bolt fasteners. This new two-piece filter bowl is now mandatory.
In addition, the FAA and Sikorsky have modified the S92's flight manual to address the ambiguity of "normal" temperature readings.
Within three months of the crash, Cougar also revised the helicopter's emergency checklist, and these new procedures are now covered during ground school.
Some risks, however, still exist. On contemporary crew resource management training, Transport Canada agrees in principle that this training should be a requirement for these kinds of operations—but that hasn't yet happened.
Many of the offshore facilities off the East Coast now have flight times over 2 hours, and as we look to the future—offshore facilities will be located even further from land—and there is talk of exploration in Canada's Arctic.
At the TSB, we have learned all we can from the crash of Cougar 91. Now those lessons need to be put to use to make the system—to make all helicopter flights over water as safe as they can be—now and for future generations.
Thank you for your time. I am now prepared to take your questions.
Slide 19: Questions?
Slide 20: End
- Date modified: