Certified to Fail: The crash of Cougar Helicopters flight 91
On the 12th of March 2009, a Sikorsky S-92A helicopter carrying workers to an oil rig off the Canadian coast suffered a catastrophic failure of the main gearbox, sending it plummeting into the icy waters of the North Atlantic. Of the 18 people on board, only one managed to escape as the shattered helicopter sank beneath the waves. Investigators traced the failure back to a miniscule design flaw that led to a series of escalating failures during a critical 11-minute period during the fatal flight. They also found a critical miscalculation by the helicopter’s manufacturer, a previous near-disaster in Australia, and a set of misleading cues that tricked the pilots into thinking they could make it back to the airport. There were deficiencies in crew communication, faulty assumptions during certification of the helicopter, and improper maintenance. The disaster was made possible by subtle failures at every level over a period of more than ten years, from the design of the helicopter to the split-second decisions made by the crew as they plunged toward the sea. Investigators would find that the crash contained lessons for everyone, from regulators to manufacturers to operators to pilots, which would help improve the safety of helicopters around the world.
As one of the world’s largest petroleum producers, Canada has an extensive offshore drilling industry that extracts over 250,000 of barrels of crude oil every day. One of its most lucrative deposits is the Hibernia oil field off the east coast of Newfoundland, beneath the waves of the wild North Atlantic. Thousands of hardy men and women run the platforms and oil rigs here year-round, and the vast majority of them commute to work by helicopter. One of the companies offering routine flights to and from the Hibernia oil field was Cougar Helicopters, a company based in St. John’s which almost exclusively flies oil workers to oil rigs off Newfoundland.
For these flights Cougar Helicopters used, and still uses, the Sikorsky S-92A, a state-of-the-art 19-seat transport helicopter that first entered service in 2004. It was one of these helicopters that was scheduled to operate a routine flight from the city of St. John’s to the Sea Rose oil platform and the Hibernia oil rig on the 12th of March 2009. In command of the flight were Captain Matthew Davis, 34, an experienced pilot with about a thousand hours on the S-92A; and First Officer Tim Lanouette, 47, who had a long career flying Sea Kings in the Canadian navy but was new to the Sikorsky, with just 94 hours on type. Joining them that day were 16 passengers, all of whom — like the pilots — had undergone extensive survival training, which was required in order to fly on a helicopter during extended overwater operations. All the occupants of the helicopter also wore waterproof survival suits and watched a 15-minute safety video prior to boarding.
At 9:17 a.m. local time, Cougar Helicopters flight 91 took off from the helipad at St. John’s International Airport and proceeded southeast toward the Hibernia oil rig. However, no one knew that deep in the helicopter’s vital systems, a major mechanical failure was about to occur.
The most important part of a helicopter is arguably the main gearbox. The main gearbox is where engine torque is transmitted to a variety of systems, including the main rotor, tail rotor, oil pumps, hydraulic pumps, and electrical generators. The large number of moving parts and rotating gears inside the main gearbox means that it has to be filled with oil to keep everything lubricated. Without oil, the metal teeth of the gears would quickly wear down until they failed catastrophically. On the Sikorsky S-92A, pumps drive oil through a series of filters in order to remove debris. The filters are housed within a hollow metal shell called the filter bowl, which is bolted to the side of the gearbox using a set of three titanium studs. Titanium was chosen to help the studs withstand the significant loads imposed upon them as highly pressurized oil coursed through the filter bowl. However, titanium has one major vulnerability: when it rubs against metal, its surface tends to bind to that of the other object, causing it to be stripped away — a process referred to as galling. As a result, the studs suffered galling damage whenever maintenance workers removed them to replace the oil filters.
By the time flight 91 left St. John’s on the 12th of March, the helicopter’s oil filters had been changed 11 times. And every time, galling wore away some of the threads on the studs, forcing more and more stress onto the threads which remained intact. Over time, this extra stress caused one of the three studs to suffer from metal fatigue. A tiny crack formed and progressively lengthened over repeated load cycles, until the structural integrity of the stud was fatally compromised.
Twenty-eight minutes after takeoff, at 9:45, the bottom left filter bowl stud finally failed. Within a fraction of a second, the sudden transfer of stress overloaded the bottom right stud, which also broke. Attached by only one stud, there was nothing to stop the highly pressurized oil inside the filter bowl from spurting out through the gap between the filter bowl and the gearbox (see photo). Oil pressure began to drop rapidly, triggering a flashing red low oil pressure light on the pilots’ displays, and an automated voice began to call out, “GEARBOX PRESSURE! GEARBOX PRESSURE!”
A loss of gearbox pressure is an extremely serious emergency, because in the absence of lubricating oil the remaining lifespan of the gearbox will be measured in minutes. Captain Davis immediately sprang into action, turning back toward St. John’s while initiating an emergency descent from their cruising altitude of 9,000 feet. He also called for the emergency checklist, and First Officer Lanouette pulled out the Quick Reference Handbook (QRH), while Davis keyed his mic and broadcast a mayday call to St. John’s air traffic control.
Within 20 seconds of the failure, the oil pressure dropped from its normal range of 45–75 psi to less than 5 psi, indicating that all the oil had most likely escaped. The time was now ticking down to disaster. But Lanouette found that the main gearbox pressure warning wasn’t among the alerts listed in the table of contents on the back cover of the QRH. Giving up on the table of contents, he began flipping through the book in search of the procedure. Three separate times, he indicated that he was having trouble finding the checklist, but Davis was simultaneously trying to fly the helicopter and talk to air traffic control, and he didn’t hear or didn’t process Lanouette’s indirect requests for help.
After two and a half minutes of searching, Lanouette finally found the appropriate checklist — it turned out to be integrated into the checklist for the much less serious main gearbox pressure caution (as opposed to the full-on warning, which indicates a much more significant loss of oil).
Most of the checklist consisted of three sets of symptoms which the pilots could use to determine the seriousness of the failure. On a helicopter, there are three emergency courses of action which correspond to these levels of seriousness: “land as soon as practical,” “land as soon as possible,” and “land immediately.” In practice, these meant, respectively, “land at a convenient landing spot,” “land at the nearest safe location,” and “land on whatever terrain you happen to be flying over.” Their job was to determine which one applied to their situation.
Lanouette began reading off symptoms listed in the checklist, first verifying that the gearbox pressure was below 35 psi (by this point it had dropped to zero). Another item was the oil temperature, which the checklist stated should increase during an oil leak, as increased metal-on-metal contact between the gears generates frictional heat that warms the remaining oil. However, the oil temperature indication was still within the normal range. The pilots didn’t know that with all the oil gone, the sensor was actually measuring the ambient air temperature inside the gearbox. This conflicting symptom injected confusion into the situation by suggesting that there might not be a problem after all. This was further confirmed by the other symptoms listed in the checklist: fumes in the cabin, vibrations, oil pressure fluctuations between 5 and 25 psi, and hydraulic failures. None of these symptoms were present; in fact, the only sign of a problem was the oil pressure gauge reading zero. In the absence of almost all the symptoms except for the pressure reading itself, both pilots began to speculate that the problem might actually be with the sensor. After an extensive discussion, they concluded that they probably had a sensor problem, and that even if there had been some kind of leak, there would almost certainly be enough oil left in the system to allow them to limp back to St. John’s. Captain Davis set a course for St. John’s and leveled off at 800 feet, which would allow them to clear a 500-foot hill located near the airport. As a precaution, they made note of a parking lot at Cape Spear, the nearest land, as a potential alternative landing site.
Only now did Lanouette come to the end of the checklist, which listed the possible conditions under which they were obliged to land immediately. Among these was a gearbox pressure below 5 psi, so Lanouette announced that they were, in fact, in a “land immediately” condition. However, Davis was fully convinced that the problem was with the sensor, and he said as much to company dispatchers over the radio. Having come to this incorrect conclusion, he didn’t do what every helicopter pilot should do when faced with a possible failure of the main gearbox: descend to 50 or 100 feet and prepare to ditch.
At this point, First Officer Lanouette began to grow increasingly worried. He again pointed out that they were in a “land immediately” condition, but Captain Davis ignored him. Instead, Davis decided to increase engine power and see if he noticed anything abnormal. The helicopter responded normally, so he left the power at this higher setting in order to shorten their flight time back to the airport. Lanouette replied that this could be a trade-off because it could also accelerate the failure of the main gearbox if all the oil was gone, but Davis didn’t change his strategy. Lanouette soon added that from a height of 800 feet, ditching would be difficult, and they should probably review the ditching procedures, but Davis didn’t reply. Later, Davis told Lanouette that there was no reason to ditch unless it seemed the helicopter was “coming apart.”
As flight 91 proceeded back toward St. John’s, the breakdown of the gearbox was well underway. In the absence of the lubricating surface generated by the oil, metal-on-metal contact between the drive gear and the pinion gear attached to the tail rotor caused the pinion to heat up to an extremely high temperature. This heat weakened the metal, and the teeth of the pinion began to rapidly wear away. At 9:56, 11 minutes after the failure of the filter bowl, the tail rotor pinion started to give up the ghost.
A sudden vibration or yaw excursion convinced Captain Davis that the helicopter was in fact coming apart, and that a ditching would be necessary. He immediately initiated an emergency descent and informed the controllers, dispatchers, and passengers that they were about to ditch. Thirty seconds later, at 600 feet above the waves, the tail rotor pinion completely stopped mating with the drive gear — one of the most serious failures that can occur on the Sikorsky S-92A. The tail rotor serves to stabilize the helicopter in the horizontal plane; without it, the torque produced by the engines will cause the helicopter to spin around in circles uncontrollably. While most helicopters can continue to fly with a failed tail rotor, the S-92A cannot. As soon as the tail rotor pinion failed, the helicopter yawed sharply to the right at a rate of 20 degrees per second. The only way to stop this spin was to shut down the engines, which Captain Davis did within two seconds of the failure.
With the engines shut off, the pilots needed to descend to the surface using a technique called autorotation. During an autorotation, the pilots must achieve a particular blade pitch, airspeed, and pitch angle in order to optimize airflow through the rotor, allowing aerodynamic forces to spin it in place of the engines. This causes the blades to continue generating lift, making a safe rate of descent possible. But they were also traveling at too high an airspeed with too much engine power, which significantly exacerbated the control problems they experienced when the tail rotor failed. In the chaos of the moment, the captain did not lower the blade pitch to an appropriate level before shutting off the engines. The high blade pitch relative to the airstream caused increased drag, which slowed the rotor RPM below the level needed to maintain the proper descent rate during an autorotation. As the helicopter careened down through 400 feet, Lanouette accidentally keyed his microphone and broadcast frantic words of encouragement for Captain Davis over the ATC frequency. By the time Davis recovered from the pitch and roll excursions, the water was rushing up to meet them, and their airspeed was too low and descent rate too fast. Seconds later, descending at a rate considerably in excess of 2,300 feet per minute, the blade RPM dropped so low that the blades stalled, and the helicopter dropped like a rock into the sea.
Less than a minute after the failure of the tail rotor, Cougar Helicopters flight 91 slammed into the surface of the Atlantic Ocean with incredible force. The helicopter shattered on impact and seawater poured in through every crack, filling the cabin in seconds. Although all the passengers survived the impact, many were seriously injured and unable to take action. Others were caught off guard by the cold shock brought on by the icy seawater, which caused them to lose their ability to hold their breath; these people quickly drowned. Only two passengers managed to undo their three-point harnesses and swim out of the helicopter as it sank through a depth of nine meters. One managed to hold his breath long enough to reach the surface, but the other did not, and she swallowed massive amounts of seawater that caused her to drown shortly after surfacing. Within seconds of the crash, only one survivor remained: 28-year-old Robert Decker, who now found himself floating alone on the ocean surface, waiting for rescue.
After a recon plane spotted him waving at them from the water, a helicopter was sent to rescue Decker, arriving about 40 minutes after the crash. He had suffered from numerous injuries including multiple broken bones and his body temperature was dangerously low, but once out of the water, doctors were able to stabilize his condition. A helicopter also retrieved the body of the woman passenger, who was found floating on the surface nearby. But all the other passengers and crew had gone down with flight 91, and would need to be retrieved from the ocean floor along with the wreckage.
Responsibility for investigating the crash fell to the Transportation Safety Board of Canada. A special underwater salvage vessel was commissioned to raise the bodies of the victims and the wreckage of the helicopter, which was taken to a hangar in St. John’s for analysis. With Sikorsky engineers assisting, the investigators opened up the main gearbox and right away discovered the source of the problem: the studs holding the filter bowl had broken, allowing all the oil to escape. This in turn caused friction to wear down the teeth on the tail rotor pinion until it stopped mating with the drive gear, leading to the loss of control. It was at this point that the Sikorsky engineers delivered some surprising news: this had actually happened before.
In July 2008, another Sikorsky S-92A was operating a flight to an oil platform off the coast of Western Australia when the pilots received a main gearbox pressure warning. They immediately turned back toward land and began to troubleshoot the problem using the checklist. Like the crew of flight 91, they found that most of the symptoms listed in the checklist were not present, except for the oil pressure indication. However, pooling their systems knowledge, they realized that the warning and the oil pressure gauge got their pressure information from separate, redundant sensors, confirming that the indications had to be real. After flying for seven minutes, they put the helicopter down immediately upon reaching land; everyone on board survived and the helicopter was not damaged.
When Sikorsky engineers examined the gearbox, they found that the filter bowl studs had failed and all the oil had escaped. The studs showed visible evidence of galling, which had worn away the threads until the studs failed. As a result of these findings, in November 2008 Sikorsky issued a safety advisory to all S-92A operators instructing them to inspect the filter bowl studs every time they replaced the filters; to replace studs that were found to be damaged; and to send any damaged studs to Sikorsky for analysis. In January 2009, Sikorsky followed this up with a service bulletin requiring operators to replace the titanium studs with steel studs, which would not be vulnerable to galling, within one year or 1,250 flight hours. This relatively lax deadline was considered reasonable because Sikorsky had not yet received any reports of damaged studs, suggesting that the problem was rare, and because the inspection regime described in the safety advisory was clearly sufficient to detect damage. So what went wrong?
Investigators found that galling on the titanium filter bowl studs was widespread throughout the S-92A fleet, but that not a single operator had actually implemented the inspection regimes laid out in Sikorsky’s safety advisory. The only explanation for this across-the-board failure to follow directions was that operators did not understand the reason for the inspections. Their failure to report damaged studs caused Sikorsky to draft its service bulletin based on inaccurate information about the scale and urgency of the problem. Tragically, had Cougar Helicopters followed the procedures in the safety advisory, the galling on the studs on the accident helicopter would have been easily detectable.
Next, investigators looked at the S-92A’s original certification process in the late 1990s and early 2000s. Since the 1980s, most helicopters have been required to run for at least 30 minutes after a total loss of main gearbox lubrication. However, the US Federal Aviation Administration, which oversaw the S-92A’s certification process, allowed for an exception if the manufacturer could prove that the possibility of a total loss of lubrication was “extremely remote.” This meant that the probability of failure had to be within the range of one in ten million to one in a billion per flight hour — rare enough that there would certainly not be more than one or two such failures in the lifetime of the entire fleet. Sikorsky initially expected that the S-92A would meet the 30-minute rule, but to their surprise, the main gearbox failed after just 11 minutes during a “run dry” test in 2002. As a result, they decided to have the gearbox certified under the “extremely remote” provision instead. They installed a bypass valve which could halt any oil leak as soon as it was activated, providing sufficient redundancy to push a total loss of lubrication into the required probability range. The FAA certified the S-92A gearbox based off its analysis of these changes.
However, Sikorsky and the FAA did not consider a failure of the oil filter bowl in their calculations. The filter bowl failure which occurred on both Cougar 91 and in the Australian incident caused such a large leak that all the oil was already gone before the pilots could activate the bypass valve. When the S-92A was certified in Canada, Transport Canada had in fact expressed concern that pilots would not be able to activate the bypass valve in time, because Sikorsky had stated that they should do so within five seconds of receiving a gearbox pressure warning. Transport Canada felt that this action should be automated. Sikorsky replied that five seconds was a worst-case scenario and that in practice pilots could activate the bypass valve much later. Transport Canada reluctantly accepted this explanation, on the condition that Sikorsky provide some way for the pilots to know whether they activated the valve soon enough, which they did. Nevertheless, it took the pilots of Cougar 91 no less than 77 seconds to activate the bypass valve — and even if they had done so within five seconds, it still wouldn’t have been fast enough to stop the total loss of lubrication. It was clear from these findings that the basis on which the S-92A gearbox had been certified was fatally flawed, because it was possible for a single failure to circumvent the redundancy provided by the bypass valve.
Despite all of this, the failure of the filter bowl studs on flight 91 didn’t have to end in disaster. Just a few years earlier, a different type of helicopter serving Canada’s offshore oil fields also suffered a main gearbox failure; in that case, the pilots conducted an immediate controlled ditching and everyone survived. The difference between that case and Cougar 91 lay in the decisions made by the crew during the 11 critical minutes between the failure and the crash.
Investigators found a variety of contributing factors which led the pilots, especially Captain Davis, to believe that they could make it back to St. John’s. First of all, they did not know that the expected “run dry” time for the S-92A was only 11 minutes — not enough time to return to shore — because this figure was not mentioned anywhere in the flight operations manual. Had they known that the gearbox could fail after 11 minutes, they might have decided that ditching was the safer option. But an even more important contributor to their decision was the difference between how they expected a loss of gearbox pressure to unfold, and how it actually happened. During training, both pilots had faced a simulated loss of main gearbox lubrication. But in the training scenario, the loss of pressure was gradual, and below 20 psi the simulator introduced heavy vibrations which would prompt the crew to land immediately. The simulation also included rising oil temperature, which eventually decreased back to normal after all the oil was gone. In contrast, the real loss of lubrication happened very suddenly, with no gradual drop in pressure; the oil temperature never had a chance to increase before all the oil was gone; and no vibrations occurred. The emergency checklist also emphasized these symptoms, and it was buried inside the checklist for the less urgent main gearbox pressure caution light, because Sikorsky expected this light to come on before the more serious main gearbox pressure warning. Again, the procedure was based on an expectation that any leak would be gradual, which contributed to First Officer Lanouette’s difficulty in finding the checklist, and to the pilots’ confusion while interpreting it.
All these misleading expectations led the pilots to conclude that they probably had a sensor problem rather than an actual loss of oil pressure. As a result, Captain Davis chose to level off at 800 feet in order to clear the hill near the airport, and kept their speed well above the value recommended in the emergency checklist. When the tail rotor failed, this forced them into an autorotation. By the time they regained directional control of the helicopter, their airspeed was too low, the blades weren’t spinning fast enough, and their descent rate was much too high. Had they been flying at 100 feet instead of 800 feet, none of this would have mattered, because when the first signs of tail rotor trouble began, they would have been able to descend all the way to the water before the rotor actually failed.
Nevertheless, it was clear from the cockpit voice recording that First Officer Lanouette had doubts about Captain Davis’s decision to continue the flight. At numerous points, he voiced concern about their height, speed, and lack of preparedness for a ditching which Davis duly ignored. This suggested a lack of appropriate crew resource management. Although he only had 94 hours on the S-92A, Lanouette had 11 years of overwater experience as both a first officer and a captain on Sea King helicopters, and he was well aware the danger of not being ready to ditch if something went wrong. But Lanouette had a submissive personality, and he lacked the assertiveness to effectively challenge Captain Davis’s assumptions about the situation. Davis was known for his strong personality and had over ten times as many hours on the S-92A, which caused a steep authority gradient where Davis did not take Lanouette’s concerns seriously.
Davis also failed to display effective task and workload management during the emergency. Within seconds of the warning, he started flying the helicopter, communicating with air traffic control, and managing the response to the emergency. Meanwhile, Lanouette did nothing but struggle to find the checklist for two and a half minutes. Davis should have handed over the time-consuming but rote task of flying the helicopter to Lanouette while he used his superior experience and judgment to interpret the checklist and determine their course of action. He also did not adhere to the principle of “aviate, navigate, communicate,” as he spent valuable time engaged in lengthy radio conversations, when it was entirely within his rights to tell ATC to stand by while he stabilized the situation. Instead, he became so saturated with tasks that he repeatedly tuned out Lanouette’s indirect suggestions and requests for help. Unable to focus on everything at once, his brain latched on to indications which supported his desired course of action: to return to the airport. It was a classic case of confirmation bias. Had Davis and Lanouette engaged in an open conversation about their options, Davis might have realized that it would be dangerous to be at 800 feet if something went wrong.
The high number of fatalities was a direct result of this series of misguided decisions. The high rate of descent at impact caused the cabin walls to fail, allowing the helicopter to sink almost immediately. It also caused serious injuries to the passengers and crew which prevented some of them from escaping. Had they landed with an appropriate rate of descent, air bags on the bottom of the helicopter would have automatically inflated to keep it afloat, and there might have been enough time for everyone to escape. But the heavy impact destroyed the air bags’ deployment systems and not one of them inflated.
That Robert Decker managed to survive was a miracle. Escaping from a sinking helicopter after a large impact like that of flight 91 requires mental fortitude, clarity of thought, a strong survival instinct, and no small amount of luck. Decker had all of these factors working in his favor, but only because he had undergone intensive cold water survival training. Tellingly, the other passenger who managed to escape had also received this training, while most of those who went down with the helicopter had not. The icy water quickly robbed them of their ability to think clearly and hold their breath, leaving them with no chance to escape.
As a result of the accident, the FAA issued several airworthiness directives mandating changes to the Sikorsky S-92A. The first AD required S-92A operators to immediately replace their titanium filter bowl studs with steel versions. No S-92A ever again flew with titanium studs. The FAA also ordered Sikorsky to change the S-92A flight manual to clearly indicate that the helicopter’s “run dry” time could be as little as 10 minutes or less; and mandated a design change to the filter bowl which would prevent it from failing as a result of a failure of a mounting stud. Cougar Helicopters introduced a new safety management system; started a program which successfully increased the use of helmets among its pilots; amended its low oil pressure warning checklist; and hired a qualified crew resource management instructor to teach an updated CRM program. Sikorsky increased the number of filter bowl studs from three to six. Helicopter passengers in the Canadian offshore oil fields were provided with underwater breathing apparatuses and helicopter ditching survival training was improved. And finally, S-92A pilots are now taught that oil temperature readings may appear normal if all the oil is gone.
Beyond the actions already taken, the TSB also issued several recommendations, including that Sikorsky redesign the bypass valve to activate automatically when a loss of oil pressure is detected; and that the FAA require all helicopters to adhere to the 30-minute run dry rule.
The crash of Cougar Helicopters flight 91 contains valuable lessons for every part of the aviation industry, from the danger of probability-based certification loopholes to the importance of considering the worst-case scenario when making decisions. No one person or organization was responsible for the accident, which occurred due to an accumulation of numerous interconnected failures at the FAA, at Sikorsky, at Cougar Helicopters, and in the cockpit of the ill-fated flight. The sequence of events is also a sobering reminder to be vigilant and prepared while flying on board a helicopter, whether you’re a pilot or a passenger. Helicopters have fewer redundant systems and more single points of failure than airplanes. While an airplane’s natural desire is to keep flying, a helicopter’s natural state is basically a brick, requiring multiple complex systems just to keep it from falling out of the sky. It is difficult to design a helicopter that meets the level of mechanical safety expected of fixed-wing airplanes, but if the response to the crash of flight 91 shows us anything, it’s that safer helicopters are possible if the industry is willing to put in the effort.
_______________________________________________________________
Join the discussion of this article on Reddit!
Visit r/admiralcloudberg to read and discuss over 160 similar articles!
You can also support me on Patreon.
