Aviation Investigation Report A09A0016

On 12 March 2009, at 0917 Newfoundland and Labrador daylight time, a Cougar Helicopters' Sikorsky S-92A (registration C-GZCH, serial number 920048), operated as Cougar 91 (CHI91), departed St. John's International Airport, Newfoundland and Labrador, with 16 passengers and 2 flight crew, to the Hibernia oil production platform. At approximately 0945, 13 minutes after levelling off at a flight-planned altitude of 9000 feet above sea level (asl), a main gearbox oil pressure warning light illuminated. The helicopter was about 54 nautical miles from the St. John's International Airport. The flight crew declared an emergency, began a descent, and diverted back towards St. John's. The crew descended to, and levelled off at, 800 feet asl on a heading of 293° Magnetic with an airspeed of 133 knots. At 0955, approximately 35 nautical miles from St. John's, the crew reported that they were ditching. Less than 1 minute later, the helicopter struck the water in a slight right-bank, nose-high attitude, with low speed and a high rate of descent. The fuselage was severely compromised and sank quickly in 169 metres of water. One passenger survived with serious injuries and was rescued approximately 1 hour and 20 minutes after the accident. The other 17 occupants of the helicopter died of drowning. There were no signals detected from either the emergency locator transmitter or the personal locator beacons worn by the occupants of the helicopter.

---

1.1 History of the Flight

1.1.1 Pre-Flight Preparation

On the morning of the occurrence, the crew completed their flight planning and prepared the helicopter for the flight. The passengers were given the required pre-flight safety briefing. The passengers and flight crew were provided with immersion suits for the over-water flight.

1.1.2 Departure and En Route

Cougar Helicopters Inc. (Cougar Helicopters) Flight 91 (CHI91)^{Footnote 1}, departed on an instrument flight rules (IFR) flight plan from St. John's International Airport (CYYT), Newfoundland and Labrador at 0917^{Footnote 2} destined for the Sea Rose oil platform and then the Hibernia oil rig. The captain occupied the right seat, and was the pilot flying (PF). The first officer was seated in the left seat and was the pilot not flying (PNF). Shortly after take-off, the crew amended the flight plan and received clearance to go to the Hibernia platform first and then to the Sea Rose. At 0932, the helicopter levelled off at 9000 feet asl. Power was set at 70% engine torque (torque) resulting in an indicated airspeed of 112 knots. The estimated arrival at Hibernia was 1040.

1.1.3 Recognition of Emergency and Descent

At 0945:05, the flight data recorder (FDR) registered that the main gearbox (MGB) oil pressure started decreasing from its normal range which is between 45 psi to 70 psi. Within approximately 1 second, the amber MGB OIL PRES caution message, indicating low MGB oil pressure, appeared momentarily before extinguishing due to the illumination of the red MGB OIL PRES warning message. The illumination of the red MGB OIL PRES warning message was accompanied by the aural warning: "GEARBOX PRESSURE…GEARBOX PRESSURE". Moments later, the captain directed the first officer to locate and begin the checklist procedure. By 0945:25, the MGB oil pressure had dropped below 5 psi. The combination of the red MGB OIL PRES warning message (i.e., primary indication) and MGB oil pressure below 5 psi (i.e., secondary indication) constituted a "land immediately" condition as per the S-92A Rotorcraft Flight Manual (RFM).

At 0945:27 the captain issued a mayday to Gander ACC, advising that they had a MGB oil pressure problem and requested a clearance back to CYYT (see Figure 1, Point A). At 0945:31 the captain initiated a descent from 9000 feet asl. Immediately after receiving the mayday call, Gander ACC issued radar vectors to CHI91, directing it towards CYYT. At 0945:57, CHI91 had completed its turn, and was approximately 54 nautical miles (nm) from CYYT and 47 nm from Cape Spear, which was the closest piece of land.

During the departure and en route portion of the flight the first officer handled all radio transmissions. However, after receiving the MGB oil pressure warnings, the captain, who was the pilot flying, handled all external radio communications while the first officer referenced the emergency checklist.

At 0945:58, the PF stated that he was initiating a descent to the water, which the PNF acknowledged. Less than 1 minute later, they discussed preparing their immersion suits. The crew then discussed if the landing gear should be extended (the first step in the ditching checklist), but it was decided not to lower it at that point.

At 0947, the crew discussed if there were any unusual smells or vibrations; however, there were no signs of smells or vibrations and nothing was abnormal in the back of the helicopter. At that time, the FDR recorded that the MGB oil pressure reached 0 psi. Throughout the event, both pilots monitored the MGB oil pressure gauge and were aware that it indicated 0 psi.

The captain confirmed with Gander ACC that they were in visual meteorological conditions (VMC) and advised that they had lost all MGB oil pressure. Gander ACC informed CHI91 that the Joint Rescue Coordination Centre (JRCC) in Halifax had been notified of the situation. The captain acknowledged this transmission and indicated that he had also advised the Cougar dispatch centre to get another machine ready in case it was required.

Figure 1 depicts the outbound portion of CHI91's flight path prior to the red MGB OIL PRES warning message (solid green line), the point where the oil pressure loss occurred (see Point A), the return portion of the flight (red line), and the approximate position it impacted with the water (see Point B). The blue dashed line is the projected track from the impact position direct to CYYT. The inset shown in Figure 1 depicts the distance between Cape Spear and the direct track followed by the helicopter, from the diversion point to CYYT.

At 0951:14 Gander ACC provided CHI91 with the latest altimeter setting and asked for the number of people on board and fuel remaining. At the same time, the helicopter warning system announced "MINIMUMS, MINIMUMS", indicating that they had reached the preset level-off altitude. The captain acknowledged the altimeter setting and then told Gander there were eighteen persons onboard and 3 hours of fuel. Immediately afterwards, the first officer concluded the MGB oil system failure procedure by stating that they were in a "land immediately" condition. The captain's response to the first officer was that he was going to level off at approximately 1000 feet asl.

1.1.4 Level-off and Continued Flight at 800 feet asl

As CHI91 descended through 1000 feet asl, the PF increased the power slightly in order to maintain altitude. At 0951:50 the FDR recorded an increase in torque. Moments later, the helicopter levelled out at 800 feet asl. This would provide approximately 300 feet of terrain clearance over the highest point of land on the direct track from their present position to CYYT and approximately 600 feet of terrain clearance over the highest point in the vicinity of Cape Spear. At 0952:16, the Cougar dispatch centre advised CHI91 that the JRCC was asking if ditching was imminent, probable, or possible. The captain, with the concurrence of the first officer, responded that ditching was possible. The captain also indicated that they suspected they had experienced an oil pump or an oil pressure sensor problem since the MGB oil temperature was still indicating in the normal range. During this conversation with the Cougar dispatch centre, the captain added that they did not believe they had lost all the MGB oil.

Commencing at 0954:08, the captain engaged in a discussion with the Cougar dispatch centre that lasted the next minute and seven seconds. At 0955:15, there were indications that something had just happened to the helicopter and the captain made an immediate decision to ditch. At that point, power to the multipurpose flight recorder (MPFR) was interrupted. No additional abnormalities were verbalized by the flight crew prior to the power interruption to indicate what triggered the sudden decision to ditch the helicopter.

At 0956, less than 1 minute after the captain advised the Cougar dispatch centre that they were ditching, and 11 minutes after the loss of MGB oil pressure, CHI91 struck the water in a slight right-bank, nose-high attitude. The impact with the water compromised the helicopter structure and the helicopter's emergency flotation system did not deploy. The helicopter sank rapidly and all but two passengers remained inside.

1.1.5 Location of Accident Site and Recovery of Survivor

The accident location was approximately 35 nautical miles (nm) from CYYT (approximate position of 47°26′03″N, 051°56′35″W), on a direct track between the diversion point and CYYT (see Figure 1).

At 1012, approximately 17 minutes after CHI91 advised that they were ditching, a fixed-wing offshore patrol aircraft arrived on scene and spotted two persons and two life rafts floating on the water. One person was waving at their aircraft; a second occupant appeared to be face-down in the water.

At 1037, Cougar Rescue 61, a company S-92A equipped for search and rescue (SAR) operations, departed CYYT for the accident site, arriving at 1055. Using the helicopter's hoist, a rescue specialist recovered the sole survivor approximately 20 minutes later. At 1140, a second helicopter, Cougar Rescue 62, arrived on site and recovered the second passenger via hoist, but no vital signs were observed.

The first military aircraft to arrive on scene was a CP140A (Arcturus) at 1032. It was followed, at 1104, by a C130 (Hercules) SAR aircraft. At 1158, three CH-149 Cormorant SAR helicopters arrived on scene. Active search operations continued until the JRCC called off the search the following day at 2000.

1.2 Injuries to Persons

1.3 Damage to Aircraft

CHI91's airframe was severely compromised by impact forces with the water. The forward cockpit, central fuselage/cabin floor area, upper deck, and aft vertical pylon (tail) were separated into four sections which were held together by sections of cable, wiring bundles, and some structural components. Some floating debris was recovered by surface vessels including the left sponson and fuel bladder, rear cargo door, two life rafts, other lightweight buoyant materials, and some personal effects. The right sponson and fuel bladder were not recovered. During the weeks following the accident, additional pieces of floating debris were recovered by surface vessels.

The cockpit was extensively damaged and had structurally separated from the main fuselage. Both crew emergency exit windows had been detached by the force of the impact as the cockpit fuselage structure had been severely crushed. The cockpit area, including the flight controls and instrument panel, from the nose rearward to where the cockpit joins the main fuselage, was found lying under much of the forward cabin wreckage. The left-hand pilot seat had remained attached to the cockpit structure but the right-hand pilot seat had separated from its attachment structure.

The main cabin walls and floor were structurally compromised and had broken in several places. The left and right sides of the cabin fractured horizontally along the passenger window frames and emergency exits, separating it from the upper deck and cabin roof. All of the jettisonable passenger windows had separated from the fuselage during the impact and none were recovered. The forward left side wall of the cabin, including the avionics racks and airframe structure aft of the cockpit was fractured and bowed outward. The forward and aft left emergency exits, as well as the aft right emergency exit, separated from the fuselage and were not recovered. The two-piece main entrance door had separated from the fuselage at impact and both portions were recovered.

The upper deck section/cabin roof, including the engines, auxiliary power unit (APU), transmission, and main rotor assembly remained barely attached to the wreckage. The upper deck had buckled and, with all its associated machinery, had rotated 180 degrees from its normal position to face rearward along the helicopter's longitudinal axis. All four main rotor blades remained attached to the rotor head and MGB.

The tail section (which includes the tailboom, intermediate gearbox [IGB], the tail rotor gearbox [TGB], and tail rotor assembly) had completely separated from the airframe and was located close to the main wreckage on the ocean floor. The aft baggage door, aft emergency flotation system bag, cylinders, and associated plumbing also separated from the helicopter.

A remotely operated vehicle (ROV) surveyed the extent of the helicopter breakup and reorientation of the major sections, including a main landing gear adjacent to the main rotor hub and blades (see Photo 1).

1.4 Other Damage

There was no other damage to property or the environment.

1.5 Personnel Information

1.5.1 General

1.5.2 Captain

The pilot was certified and qualified for the flight in accordance with existing regulations. The captain held a Canadian airline transport pilot licence (ATPL) - helicopter, with type ratings on the Bell 206, Bell 212, Robinson 22, Eurocopter AS332, Eurocopter AS350, and Sikorsky S-92A. His licence was endorsed with a group 4 instrument rating valid until 01 February 2010.

From 1996 to late 2003, the captain worked in his first flying position as a pilot on single-engine, single-pilot helicopters for a helicopter company based in Newfoundland and Labrador. These operations were conducted in visual flight rules (VFR) conditions. In addition, he also acted as a first officer on a twin-engine, two-crew, helicopter for that same company, conducting VFR and instrument flight rules (IFR) operations. During his time with this company, the captain completed several over-water flights. He also completed autorotations to touchdown on land during his annual training. The captain was considered to be a confident, skilful pilot, with a strong personality.

On 10 January 2005, the captain joined Cougar Helicopters as a first officer on the AS332. In September 2006, he was qualified as a first officer on the S-92A. On 27 September 2007, he was upgraded to captain on the S-92A. On 09 January 2009, he completed his pilot proficiency check (PPC), and it was valid until 01 February 2010. The captain was considered to be safety conscious, and was not reluctant to raise concerns that he perceived as having an adverse effect on operations or safety margins. To share some of his own experiences with other pilots, he wrote an article on helicopter icing that was published in Transport Canada's (TC) Aviation Safety Letter.

The captain's flight and duty time limits were not exceeded. In the days prior to the occurrence, the captain flew 4.2 hours on 09 March 2009, 8.5 hours on 11 March 2009, and had 13 hours off duty prior to commencing work on 12 March 2009. On the day of the occurrence, the captain reported to work around 0800 and Cougar Helicopters employees that spoke to him did not observe any unusual behaviour or signs that the captain was not well rested.

1.5.3 First Officer

The first officer was certified and qualified for the flight in accordance with existing regulations. The first officer held a Canadian ATPL - helicopter, with type ratings on the Sikorsky S-61 and S-92A. His licence was endorsed with a Group 4 instrument rating valid until 01 June 2010.

Prior to his employment at Cougar Helicopters, the first officer served 24 years with the Canadian Forces (CF). From 1997 to 2008, he served as a pilot on the Sikorsky CH-124 Sea King, filling a wide variety of operational roles, gaining extensive experience in the offshore environment. Possessing a relaxed demeanour, the first officer was well liked by his peers and superiors. However, he was slow to progress through the Sea King upgrade program because of difficulties related to systems and operational knowledge, and a lack of assertiveness that made him more inclined to defer decisions to more experienced personnel. The first officer was eventually upgraded to Aircraft Commander, and then to Mission Commander, responsible for the coordination and execution of operational maritime missions. As a Sea King pilot, he was routinely exposed to ditching training, annually conducting landings on the water to condition personnel for a ditching situation. As is often the case when training with large, multi-engine helicopters, the first officer did not conduct autorotations to touchdown in the Sea King. Those exercises were limited to the simulator; however, the first officer did complete autorotations during his basic helicopter training with the CF.

The first officer joined Cougar Helicopters on 21 April 2008. The first officer then completed the S-92A initial conversion course, which concluded with a PPC on 25 May 2008. The first officer's training records from the S-92A initial conversion course make references to crew resource management (CRM) difficulties; however, the reports indicated that his CRM was continuing to improve with each session. The first officer's PPC was valid until 01 June 2009.

The first officer's flight and duty time limits were not exceeded. Following the completion of his initial conversion course, the first officer was assigned to an international deployment that did not include regular flying. This deployment, combined with time off following his return, resulted in the first officer gaining only a limited number of flight hours during his employment with Cougar Helicopters. In the days prior to the occurrence, the first officer flew 5.1 hours on 09 March 2009, 2.8 hours the day before the occurrence, and had 14 hours off duty prior to commencing work on 12 March 2009. On the day of the occurrence, the first officer reported to work around 0700 and Cougar Helicopters employees that spoke to him did not observe any unusual behaviour or signs that the first officer was not well rested.

1.6 Aircraft Information

1.6.1 General

The S-92A is a four-bladed, twin-engine, medium-lift helicopter built by Sikorsky Aircraft Corporation for the civil and military helicopter market (See Photo 2 and Figure 2). The civil transport version has an airliner-type interior which seats up to 19 passengers. The first production S-92A was delivered to an American operator in September 2004. Cougar Helicopters' S-92A helicopter C-GZCH was configured to carry 2 crew members and up to 17 passengers in the cabin. The helicopter was also equipped with an auxiliary fuel tank located on the left side of the cabin that occupied the space where seats 3A, 4A and 5A would have been located.

The Cougar Helicopters' S-92A instrument panel consists of five Collins' Multi-Function Displays (MFDs) (see Photo 3). MFDs 1 and 2 are located in front of the first officer's crew position. MFDs 3 and 4 are located in front of the captain's crew position. MFD 5 is located centrally on the instrument panel between MFD 2 and MFD 3. The Cougar Helicopters' standard MFD configuration was to have MFDs 1 and 4 set to Primary Flight Display (PFD) page, MFDs 2 and 3 set to the Engine Instrument and Caution Advisory System (EICAS) page, and MFD 5 was normally configured to the Navigation page (see Photo 3).

1.6.2 Maintenance Record Review

The aircraft was certified and equipped in accordance with existing regulations. The helicopter maintenance records did not disclose any deficiencies before the accident flight (see also Section 1.18.3.9).

1.6.3 S-92A Main Gearbox

1.6.3.1 Description

The S-92A main transmission assembly drives the main rotor head, two transmission oil pumps, two alternating current generators, main and utility hydraulic pumps, and the tail rotor drive shaft system. The transmission assembly consists of a MGB module, two identical input modules, and two identical accessory modules (see Figure 3 and Figure 6).

The MGB incorporates an oil bypass system that allows the pilot to bypass the MGB oil cooler in the event of a leak in the oil cooler or its components (i.e., oil cooler system) (see Figure 7). The MGB oil bypass switch allows the pilot to test the system for proper operation or to electrically activate the bypass valve. When the valve is activated, oil is routed back into the gearbox, bypassing the oil cooler system, and a MGB BYPASS caution message is displayed on the multi-function display (MFD).

The transmission assembly has a self contained oil pressure system. The oil entering the MGB from the pumps is sampled for pressure by an oil pressure sensor, located on the aft left side of the MGB. The oil is also sampled for pressure by a low oil pressure switch, located on the Number 1 accessory module.

During flight, an amber MGB OIL PRES caution message will be displayed on the EICAS page when the MGB indicated oil pressure, which is supplied by the oil pressure sensor, is between 45 and 35 psi, or the low oil pressure switch senses a pressure less than 24 psi (see Figure 4). As described in the S-92A RFM, cautions such as MGB OIL PRES, "initially appear in inverse video and are announced by activation of the master caution light. There is no aural alert for cautions. Once either pilot acknowledges the caution by pushing the master caution light, the affected caution will change to yellow text and the master caution light will go out." When the MGB has indicated oil pressure is less than 35 psi and the low oil pressure switch is activated, the crew will then be alerted by an aural warning, "GEARBOX PRESSURE…GEARBOX PRESSURE", and the amber MGB OIL PRES caution message will be replaced by a red MGB OIL PRES warning message. The appearance of the red MGB OIL PRES will also be announced by the master caution light, which is extinguished by either pilot pressing the master caution light.

A MGB sump chip detector incorporates a wet-bulb type analog temperature sensor which provides oil temperature information to the crew. For this sensor to operate properly it must be submerged in oil. During normal operation, the oil bypass valve directs oil to the cooler assembly to maintain safe operating temperatures. When the bypass valve is activated the oil is redirected back into the MGB, bypassing the cooler and resulting in an oil temperature increase. If the MGB oil is completely lost then the MGB temperature indications will not be reliable since the sensor will be reading the ambient air temperature within the MGB.

The MGB oil filter bowl houses the first and second stage filter elements. During normal operation, the oil passes through the first stage 3-micron filter element then through the second stage, 75-micron filter element. If the 3 micron filter element begins to clog, the filter assembly's impending bypass indication button on the bottom of the filter bowl will pop out, which provides maintenance personnel with a visual warning that the filters are beginning to clog. Cougar Helicopters' practice was for maintenance personnel to check the impending bypass button after each flight.

The MGB oil filter is designed with four equally spaced dimples on the end surfaces of the filter. These dimples are designed to ensure that a fluid pressure path exists under the filter element pressure port.

The oil filter bowl is attached to the MGB housing by three equally spaced titanium alloy stud and self-locking nut assemblies. The manufacturer decides what type of fastener to use, as there is no specific rule that defines the type of fastener to be used for what application. In selecting a fastener, aircraft manufacturers typically use similar product history, published material specifications (i.e. American Society for Testing and Materials), and/or develop their own process specifications.

Titanium is desirable in certain applications due to its corrosion resistance and lighter weight as compared to steel. Sikorsky selected the titanium alloy stud because these had been used successfully on other Sikorsky products, such as the CH-53E Sea Stallion which utilizes six titanium studs to attach the oil filter bowl to the MGB. Also, Sikorsky declared that there was no reported history of in-service titanium stud failures.

Galling is a type of adhesive wear, whereby material is removed or displaced from a surface^{Footnote 3}. The Selection and Use of Titanium, A Design Guide^{Footnote 4}, provides the following information about titanium galling:

The surfaces of titanium and of all commercially produced alloys of titanium have relatively poor wear resistance. In particular, titanium surfaces in contact with each other or with other metals readily gall under conditions of sliding contact or fretting. Even with light loading and little relative movement, complete seizure of surfaces can occur. This situation is caused by adhesive wear in which microscopic asperities on the metal surfaces come into contact as a result of relative sliding and they tend to weld together forming a bond at the junction which can have rupture strength greater than the strength of the underlying metal. Fracture then takes place at one of the asperities causing metal to be transferred from one surface to the other. The debris so formed gives rise to the accelerated wear that occurs with titanium.

The fastening system for the oil filter bowl of the S-92A used anodized^{Footnote 5} titanium alloy studs, silver-plated steel nuts and cadmium-plated steel washers. Anodizing and plating increases resistance to corrosion, wear and galling.

1.6.3.2 Lubrication Basics

The operation of a helicopter MGB is dependent upon the constant supply of the proper quantity and quality of lubricating oil. The oil reduces the friction and wear between adjacent contacting surfaces by forming a lubricant film between them that dissipates heat, thereby preventing components from reaching critical temperature levels. When there is insufficient oil, the lubricant film becomes progressively thinner, reducing heat dissipation and allowing metal-to-metal contact to occur. This can lead to damage such as rubbing, scuffing, scoring, seizing and galling. Typically, as the oil quantity decreases there will be a rise in oil temperature as a result of heat generation.

1.6.3.3 S-92A Main Gearbox Oil and Filter Replacement

The service life of the MGB oil was 500 flight hours. At that time, if an oil sample successfully passed the aircraft maintenance manual's (AMM) acceptance test criteria, then it could remain in service for an additional 500 flight hours. Additionally, if the oil passed the acceptance test, then the MGB oil filters could remain in place for one additional 500 hour time period, to a maximum of 1000 flight hours. This indicates that the oil filters' initial time period for replacement was 500 hours. This is consistent with the scheduled lubrication interval and what Cougar and other S-92A operators were doing. At the time of the occurrence, the S-92A MGB had a 2700-hour replacement interval. This suggests that the oil filter bowl would have been removed a total of five times during the life of the MGB.

If the impending bypass button popped, AMM Chapter 63-24-02 defines criteria to determine whether the filters must be replaced before the next flight or within the next eight flight hours. Cougar Helicopters' practice was to change the MGB oil filters at the 500 hour interval as well as whenever the impending bypass button popped. On the occurrence helicopter, the MGB oil filter had been replaced a total of 11 times. Cougar Helicopters' S-92A fleet, including the accident helicopter, experienced impending bypass conditions ranging from a matter of hours up to hundreds of hours, with the average time being about 220 hours. Consequently, Cougar Helicopters was changing oil filters at about 220 hours instead of the anticipated 500 to 1000 hours, requiring multiple removals of the nuts. This average was consistent with the S-92A worldwide fleet average. No abnormalities were found by either Cougar Helicopters or Sikorsky when examining the MGB oil filters that had been removed due to an impending bypass condition.

Some S-92A operators initially experienced the impending bypass conditions within hours of changing the oil in the MGB but after implementing oil pre-filtering they no longer experienced this. Other operators indicated that even without oil pre-filtering they did not experience the frequent impending bypass conditions. At the time of the accident Cougar Helicopters was not pre-filtering the MGB oil, nor was this required by Sikorsky. Prior to the accident, Sikorsky had commenced working with oil manufacturers to determine what characteristic of new oil, if anything, could be contributing to the impending bypass conditions. At the time this report was written, Sikorsky and the oil manufacturers had not been able to determine the reason for the frequent impending bypass conditions.

1.6.4 Auxiliary Fuel Tank

The accident helicopter was equipped with a 150 US gallon auxiliary fuel tank installed on the left side of the cabin in accordance with a TC approved Supplemental Type Certificate (STC). The STC allowed for the installation of a fuel tank and associated systems either on the left, the right, or both sides of the S-92A cabin.

1.6.5 S-92A Safety Features and Crashworthiness

Federal Aviation Regulation (FAR) 29.561 and 29.562 require that, although the rotorcraft may be damaged in emergency landing conditions on land or water, it must be designed to give each occupant every reasonable chance of escaping serious injury in a crash landing. It must be designed such that each occupant and each item of mass inside the cabin that could injure an occupant is restrained when subjected to the following ultimate inertial load factors relative to the surrounding structure:

1. Upward: 4g^{Footnote 6};
2. Forward: 16g;
3. Sideward: 8g;
4. Downward: 20g, after the intended displacement of the seat device; and
5. Rearward: 1.5g.

The passenger and crew seats installed in the S-92A helicopter met the applicable FAR requirements. The seats were equipped with a stroking mechanism designed to absorb crash impact energy in the vertical direction. This is accomplished by mounting each seat on a pair of vertical rails (see Figure 8). Each seat is prevented from sliding freely down the rails by rollers which pinch against the rails. When the downward force on the seat exceeds a certain threshold, the seat begins to slide down the rails, causing the rollers to deform the rails. The plastic deformation of the rails, caused by the rollers, absorbs the crash energy. To meet certification requirements, the manufacturer designed the seats to limit the vertical load on the occupant's spine to 1500 pounds. During certification testing, a standard weight 170 pound anthropomorphic test device^{Footnote 7} occupant sitting in the normal upright position required a downward inertial load factor of 8.8g to stroke the seat. If the weight on the seat is greater than 170 pounds, the seat will stroke at a lesser g value.

1.6.6 Emergency Flotation System

According to the S-92A RFM, the helicopter's emergency flotation system (EFS) was "designed to keep the helicopter upright and afloat long enough for all crew and passengers to evacuate the aircraft in mid sea state 5 (wave height 8-12 feet with a wind speed of 18-24 knots) sea conditions." The S-92A EFS on CHI91 was certificated for use in World Meteorological Organization (WMO)^{Footnote 8} sea state 4. However, it had been designed, and tested, for Joint North Sea Wave Project (JONSWAP) sea state 4. JONSWAP recognizes a steeper wave profile than the WMO scale, which is more typical of the wind waves encountered in the North Sea.

The S-92A EFS on CHI91 consisted of three dual-cell pop-out float bags. Two forward bags were mounted below the cockpit windows and the aft bag installed on the underside of the tail. Four inflators,^{Footnote 9} two centrally located in the belly and two in the tail, were connected to the bags by a combination of rigid and flexible supply lines. As a safety measure, each of the forward bottles filled one cell of each of the forward bags, and each of the two aft bottles filled one cell of the aft bag. Small explosive charges on the bottles are actuated electrically, either by the pilots or automatically by immersion switches in the main gear wheel wells. Activation allows the pressurized gas to flow to the bags. The EFS is designed to simultaneously activate all of the bags. There is no means by which individual bags can be independently inflated.

The S-92A EFS is designed to be armed when flying over water and the airspeed is below 80 knots. However, the pilot must first ditch the helicopter before activating the EFS, as "the floats are not designed to absorb the force of water impact and must only be deployed after water entry."^{Footnote 10} While intentional in-flight deployment of the float bags is prohibited, the helicopter can continue to operate in the case of inadvertent in-flight flotation deployment. If an inadvertent in-flight flotation deployment occurs, the helicopter rate of climb must be restricted to 1000 fpm or less and the angle of bank is restricted to 30° or less. In addition, the maximum indicated airspeed with the floats deployed is restricted to 50 knots indicated airspeed (KIAS) in the climb, 55 KIAS in level flight, and 60 KIAS during descent/autorotation.

The S-92A has a five float bag EFS option which is designed for, and has been demonstrated in sea state 6 JONSWAP conditions. At the time of the accident, 38 helicopters of the worldwide S-92A fleet in-service had been equipped with the five-bag EFS option. The vast majority of the five-bag EFS systems were installed in helicopters operated in the North Sea.

1.6.7 Emergency Locator Transmitters

The accident helicopter was equipped with two 406 MHz^{Footnote 11} Emergency Locator Transmitters (ELTs). One of the ELTs was a Honeywell RESCU 406 Survival ELT (part number 1151324-1M316, serial number 1151324-41074) located in the forward cabin. This ELT was removable, waterproof, and intended to be taken by the occupants as they escape the helicopter. It had an internally mounted antenna and was designed to be activated either by fresh or salt water or by selection of a switch to the on position. The other ELT was an Artex C406-N HM ELT (part number 453-5061, serial number 02033) attached to the fuselage on the right side of the helicopter in the rear cargo section. The fixed ELT is activated automatically by impact forces or manually via a remote activation switch located in the cockpit. Neither ELT was recovered, nor were there any reports of a 406 MHz signal being received. The remote activation switch for the fixed ELT was found in the armed position.

Both 406 ELTs on the occurrence helicopter were designed to transmit a 406 MHz signal for 440 to 520 milliseconds, repeating every 47.5 to 52.5 seconds. By regulation, however, the first transmission after activation is deliberately delayed for 50 seconds in order to prevent false alarms that can occur during routine ELT maintenance activities. While the delay helps to ensure that the signal received by the COSPAS-SARSAT satellite system is a legitimate distress signal, this delay may prevent the broadcast of an actual distress signal in a ditching scenario. Due to the severity of the impact it is likely that the helicopter sank before a 406 MHz signal could be transmitted.

The helicopter was not equipped with an automatically deployable ELT, nor was it required by regulation. Sikorsky began offering two deployable ELTs as options in early 2005 for the S-92A: the DRS Technologies Deployable Emergency Beacon (DEB) ELB 3000 and the H.R. Smith Crash Position Indicator Model CPI-503 DEB. Both of these deployable ELTs are certified for use in Canada. Presently Sikorsky only offers the CPI-503 deployable ELT option.

European operation rules require that an automatically deployable ELT be installed in accordance with JAR-OPS 3.820, Automatic Emergency Locator Transmitter (ADELT), which states:

An operator shall not operate a helicopter in Performance Class 1 or 2 on a flight over water in a hostile environment as defined in JAR-OPS 3.480(a)(12)(ii)(A) at a distance from land corresponding to more than 10 minutes flying time at normal cruising speed, on a flight in support of or in connection with the offshore exploitation of mineral resources (including gas), unless it is equipped with an Automatically Deployable Emergency Locator Transmitter.

The CAA has received several reports where ADELTs did not deploy during an accident and instances where they have deployed inadvertently. These instances of deficient ADELT operation are being investigated by the UK CAA to determine what remedial action needs to be taken.

1.7 Meteorological Information

1.7.1 Emergency Locator Transmitters

Actual Weather Reports CYYT

The actual weather conditions reported at CYYT prior to and after CHI91 departed at 0917 were as follows:

At 0830: surface wind 190° True (T) at 13 knots, gusting to 19 knots, visibility 15 statute miles (sm), overcast clouds at 1100 feet above ground level (agl), temperature −1°C, dew point −6°C, altimeter setting 29.98 inches of mercury (in Hg). Remarks: 8/8 altocumulus. Sea level pressure 1016.0 hectopascals.

At 0930: surface wind 190° T at 14 knots, gusting to 20 knots, visibility 15 sm, few clouds at 1100 feet agl, with an overcast layer at 8000 feet agl, temperature −1°C, dew point −5°C, altimeter setting 29.93 in Hg. Remarks: 2/8 stratocumulus, and 6/8 altocumulus. Sea level pressure 1014.2 hectopascals.

1.7.2 Actual Marine Weather

Several buoys permanently stationed in the general area of the impact recorded the sea water temperature between 0.1°C and 0.3°C, and surface wind generally from the south-southwest at about 22 knots. Wave Analysis charts prepared by the Halifax division of the Meteorological Service of Canada (MSC)^{Footnote 12} indicated that the wave height in the area of the occurrence was in the order of 2.5 metres, with a wind wave direction generally from the south-southwest.

On the day of the occurrence, the sea conditions at Nickerson Bank, 64 nm southwest of St. John's, were recorded as follows: wind 180° T at 29 knots, gusting to 35 knots, air temperature 2°C and sea temperature 0°C, sea level pressure 29.72 in Hg and falling rapidly; and a wave height of about 2.5 metres over a dominant wave period of 7 seconds. The wind chill factor was calculated as −6°C.

1.7.3 In-Flight Weather Conditions

CHI91 departed IFR from CYYT in VMC. Similarly, the reported weather was VMC at the destination oil rigs and along the intended route of flight.

CHI91 likely encountered at least one layer of broken cloud while climbing to its cruising altitude outbound from CYYT. Once CHI91 turned around and proceeded westward toward CYYT, descending from 9000 feet asl, the helicopter was clear of cloud with good flight visibility in daylight conditions.

There is no indication that the meteorological conditions contributed to this accident.

1.8 Aids to Navigation

All navigation aids in the St. John's area and those provided by the offshore oil facilities were recorded as serviceable with the exception of the Outer Cove non-directional beacon (NDB) which had been taken out of service until 07 May 2009. CHI91's onboard navigation systems used a combination of conventional navigation aids and global positioning system (GPS) satellites. A review of the flight recorder data did not identify any navigation system anomalies. Examination of the flight path of CHI91 indicated that the helicopter was tracking accurately along the intended flight path, in a manner consistent with normal operation. The function and accuracy of navigational aids is not considered a factor in this accident.

1.9 Communications

1.9.1 Communications with Gander ACC

All recorded communications between CHI91 and the Gander ACC were of good technical quality; that is, all of the recording equipment functioned normally and the sound quality was good. ATC communications with the occurrence helicopter totalled approximately 2 minutes and 7 seconds after the MGB oil pressure warning. They included a mayday call, navigation information, runway preference, and other information such as people on board and fuel remaining. There was no indication that any of the communications made by ATC were misunderstood or missed by CHI91.

When the pilot issued the mayday call at 0945:27, the controller at Gander ACC treated the situation as an emergency, responding in accordance with NAV CANADA standards and practices. At 0951, Gander ACC opened a dedicated controller position to respond solely to CHI91's emergency situation. After the helicopter ditched at 0956, this dedicated position continued to coordinate the SAR operations among seven aircraft, issuing ongoing updates and information to each aircraft. These communications were clear, timely, and unambiguous.

1.9.2 Communications with the Cougar Dispatch Centre

The radio communications between CHI91 and the Cougar dispatch centre were also clear and normal, lasting for a total time of approximately 2 minutes and 9 seconds (see Figure 9). These communications included a mayday call, a description of the emergency at hand, information about the continuation of the flight and flight preparation of a second S-92A.

1.9.3 Internal versus External Communications

From the moment the red MGB OIL PRES warning message light illuminated, until the power interruption to the flight recorder just prior to ditching, 10 minutes and 7 seconds elapsed. During this time the captain was in communication with Gander ACC and the Cougar dispatch centre for roughly 4 minutes and 16 seconds, leaving 5 minutes and 51 seconds for internal communications between crew members (see Figure 9).

1.10 Aerodrome Information

1.10.1 General

There were no operational issues with the departure airport, destination helideck facilities, or alternate landing site that were deficient or could have potentially had an adverse effect on the flight of CHI91. The elevation of the airport at St. John's field is 461 feet asl, and the highest terrain between the airport and the location CHI91 impacted the water was about 500 feet asl.

1.10.2 Cape Spear Landfall

In his communications, the captain indicated that they would possibly land at Cape Spear, a point of land about 8 nm southeast of CYYT, and approximately 4.5 nm south of the direct return flight path to St. John's International Airport (see Figure 1).

Cape Spear is designated by Parks Canada as a National Historic Site of Canada and is a well-known landmark in the St. John's area, featuring the historical Cape Spear lighthouse. Adjacent to the lighthouse is a large and open vehicle parking area, with asphalt surface in good condition, and no significant obstructions. The elevation of the parking lot is approximately 150 feet asl. It is well-suited to accommodate a helicopter such as the S-92A, and would have provided a suitable emergency landing site.

1.11 Flight Recorder

1.11.1 General

CHI91 was equipped with a Penny & Giles multipurpose flight recorder (MPFR) (part number D51615-102, serial number 00170-002), which records both flight data recorder (FDR) data and cockpit voice recorder (CVR) audio, in crash-protected solid-state memory (see Photo 4). The installed MPFR (position #1 FDR/CVR) was powered from the 28V direct current (DC) battery bus. CHI91 was not equipped with the optional second MPFR (position #2 FDR/CVR), nor was it required to be so by regulation.

1.11.2 Multipurpose Flight Recorder Power Interruption

The MPFR stopped recording about 44 seconds before impact and then began recording again about 1.7 seconds before the impact. TSB's examination of the MPFR and the components which supply it with data, as well as the associated wiring, determined that there was no indication of a pre-existing condition that would have prevented normal operation.

By design, electrical power (power) to the MPFR is routed through a dedicated relay. As long as this relay is not energized, power will be supplied to the MPFR. Once energized, by either the omni-directional inertia switch (g-switch) or the water immersion switches, the power to the MPFR will be cut. When the reset switch is selected the relay will be de-energized and power will be restored to the MPFR.

The S-92A is equipped with numerous accelerometers that provide data to the MPFR and the helicopter health and usage monitoring system (HUMS). The g-switch is designed to close when subjected to a 5g, 4 millisecond pulse but will close much quicker when subjected to higher g pulses.

Before the MPFR stopped recording, the data showed that electrical power was being supplied by the primary Alternating Current (AC) generators, and the HUMS data shows that the auxiliary power unit (APU) was on line. Just prior to the MPFR powering back up, the HUMS data showed the main rotor rpm (Nr) dropping to approximately 80% Nr. Data showed that after the MPFR started recording again, electrical power was being supplied by the APU generator.

Under normal conditions, electrical power is supplied by the two primary AC generators, each driven by one of the engines. The helicopter also has an APU and generator that supplies power while on the ground and during in-flight emergencies. Both primary AC generators will go off line when Nr drops below 80%. If Nr drops below 80% while the APU generator is on line, then the APU generator will provide electrical power. Switching over from the primary AC generators to the APU generator is not instantaneous and therefore it is possible that when doing so there is a momentary power interruption. This would de-energize the dedicated relay and restore power to the MPFR.

In accordance with Canadian Aviation Regulations (CARs) 529.1457 (d)(2) and 529.1459(a)(5), flight recorders installed on transport category rotorcraft must include an automatic means to stop flight recorders within 10 minutes after crash impact. In order to ensure reliable operation, the means to automatically stop the recorder should rely on more than one device. Some examples of automatic means to stop flight recorders include the detection of loss of pressure on all engines together with loss of airspeed, airframe crash sensors, and water immersion switches. The S-92A uses the 5g switch as a power interrupt circuit to meet this requirement. Generally, g switches are not considered a reliable means of stopping recorders and subsequent to the certification of the S-92A the issue was addressed in two documents. The European Organization for Civil Aviation Equipment (EUROCAE) document ED112, Minimum Operational Performance Specification for Crash Protected Airborne Recorder Systems issued in March 2003 states that negative acceleration sensors (g-switches) shall not be used because their response is not considered to be reliable. In addition, the UK Air Accidents Investigation Branch (AAIB) issued Safety Recommendation 2008-074 which states:

It is recommended that the Federal Aviation Administration and the European Aviation Safety Agency review the certification requirements for automatically stopping flight recorders within 10 minutes after a crash impact, with a view to including a specific reference prohibiting the use of ‘g' switches as a means of compliance as recommended in ED112 issued by EUROCAE Working Group 50.

Current Canadian regulations do not reflect this philosophy. The problem related to g-switches is not unique to helicopters. A recent TSB investigation (A07A0134) into a landing accident found that the g-switch had prematurely removed power from the CVR on initial impact with the ground. Subsequent conversations and cockpit sounds during the runway excursion and aircraft evacuation that followed were not recorded.

At the time of the S-92A's certification, the installation of one combined CVR/FDR (e.g., MPFR) met the applicable certification requirements. Although the S-92A is designed to accommodate two MPFRs, even if both had been installed, the helicopter was designed such that the power interruption would also have affected the second MPFR.

The lack of FDR and CVR information during the latter part of the accident flight hampered the investigation team's ability to obtain an accurate understanding of the final seconds of the event and could have prevented the timely identification of safety significant issues. The lack of FDR information also eliminated the opportunity for engineers to obtain actual tail rotor failure and autorotation data to validate the engineering models used in S-92A simulators in order to make this training more realistic.

1.11.3 HUMS Data

The investigation team was able to recover the two flight control computers (FCC), two electronic engine controls (EEC), the data concentrator, the HUMS, the enhanced ground proximity warning system (EGPWS), and the maintenance data computer. Data successfully recovered from non-volatile memory was used to reconstruct some of the flight profile during the final stages of flight, enhancing the investigation team's ability to understand and analyze the final moments before impact.

The TSB Engineering Laboratory examined the recorded data. At 90 feet asl, the HUMS recorded a descent rate of 2300 feet per minute and increasing, with a 16 degrees nose up and 9 degrees left bank attitude. The low speed of the main rotor would have made it impossible to arrest the rate of descent of the helicopter any further. Allowing for air resistance, the actual rate of descent at impact would have been somewhat less than 5100 feet per minute but much higher than 2300 feet per minute.

1.12 Wreckage and Impact Information

1.12.1 Preliminary Wreckage Examination

On 19 March 2009, the wreckage was recovered and transported to CYYT Airport. The wreckage was then removed from the transportation container (cage), partially dismantled, and laid out for examination and documentation. Almost immediately it was found that two of the three oil filter bowl mounting studs had fractured and the oil filter bowl had lifted from the MGB housing on the outboard side. The lower forward fractured stud had separated near the top surface of the filter bowl mount flange and its nut was not recovered. The lower aft stud was fractured further down inside the filter bowl attachment lug and the nut was still attached to the fractured portion of the stud. The upper stud and nut were intact.

During the next 7 days, the preliminary examination of the wreckage continued. Components requiring further examination by the TSB were shipped to the TSB Engineering Laboratory in Ottawa. Almost immediately, to minimize the effects of salt water corrosion, the MGB was removed, packed, sealed and shipped to Sikorsky's main plant in Connecticut. At the Sikorsky plant, the MGB was disassembled, examined, and documented by representatives from Sikorsky under the supervision of two TSB investigators. Also in attendance were observers from Cougar Helicopters, the Federal Aviation Administration (FAA), and the National Transportation Safety Board (NTSB). Critical components of the MGB were then forwarded to the TSB Engineering Laboratory for detailed metallurgical examination.

1.12.2 Impact Damage Signature and Impact Geometry

The helicopter impacted the water with a high downward velocity. The extensive break-up of the passenger cabin and floor, and the comparatively intact roof above was consistent with the helicopter having been upright at impact. Due to the sea state conditions (about 2.5 metres significant wave height) it was not possible to establish an exact helicopter attitude at the time of impact (see Photo 5). However, damage to the airframe indicated that both the cockpit and the tail pylon broke in a downward direction.

The relative integrity of the main rotor blades is consistent with a low blade energy state at the time of water impact. The tail rotor blades showed no sign of rotation at impact.

1.12.3 CHI91 MGB Examination

The helicopter's MGB operated for approximately 11 minutes after the total loss of lubricating oil pressure. Examination of the MGB components showed damage due to frictional heating caused by the continued operation without oil. This frictional heating led to the plastic collapse of the tail take-off pinion's teeth, eventually causing the loss of drive to the tail rotor shafts (see Photo 6, damaged pinion compared to exemplar). There was no indication of component seizure that would have prevented the main rotor from free-turning at the time of impact. The tail take-off pinion shaft is held in position in the radial and axial directions by two tapered roller bearings and these bearings had damage consistent with operation under inadequate lubrication. Their failure would have caused a loss of radial and axial constraint of the rotor brake disc. The disc-type rotor brake system is designed to stop the rotors with both engines off when Nr is at 40% (decreasing) within 30 seconds of application.

Approximately 1.5 seconds before the MPFR stopped recording, there was a 1 to 2 seconds "ROTOR BRAKE ON" indication. Although there was no indication of abnormal contact between the rotor brake disc and brake pads, the activation of any of the switches in the brake callipers could have been caused by an impact or impacts between the rotor brake disc and the brake wear liners caused by the deterioration of the tail take-off pinion and bearings.

The TSB's examination of the MGB components and oil bypass system determined that there was no indication of a pre-existing condition which would have prevented their normal operation.

1.12.4 CHI91 MGB Filter Bowl Assembly Examination

The two oil filter bowl mounting studs had fractured by overstress extension of fatigue cracks. Fretting and rub patterns observed on the filter housing and packing indicated that the fatigue cracking developed in the forward stud, causing it to fail, which increased the load on the aft stud leading to its failure (see Photo 7).

1.12.5 MGB Filter Bowl Assembly Stud/Nut Testing

TSB was able to examine the top stud which remained in CHI91's MGB housing (see Photo 8) and conduct testing on a sampling of new stud and nut assemblies, which were provided by Sikorsky, to quantify the nut and stud damage and the effect on preload associated with a certain number of assembly cycles. Examination of a new stud and nut showed that galling damage developed after the first installation and that the damage became progressively more severe with repeated installation/removal cycles (see Photo 9). Testing of the occurrence and exemplar studs and nuts showed that after 13 to 17 assembly cycles, the nut self-locking feature was significantly damaged and fragments were separating from the crests of the threads.

1.12.6 Auxiliary Fuel Tank

The auxiliary fuel tank remained attached to a portion of the fuselage floor structure and was recovered with the main fuselage. The fibreglass cap that covers the hose and electrical connections on the top of the tank was damaged. The tank's carbon fibre case had localized damage in the same area where the cap was damaged. The remainder of the tank structure and its hold-down attachments were intact. Some of the hoses, wiring and electrical connectors were damaged and no longer connected to the airframe. The fuel tank's internal rubber bladder appeared to be intact and showed no signs of damage. There was a small amount of residual fuel and sea water found in the bladder; however it had not been filled for the occurrence flight.

1.12.7 Emergency Flotation System Examination

The EFS switch was in the armed position and several EFS components had been damaged due to the force of the impact. The electrical wiring and gas supply lines had fractured in several locations. The protective covers on the flexible supply lines had localized bending and tearing, and the rigid supply lines had multiple fractures, bends, and localized crushing. The immersion switches in the wheel wells were disabled when the sponsons were torn away by the impact.

The right float had come free of its protective cover; however, it remained attached to the airframe. It had multiple tears and punctures likely due to the impact and the subsequent recovery or movement of the wreckage. The left float remained in its protective cover. It was subsequently inflated by the TSB and both cells held pressure. The two inflators for the forward floats were found undamaged and fully charged. The aft float and associated inflators were not recovered.

The helicopter was equipped with two life rafts, one stowed in the forward portion of each sponson. Both life rafts were recovered fully inflated and floating near the impact site. The rafts likely inflated when the lanyards, attached to the rafts and used to manually inflate them, were pulled as the storage compartment's cover separated from the sponsons at the time of the impact.

1.12.8 Seats and Safety Harness Examination

The seats had some structural damage including twisted seat backs and deformed headrests. An analysis of the deformation to the shock-absorbing mechanism in the passenger seats revealed that the occupants were subjected to inertia vertical load factors between at least 5.3g and 8.6g. However, the stroking mechanism of four passenger seats bottomed out due to the weight of the individuals, meaning that the inertial load factor felt by these occupants likely exceeded 8.6g. All the seat safety harness systems were examined and determined to be functional post-impact.

1.13 Medical Information

1.13.1 General

During the initial recovery phase, Royal Canadian Mounted Police (RCMP) officers took custody of the deceased on behalf of the Medical Examiner (ME) as they were brought onboard the Atlantic Osprey, the recovery vessel. They were recovered from the wreckage, still secured by their safety harness in their seats. Bar codes on each immersion suit, which had been recorded when issued, made it possible to confirm the seat location of each passenger. Upon arrival at the port of St. John's, the deceased were transported to the ME's facility for examination.

The ME noted that each individual had properly donned their immersion suits (i.e., zipped up with hoods on) indicating that they were prepared to ditch. The survivor testified at the Offshore Helicopter Safety Inquiry^{Footnote 13} (OHSI) that he recalled the crew advised the passengers they were ditching and then eventually told the passengers to brace themselves just prior to impact. The passengers had not donned their gloves. They had been taught that donning their gloves could interfere with their ability to release their safety harnesses and egress from the helicopter. The survivor testified that by the time he reached the water surface, the cold water had caused him to lose all feeling in his hands and he was therefore unable to don his gloves or raise his spray hood.

No unexpected damage to the passenger transportation suit systems (PTSS) was noted by the medical examiner. Most passengers were wearing long-sleeved shirts, jeans, briefs, and wool socks under their suits.

The immersion suits worn by the pilots and the occupant found deceased on the surface were retained for examination by the TSB and no deficiencies in these suits were noted. The immersion suit worn by the survivor was cut up by emergency medical personnel during his recovery, transport to hospital, and initial treatment; it was destroyed.

1.13.2 Flight Crew

The flight crew had more severe injuries than any of the other occupants. This was primarily due to head and chest injuries they suffered as a result of making contact with the helicopter's instrument panel when the cockpit was crushed during impact. Neither pilot was wearing a helmet nor were they required to by regulation. A detailed discussion on helmet use can be found in Section 1.15.14. During the impact sequence, the cockpit was severely compromised. The cockpit structure was compressed, reducing the interior space, and then rebounded back which almost caused it to separate from the rest of the fuselage. The investigation determined that there were no indications that the crew's performance was degraded by physiological factors.

1.13.3 Passengers

The Occupant Injury Chart (see Figure 10) indicates the general injuries to the occupants of CHI91. The absence of head injuries or injuries to upper limbs is noteworthy considering that the cabin roof and upper deck, with engines and transmission attached, compressed enough to split the fuselage along the window line and to bend some of the headrests downward. The absence of flailing injuries^{Footnote 14} would indicate that the passengers had assumed the brace position as taught, and that it was effective in preventing upper body injuries.

The most significant passenger injuries were lower limb fractures. Fractures to the long bones of the lower limbs typically require more force than the 5.3g to 8.6g indicated by the seat stroking mechanism so it is likely they were due to the downward force combined with the significant upward movement of the cabin floor. All the occupants that remained in the wreckage died of drowning.

The individual (seat 1A), who was found deceased on the water surface, suffered a compound fracture of the leg, which is consistent with the general injury pattern of the other occupants. Although it is possible that she released her seat belt prior to impact, the lack of upper body injury and the consistent lower limb injury pattern would suggest that she was likely restrained by her safety harness in her seat during the impact.

The sole survivor of CHI91 occupied seat 3D. Following the impact, he managed to exit the sinking fuselage and successfully reach the surface. However, he aspirated a considerable volume of seawater and experienced shock as a result of several injuries, particularly a fractured sternum. The life preserver integrated into his passenger transportation suit system (PTSS) was inflated and, in combination with the PTSS's inherent buoyancy, kept him on the surface of the water.

The survivor was wearing a large sized PTSS. A subsequent review of sizing guidelines determined that the survivor should have been wearing a medium sized suit. Although the survivor's PTSS was properly donned and inflated, the interior of the PTSS was wet and his body temperature had dropped considerably. Normal human body temperature is 37°C. Transport Canada document TP13822E entitled Survival in Cold Waters: Staying Alive,^{Footnote 15} states the following: "If the deep body temperature continues to fall, death occurs on average from cardiac arrest somewhere below a body core temperature of 24° C''. The survivor's body temperature had decreased to 29.8°C and he had an irregular heart rate. This decrease in body temperature occurred after being exposed to water that was between 0.1°C and 0.3°C for about 1 hour and 20 minutes, which equates to a decrease of approximately 0.09°C per minute.

1.14 Fire

There was no pre-crash or post-crash fire.

1.15 Survival Aspects

1.15.1 General

Many of the references, supporting research and descriptions used in the following section apply to helicopter ditching events with relatively gentle to moderate impact forces, whereas the crash of CHI91 had significant impact forces beyond those normally considered for a survivable ditching. Nevertheless, all 18 occupants of CHI91 survived the impact; but only one survived the accident.

CHI91 impacted with the water with an estimated force in the magnitude of 20g to 25g. Much of the impact force was absorbed by the fuselage, the attenuating seats, and four-point harness system. The g-force experienced by each individual differed depending on the force applied to the fuselage in the area where they were seated. Except for the four passenger seats that bottomed out, the occupants were generally subjected to inertia load factors between at least 5.3g and 8.6gin the direction of the vertical seat axis. In addition, the helicopter struck the surface with a forward velocity of approximately 55 to 60 knots which would have introduced a horizontal force on the occupants of approximately 5g to 8g.

Research has shown that typically only 10% to 15% of people involved in helicopter accidents with water are able to carry out the required escape actions effectively. ^{Footnote 16} A similar percentage of people typically fail to act due to the extreme stress, greatly reducing their chance of survival.^{Footnote 17} The remaining 75% may be stunned or bewildered by the event; however, most will be able to escape successfully if they are well trained and rehearsed for such an event.^{Footnote 18}

In order to survive an impact with the water similar to that of CHI91, a number of pre-impact conditions would have to be in place. In addition, survival would hinge on an individual's ability to make several sequentially-critical, split-second decisions and then execute the correct physical response. The key pre-impact conditions include recent high fidelity underwater escape training, good swimming ability, previous cold water acclimatization, agility, physical and mental fitness, a high pain threshold, no impairment whatsoever, and a strong survival instinct. At the OHSI, the survivor of CHI91 identified his age, fitness, good health, mental preparation, instincts, previous cold water experience, concentration on escaping, and luck as factors that made a difference in his survival.

Helly Hansen, the manufacturer of the Nautilus E-452 Survival Suit worn by the passengers, determined that suit leakage alone could not account for the 7.2°C loss of body temperature experienced by the survivor. Using its Cold Exposure Survival Model (CESM), Helly Hansen determined that a person wearing the suit in 0°C water, assuming 654 grams of leakage, should be able to survive for 12.9 hours with an associated decrease in body temperature to 28°C. CESM showed that even with a completely flooded suit survival time was expected to be approximately 4 hours.

Helly Hansen determined that after being in 0.2°C water for 1 hour and 20 minutes, the body temperature of a survivor, wearing a PTSS that is completely flooded with water would have been at 35.4°C, provided the person's shiver response was normal. However, following trauma and/or body temperature loss of about 5°C^{Footnote 19}, the body's shiver response can become abnormal resulting in higher rates of body temperature loss. The CESM model assumes calm water but wind and waves can decrease survival times,^{Footnote 20}, ^{Footnote 21} and increase heat flow out of the body by as much as 37%.^{Footnote 22}, ^{Footnote 23}

Research has shown that the median breath-holding time of 228 offshore oil workers immersed in 25°C water was 37 seconds.^{Footnote 24} Researchers concluded that inability to breath-hold was responsible for the 15% to 50% death rate in helicopter accidents into water. As the temperature of the water decreases, so does the average breath-holding time. In near freezing water, breath-holding time drops dramatically to about 5 to 10 seconds.^{Footnote 25}

The crew and passengers of CHI91 were immediately exposed to cold shock as the helicopter sank in the 0.2°C North Atlantic water. Cold shock is the primary cause of crew and passenger drowning in helicopters that ditch in cold water.^{Footnote 26},^{Footnote 27} Even with the protection of an immersion suit, the sudden exposure of the face to the cold water causes an inspiratory gasp (i.e., gasp reflex), hyperventilation, and involuntary water intake. In conjunction with this, the heart rate increases to dangerously high levels and may cause cardiac arrest or arrhythmia.^{Footnote 28},^{Footnote 29}

1.15.2 Basic Survival Training Standards

The Atlantic Canada Offshore Petroleum Training and Qualifications Committee (TQC) developed the Standard Practice for the Training and Qualifications of Personnel (2008-1038) for the offshore petroleum industry in Atlantic Canada. It was last revised in April 2008. The TQC reviews the standard annually and a new revision is proposed for release in 2010. The committee is a collaborative effort between the Canadian Association of Petroleum Producers (CAPP), the Canadian Association of Oil Well Drilling Contractors (CAODC), Canada-Nova Scotia Offshore Petroleum Board (C-NSOPB) and the Canada-Newfoundland and Labrador Offshore Petroleum Board (C-NLOPB), Marine Institute of Newfoundland and Labrador (MI) and Survival Systems Training Limited (SSTL) of Nova Scotia. The CAPP^{Footnote 30} is the organization that publishes the standard and acts as secretariat for the TQC.

Section 3 of the standard (Mandatory Safety Training for All Petroleum Installations) contains required personal safety training programs, including Basic Survival Training (BST) and Recurrent Basic Survival Training (BST(R)). All personnel working on a petroleum installation receive a BST certificate after successfully completing an initial 5-day course which is renewed by completing a two-day (BST(R)) refresher course once every 3 years. BST training covers all aspects of offshore worker survival including abandonment from offshore facilities, firefighting, and search and rescue. Helicopter underwater escape training (HUET) is a single, but major, element of BST training.

At the time of the occurrence, the standard recognized BST certificates issued by two Canadian training institutes and also certificates from two European agencies (provided that trainees had obtained supplemental training). They are as follows:

1. The Marine Institute (St. John's, Newfoundland and Labrador);
2. Survival Systems Training Ltd. (Dartmouth, Nova Scotia);
3. The Norwegian Oil Industry Association (OLF) (Stavanger, Norway); and
4. The Offshore Petroleum Industry Training Organization - The Oil and Gas Academy (Aberdeen, United Kingdom).

The Canadian standard for BST and BST(R), consisting of 2.5 pages, identifies 16 course content items for the 5-day BST and 6 items for the 2-day BST(R). HUET exercises are identified as being required for BST and BST(R); however, no additional details, such as the number and duration of exercises, HUET equipment standards, environmental conditions, instructor competency,or assessment of participants are provided.

The Norwegian Oil Industry Association (OLF) is a professional body and employer's association for oil and supplier companies operating on the Norwegian Continental Shelf. OLF BST training guidelines consist of two pages describing course objectives, target groups, prior knowledge requirements, course duration and content, and includes miscellaneous items from the GSK - Basic Safety and Emergency Course. It does not indicate that HUET equipment must be representative of the operational environment.

The Offshore Petroleum Industry Training Organization (OPITO) is an employer and trade union led oil and gas industry organization in the United Kingdom. The OPITO approved standard for Basic Offshore Safety Induction and Emergency Training consists of 16 pages describing target groups, delegate's prior achievement requirements, learning outcomes, the training program, duration of the training, and assessments. Similar to the OLF, the OPITO standard does not indicate that HUET equipment must be representative of the operational environment.

Other training standards specifically for HUET training have been proposed by different organizations. For example, the Human Factors Group at Cranfield University developed a draft HUET standard for offshore workers as part of a larger study.^{Footnote 31} This draft standard indicates a requirement for both the use of participant clothing and HUET equipment that is representative of the operational environment.

1.15.3 BST Program Quality Review

In 2008, the training programs of both the Marine Institute and Survival Systems Training Ltd. underwent independent quality reviews at the request of the TQC.

The Marine Institute's review indicated that its BST and BST(R) training programs met the requirements of the standard. As part of the continuous quality improvement process, the review highlighted ten issues (beyond the requirements of the standard) as opportunities for improvement including the observation that its HUET equipment was not representative of the helicopters used offshore.

The Marine Institute's 40 hours (approximately) of initial BST included five exercises in the helicopter underwater escape trainer (trainer) while the BST(R) included a minimum of three exercises in the trainer.^{Footnote 32} Individuals that are unsuccessful in an exercise are given additional training. During these exercises, the trainer's descent rate into the pool remains stable at 0.57 metres per second average velocity, generating negligible deceleration forces at water impact. The Marine Institute's HUET consists of the following exercises:

1. A surface evacuation is conducted with two students. The trainer is submerged upright with water ingression to chair height.
2. A window egress below the surface is performed. Students are seated at a window; the student jettisons the window while the trainer is on the water surface. The trainer is then submerged upright, leaving a small air pocket at ceiling of the trainer. The student egresses through the window.
3. A window egress with the trainer inverted 180 degrees is performed. Students are seated at a window; the student jettisons the window while on the surface. The trainer rolls 180 degrees and submerges below the surface. The student egresses through the window.
4. Exercise 3 is repeated.
5. A group of 12 students perform a controlled surface egress with a life raft.

The BST(R) program at the Marine Institute repeats exercises 1, 3 and 5 in the helicopter underwater escape trainer.

The Marine Institute's helicopter underwater escape trainer (see Photo 10) was designed to simulate a wide variety of helicopters and does not expressly represent the S-92A. It has short-backed seats with legs that are not representative of the S-92A's attenuating seats. It does not use four-point restraint harnesses like the S-92A; instead it is fitted with a lap belt. The trainer has three different sized windows with rubber strip seals that must be pulled out to remove the plexiglass windows and egress. None of the windows operate like those on the S-92A.

The quality review of the Survival Systems Training Ltd. program indicated that the BST and BST(R) programs met the requirements of the standard with one exception; smoke hoods were discussed and demonstrated but there was no actual student practice. Similar to the results of the Marine Institute's training, the Survival Systems Training Ltd. review highlighted a number of issues (beyond the requirements of the standard) as opportunities to improve BST. Representative HUET equipment was not highlighted as such an opportunity.

Survival Systems Training Ltd.'s 35 hours (approximately) of BST also includes five exercises in the helicopter underwater escape trainer.^{Footnote 33} During these exercises, descent rates range from an average velocity of 0.04 metres per second to 0.46 metres per second.

The outline of Survival Systems Training Ltd.'s HUET portion of the initial BST program is as follows:

1. A surface evacuation is conducted with the trainer upright and partially submerged.
2. A window egress with the trainer inverted 180 degrees is performed. Students are seated at a window; the student jettisons the window while the trainer is on the water surface. The trainer rolls 180 degrees and the student egresses through the window.
3. A window egress with the trainer inverted 180 degrees and below the surface is completed. Students are seated in the same seat used in exercise two, the HUET rolls 180 degrees while submerged, and the student jettisons the window and egresses.
4. Exercise 3 is repeated from an aisle seat.
5. Exercise 3 is repeated from the opposite side to provide practice jettisoning a window with the opposite arm.

Survival Systems Training Ltd.'s BST(R) repeats all five initial HUET exercises.

Survival Systems Training Ltd.'s helicopter underwater escape trainer (see Photo 11) was designed to simulate the S-92A. It has high-backed seats that can be adjusted to simulate a stroked seat, four-point restraint harnesses, and windows that are similar in size and operation to those of the S-92A. The stroked seat positions allow the students to practice egressing from the various stroking configurations that may be encountered during a ditching. Egress difficulty levels associated with the various stroking configurations can vary for students of different heights, flexibility, and arm length.

1.15.4 Frequency and Fidelity of BST Training

In 1998, Mills and Muir evaluated training frequency; the object was to make recommendations to the United Kingdom (UK) offshore oil industry on how often refresher training should be scheduled.^{Footnote 34} They reported that in as little as six months, decay of knowledge and performance can occur to the point where participants fail to perform all of the relevant actions in the correct order, often operating their seatbelt before removing their window exit, an action which can prove fatal in a real emergency. Furthermore, they asserted that the difficulties experienced after only six months may be attributable to poor HUET fidelity. They also noted that those who volunteered for their study were people who were naturally comfortable in the water, and therefore not a true representation of the population. In all likelihood, a test involving a true representation of offshore workers would have resulted in a higher failure rate.

The Industrial Foundation for Accident Prevention (IFAP) in Australia conducts the majority of HUET for the offshore oil industry in Australia. IFAP has determined that skills acquired during training are subject to significant decay within 6 to 12 months of initial training.^{Footnote 35} One study demonstrated that the best performance in an underwater escape using a HUET simulator was achieved by trainees who had received four practice sessions in one training period using a pop-out window six months previously.^{Footnote 36} The trainees who received fewer practice sessions and who were not required to pop the windows out during HUET did not perform as well at the follow-up when they were required to pop out windows in order to escape. The IFAP also recommended that students should be over-trained to combat the serious hazards of a ditching. They concluded that:

Studies of procedural skills and the performance of safety functions generally show that the most significant degree of [dunker] skill decay occurs within 6-12 months of initial training. Evidence indicates that the current statutory two year period for helicopter underwater escape training without proper interim refresher training is too long.

The survivor of the CHI91 accident had completed his most recent BST training just two months before the accident. Two other occupants who had lower limb fractures had completed their BST within the past 3 months. The other occupant who escaped the wreckage had completed the BST course a year previously. Of the eight occupants who had minor or insignificant injuries, two had had the BST course 1 year earlier; two had taken their BST course a year and a half earlier; one had taken the course almost 2 years before and the last three had received their last training approximately 2.5 years before the occurrence. Of these eight occupants, six were seated next to a window or near an exit.

During his OHSI testimony the survivor compared his HUET experience with that experienced during the CHI91 crash. In addition to noting that HUET was very controlled and covered a ditching without a lot of impact, he identified environmental issues such as salt water, water temperature, and wave action as being the most significant differences. He suggested that a couple of days of HUET every few years was not enough to prepare someone to escape a helicopter crash like the CHI91 accident.

In the early days of HUET training, the water temperature varied between 8°C in winter months to about 16°C in the summer. Students waiting for subsequent HUET sessions got cold waiting, morale declined, and requests were made to raise the temperature. As a result, about 20 years ago, the majority of training establishments started to warm their HUET pools to about 20°C. Student morale improved and fewer people failed the HUET portion of the BST training. Cold shock was taught in the classroom, but no practical exposure was given in the pool. There are several accounts of aircrew who have ditched in cold water stating they never realized how serious cold water shock was compared to what they were taught in the classroom.

A study conducted in 2008 exposed 100 aircrew volunteers to cold water immersion (8°C to 12°C) for about 5 minutes without immersion suits. All the participants experienced some symptoms of cold shock. The majority of the participants expressed the opinion that it was very effective training and suggested that it should be added to the course training standard.^{Footnote 37}

Research has also shown that realism is important because it helps to make evacuation behaviours more automatic, decreasing the time required to escape. Using helicopter underwater escape trainers that are not representative of the operating environment has the potential to negatively affect training outcomes in that trainees feel less confident about their likelihood of escape and they require more time to escape as they figure out the best course of action in the novel situation.^{Footnote 38}

Many of the offshore jurisdictions, including Norway's, require recurrent BST sessions once every 4 years, whereas Canadian offshore regulators require this training every 3. To mitigate procedural skill decay occurring in the 3 years between recurrent BST sessions, the workers employed in the eastern Canadian offshore industries (and many of the other offshore jurisdictions) are shown a preflight safety briefing video. The one shown to offshore workers travelling on Cougar helicopter flights was 15 minutes long.

1.15.5 Flight Crew BST for Offshore Operations

Cougar Helicopters is not required by TC regulation to have its aircrews complete HUET; however, contracts with the oil companies may call for this training as a required pilot qualification. Most Cougar Helicopters pilots complete a full 5-day BST program since they may be required to spend time on the offshore installations. Recurrent training is completed every 3 years, and the pilot is offered the option of completing the full 2-day refresher or the 1-day HUET portion. In addition, the BST program satisfies many of the required components of Cougar Helicopters' standard emergency procedures training.

The captain completed the 5-day initial BST course at the Marine Institute in St. John's on 05 February 2005, and his qualification was renewed on 07 January 2008 upon completion of a 7-hour, 1-day HUET session, and was valid until 07 January 2011. The captain was a proficient swimmer.

When he joined Cougar Helicopters, the first officer completed a 5-day, 40 hour BST program at Survival Systems Training Ltd. on 13 June 2008 and his qualification was valid until 13 June 2011. The first officer was a former pilot in the Canadian Forces and had completed Sea King HUET training at Survival Systems Training Ltd. several times previously. The first officer was a proficient swimmer.

While the company encourages its pilots to sit in the mock-up cockpit during HUET, Cougar Helicopters' aircrew are not required to do so. Therefore, aircrew can successfully complete the course even if they have not conducted a practice egress from one of the pilot positions.

1.15.6 Current Passenger Transportation Suit Systems Standards and CARs

In order to receive marine use approval by Transport Canada as a constant wear marine immersion suit and aviation use approval by Transport Canada as a helicopter PTSS, the Helly Hansen Canada Limited (Helly Hansen) Nautilus E-452 Survival/Marine Abandonment suit (E-452) had to meet the requirements in these Canadian General Standards Board's (CGSB) standards:

1. Immersion Suit Systems (CAN/CGSB-65.16-2005); and
2. Helicopter Passenger Transportation Suit Systems (CAN/CGSB-65.17-99).

CAN/CGSB-65.16-2005 applies to immersion suit systems that are used for marine abandonment and constant wear. The standard states that immersion suit systems must:

• Reduce thermal shock upon entry into cold water;
• Delay the onset of hypothermia during immersion in cold water;
• Provide acceptable flotation and minimize the risk of drowning;
• Not impair the wearer's ability to perform fundamental survival actions; and
• In the case of constant wear immersion suits, not impair the wearer's ability to perform normal working duties.

According to standard CAN/CGSB-65.16-2005, the marine immersion suit system must provide thermal protection of at least 0.75 clo^{Footnote 39}, have a minimum inherent buoyancy of at least 70 Newton (N)^{Footnote 40} and a minimum flotation buoyancy of at least 150 N.

According to Airworthiness Manual (AWM) 551.407 - Aircraft PTSS, and CAR 602.63 - Life Rafts and Survival Equipment, CAN/CGSB-65.17-99 applies to PTSS that are used during helicopter flights over water that is less than 10°C. This CGSB standard outlines general and detailed PTSS requirements such as closures and seals, floating characteristics, and thermal protection. In accordance with the standard, the PTSS must provide thermal protection of at least 0.75 clo, have a maximum escape (inherent) buoyancy^{Footnote 41} no greater than 175 N^{Footnote 42} and a minimum flotation buoyancy^{Footnote 43} of not less than 156 N. PTSS meeting this standard must be international safety orange, yellow, or an equivalent high-visibility color.

There is considerable overlap between CAN/CGSB-65.16-2005 and CAN/CGSB-65.17-99. In particular, the wording of the introduction to CAN/CGSB-65.17-99 clearly states that in some circumstances one suit may meet both standards. That portion of the standard states:

CAN/CGSB-65.16 Marine Abandonment Immersion Suit Systems and CAN/CGSB-65.17 Helicopter Passenger Transportation Suit Systems provide the potential for dual-role approval of immersion suit systems in certain use situations.

Although the PTSS were not required to meet CAN/CGSB-65.16-2005, the east coast offshore operators requested that the manufacturer ensure that the PTSS also met this standard. This would allow the PTSS used during flight to double as an immersion suit that could be used during an emergency abandonment from the offshore platforms. Offshore workers are required to have access to two immersion suits that meet CAN/CGSB-65.16-2005 while they are on the offshore facilities. Allowing the PTSS used during the flights to double as the second immersion suit effectively reduced the need from three suits to two suits per person. The first immersion suit, designed to meet just the marine abandonment standards, is kept onboard the offshore facilities.

When both standards are considered together, it results in a PTSS that must have an inherent buoyancy of no less than 70 N and a maximum escape buoyancy of 175 N. Escape buoyancy is a combination of inherent buoyancy and trapped air within the suit. Inherent buoyancy is often achieved by manufacturing a PTSS with buoyant material throughout the PTSS. Requiring a minimum inherent buoyancy of 70 N, as is the case for CAN/CGSB-65.16-2005, can result in a PTSS that is thicker and more bulky than a suit that does not have to meet a minimum buoyancy, as is the case for CAN/CGSB-65.17-99.

1.15.7 Cougar Helicopters Flight Crew Immersion Suits

Both occurrence pilots were wearing blue Viking pilot suits (Viking Life-Saving Equipment; model number PS4177). The Viking PS4177 is a dry-suit with neoprene wrist seals, a waterproof zip fastener, and a neoprene collar and hood. There is no inherent buoyancy provided by the Viking PS4177 nor does it provide thermal protection. Buoyancy is provided by a separate flotation vest and thermal protection is provided by undergarments. Blue is the only color available in this model. There are other pilot immersion suits commercially available with international orange or yellow exteriors which have been identified as playing a beneficial role in SAR recovery activities.^{Footnote 44} However, there is not universal acceptance of these types of suits because of the potential for reflections in the cockpit which may distract the pilots. European Technical Standard Order (ETSO)-2C503 - Helicopter crew and passenger immersion suits, Appendix 1, states that where possible flight crew immersion suits shall meet the same requirements as those for passenger suits, which require that those parts of the suit which will be visible when in the water shall be of a highly conspicuous colour. ETSO-2C503 further states that "the choice of suit colour may vary to minimise the risk of the suit reflecting on surfaces within the flight deck." As a result, some operators opt for pilot immersion suits that are not of a highly visible colour to reduce the potential for distractions caused by reflections off cockpit surfaces.

The Viking PS4177 pilot suit was selected by Cougar Helicopters because it provided water immersion protection and was still flexible enough to perform flight deck tasks and presented a reduced risk of reflection in the cockpit (see Photo 12). The Viking PS4177 is an air force design modified to meet the demands of the commercial pilot market. It has not been tested, nor is it required to be tested, to the PTSS standards set out by the CGSB which requires bulkier suits with more buoyancy and thermal insulation.

In 1985, the Canadian Aviation Safety Board (CASB) identified the need for a set of standards and regulations that applied to passenger and crew suits and the following Board recommendations were made:^{Footnote 45}

1. CASB 86-28: The Department of Transport amend Air Navigation Order Series VII, No. 6, to make provision for the wearing of immersion suits by passengers and crew on board all helicopters flying over Canada's offshore and northern waters.
2. CASB 86-29: The Department of Transport ensure that all immersion suits required by Recommendation 86-28 meet minimum performance standards throughout their in-service life.

After these recommendations were adopted, passengers and crew were required to wear immersion suits. Over time the design of passenger and crew suits diverged; when the CARs were first published in the 1990s, the name of the applicable regulation was changed to the Passenger Transportation Suit System requirement. Currently, the regulatory requirements and standards for PTSS are contained in CAR 602.63 subsection 7(a) and AWM 551.407. TC has indicated that these provisions do not apply to flight crew suits. There are no current Canadian standards for flight crew immersion suits and no current requirements in the CARs for flight crew to wear them. In contrast, EASA explicitly states that its immersion suit design standards apply to both crew and passengers. In 2006, EASA published the following standards:

1. European Technical Standard Order (ETSO-2C502) Helicopter Crew and Passenger Integrated Immersion Suits; and
2. European Technical Standard Order (ETSO-2C503) Helicopter Crew and Passenger Immersion Suits for Operations to or from Helidecks Located in a Hostile Sea Area.

Suit manufacturers provide recommended care and maintenance guidelines for crew suits and ancillary lifesaving equipment such as flotation vests. Although, there is no regulation outlining care and maintenance requirements for immersion suits, CARs Standard 625 Appendix C Item 11 states, "survival and emergency equipment shall be overhauled at the intervals recommended by the manufacturer." At the time of the occurrence, a formal pilot immersion suit maintenance program with scheduled inspections was not in place at Cougar Helicopters and crew were expected to inspect their own suits. After the accident, an inspection of the pilot immersion suits revealed that 16 out of 25 crew suits were unserviceable, with 5 of those requiring major repairs. It was determined that some pilots were not completing thorough suit inspections and some of the unserviceable issues would not have been easily detected by a cursory visual inspection.

Both pilots were wearing orange external flotation vests (Mustang model number MD1127). The Mustang vest used by the Cougar Helicopters pilots is a twin chamber inflatable constant wear life jacket providing 37 pounds of buoyancy.^{Footnote 46} The Mustang vest has self-righting capabilities, a manual carbon dioxide (CO2) inflation system, a water-activated light, and a water-activated dye marker. There were no deficiencies found with the flotation vests and they did not play a role in the occurrence.

1.15.8 Passenger Transportation Suit Systems

Prior to boarding the helicopter in CYYT, passengers were issued a PTSS that they would keep until they returned to CYYT at the end of their rotation on the rig. The E-452 was determined by the east coast offshore operators^{Footnote 47} to be well tested, safe, and the best available option for the operating environment due to its features, thermal protection, and water tightness (see Photo 13).

The E-452 is available in seven different sizes. The E-452 user dimension chart considers 23 dimensions to determine the appropriate PTSS size. Custom sizing is available for passengers falling outside the design range. At the time of the occurrence, there was no requirement for a specific type of garment to be worn under the E-452.

The E-452 has the following characteristics:

• Hypothermia protection: With over 650 grams of accidental water ingress, the insulation provides 0.75 clo in water testing in 40 centimetre (cm) waves.
• Flotation protection: 78 Newtons (N)^{Footnote 48} inherent buoyancy is provided by the PTSS alone with an additional 200 N of buoyancy provided by an integrated life preserver.

In 1995, the National Energy Board of Canada (NEB) submitted a discussion paper^{Footnote 49} to the CGSB, indicating that the Norwegian Underwater Technology Centre (NUTEC) had successfully trained 10 000 students to escape from a helicopter underwater escape trainer without any problems while wearing PTSS with between 168 N and 196 N of inherent buoyancy. Similar studies have not been carried out in Canada with the E-452. However, CAPP has been advised by the Marine Institute and Survival Systems Training Ltd. that the buoyancy of the E-452 does not impede egress during HUET.

The E-452 features include securements for a water activated personal locator beacon (PLB), a strobe light and emergency underwater breathing aid (EUBA). A common type of EUBA is a small compressed air unit that has a diving style regulator that provides a limited amount of air to the user. All E-452 suits used on the occurrence flight were equipped with PLBs and strobe lights. They were not equipped with EUBA.

In his testimony at the Offshore Helicopter Safety Inquiry, the survivor indicated that the water activated strobe light worked and provided enough light for him to see inside the submerged wreckage. The strobe light, waterproof up to 10 metres, is designed to start flashing when armed and in contact with fresh or salt water. The strobe light is designed to be visible for a minimum of 1.6 km and will function for a minimum of 8 hours in −1°C environments.

1.15.9 Passenger Transportation Suit System Introduction Phase

During the introduction of the E-452 at Cougar Helicopters, Helly Hansen personnel provided an introduction to the E-452, in addition to training Cougar Helicopters personnel on how to instruct passengers in the use of the suit. At that time, determination of PTSS size was based on visual estimates of height and weight, hood donning ability and the passenger's assessment of mobility. Confirmation of PTSS sizing through a fit check was not a BST requirement nor was it a component of the initial PTSS orientation or the normal PTSS distribution process at Cougar Helicopters.

The E-452 PTSS is designed to function well with up to 654 grams of water ingress due to leakage. Post-impact, more than 654 grams of water entered the survivor's PTSS and the survivor's body temperature dropped rapidly. The water ingress was likely due in part to inadequate PTSS seals around the face (hood seals) and wrists (wrist seals) resulting from the survivor wearing a PTSS that was too big.

1.15.10 Passenger Transportation Suit System Standard Review

The CGSB Committee on immersion suits, comprised of regulators, manufacturers, labour unions and operators, maintains a cyclic review process, normally every 5 years or as deemed necessary, for the Helicopter Transportation Suit Systems standard. New information, updates in technology, and new testing methods are considered and changes to the standards are made as required. The last revision to the standard was published in 1999.

1.15.11 PTSS and Window Size

The E-452 was designed to accommodate most offshore workers. According to anthropometric measurements, the maximum body breadth measured at the hips for most of the Atlantic offshore workers while standing, wearing work clothes (but not the PTSS), is 16.5 inches and relaxed shoulder breadth is 17.6 inches.^{Footnote 50} An additional measurement of consideration is that 50% of the Atlantic offshore workers have waist circumferences of greater than 46.9 inches while wearing the PTSS.

The S-92A certification documents indicate that each passenger window is 21.5 inches high and 18.25 inches wide. These windows are not considered emergency exits by FAR 29 nor must they pass a certification process that accounts for the use of PTSS by occupants.

1.15.12 Personal Locator Beacons

Personal locator beacons (PLBs) are not required by regulation or by the C-NLOPB; however, the east coast offshore operators require them to be carried by pilots and passengers. The PLBs (model #ISPLB8X) were manufactured by Marine Rescue Technologies Ltd. in the United Kingdom and were designed to operate for 20 to 30 hours in water depths of less than 20 centimetres (see Photo 14). The PLB is designed to provide an immediate warning of a man overboard event by transmitting a distress signal on 121.5 MHz when immersed in fresh or salt water. Prior to 01 February 2009, the primary detection source for 121.5 MHz PLBs and emergency locator transmitter (ELT) signals was the COSPAS-SARSAT satellite system and a secondary source of detection was line-of-sight detection by surface ships or airborne aircraft. As of 01 February 2009, COSPAS-SARSAT ceased monitoring 121.5 MHz as part of the transition to newer technology 406 MHz PLBs and ELTs. The east coast offshore operators have remained with the 121.5 MHz PLBs because of its homing capabilities and the fact that many of the new 406 MHz PLBs must be manually activated. 406 MHz PLBs with automatic activation are in use in Europe and are expected to be commercially available in North America in 2011.

The PLB design is such that over-tightening of the antenna could, with very little resistance, cause the antenna connector to turn. If tightening is continued, the wires running from the connector will eventually break. Three of the PLBs recovered following the occurrence and examined by the TSB had loose antenna connectors, which would have prevented them from being watertight. Two of those three PLBs had twisted wires, one of which had the wires twisted until they broke. The broken wires would have made this PLB incapable of transmitting a signal. The third PLB antenna connector, which was recovered from the survivor, was likely damaged prior to the occurrence.

The manufacturer's website states that the beacon is protected against the effects of immersion in water to depth between 15 cm and 1 metre. All of the recovered PLBs had contamination due to salt water ingression. The PLBs are electronic components and must be sealed from moisture to ensure correct operation. Since none of the search and rescue aircraft that responded to the occurrence received a transmission on 121.5MHz, it is likely that sea water quickly penetrated the PLBs, rendering them inoperable.

The flight crew were equipped with ACR AEROFIX 406 PLBs (part number 11-07709), which are small lightweight devices that were carried in their immersion suit leg pocket covered by the pocket flap. These PLBs transmit a 406 MHz signal that is detected by the COSPAS-SARSAT satellite system, and includes a registered unique, digitally coded distress signal. The 406 MHz beacons also transmit on 121.5 MHz to allow for traditional homing by SAR resources. The flight crew's PLBs were not recovered by the TSB.

1.15.13 Emergency Underwater Breathing Aids

In 1989, a Royal Air Force report demonstrated that an air supply significantly aided in escape from a submerged helicopter.^{Footnote 51} Studies suggest that survival rates of helicopter ditching accidents may be low due in part to an inability to hold one's breath long enough to allow the helicopter to settle and to subsequently perform an escape from an often inverted and submerged helicopter.^{Footnote 52} EUBAs have been shown to extend the amount of time available for underwater escapes beyond the 29 to 92 seconds^{Footnote 53} normally required, and increase the likelihood of a successful escape.^{Footnote 54} In 2001, EUBA research in Canada was completed by the Canadian military and by the end of that year all Canadian military maritime helicopter crews were trained in its use.

In 2000 C-NLOPB asked CAPP to look at introducing EUBA for workers in Canada's offshore industry. An implementation committee was established by CAPP in 2003 to begin considering if the current PTSS version could accommodate a EUBA and what type of EUBA was appropriate for the Canadian offshore. There are three basic types of EUBA in use worldwide: compressed air devices, rebreather systems and hybrid systems combining a rebreather bag with a supplemental compressed air cylinder. These devices are usually carried in a pouch or pocket on the immersion suit or life vest. In order to be effective, a suitable EUBA needs to be well designed, reliable, easy to use and has to be appropriate for the average individual in the environmental conditions most likely to be encountered.

Compressed air systems supply air on demand and can be deployed just before submersion or underwater following a sudden impact and immersion. However as soon as they are deployed the limited air supply, approximately 2 minutes, starts to run out so they should not be deployed too quickly before submersion. Like any underwater diver using compressed gas, using a EUBA with compressed air requires the user to continue breathing during the ascent to the surface or run the risk of barotrauma injury. Barotrauma is an internal injury caused by a change in pressure such as the change encountered in changing water depth. The potential for barotrauma injury would impose an additional risk for offshore workers each time they train using EUBA.

Rebreather systems were developed to be simple to use and to eliminate the potential of barotrauma injury. They essentially use a bag to resupply the user with expired air, allowing some respiratory movement and allowing the user to re-breathe 2 to 4 times longer than their normal breath. Most rebreather systems can only be activated after the mouthpiece is in place and the system is primed with expired air. The individual's orientation underwater and the rebreather system design can make it difficult to overcome the hydrostatic imbalance between the pressure of the air in the lungs and that in the bag.

Hybrid rebreather systems allow for additional air from a compressed air supply to supplement the rebreather, reducing the hydrostatic imbalance.

Prior to the CHI91 accident, a program to introduce compressed air EUBA systems into the Canadian offshore industry was initiated but the training and equipment was not introduced until after the accident.

1.15.14 Flight Helmets and Visors

Although not fatally injured during the impact sequence, both pilots received severe injuries due in part to striking their heads/faces against the instrument panel. Neither pilot was wearing head protection (i.e., approved helmet, complete with visor).

No helmet use policy was in place at Cougar Helicopters at the time of the occurrence, and helicopter pilots were under no regulatory requirement to wear head protection. Prior to the occurrence, approximately 10% of the Cougar Helicopters' pilots were routinely wearing head protection. The majority of pilots surveyed cited discomfort as the reason they did not wear head protection. Very few of the surveyed pilots had fully considered that partial incapacitation due to a head or face injury could compromise their ability to help their passengers after an accident.

According to US military research, the risk of fatal head injuries can be as high as six times greater for helicopter occupants not wearing head protection.^{Footnote 55} In addition, the second most frequently injured body region in survivable crashes is the head.^{Footnote 56} The effects of non-fatal head injuries range from momentary confusion and inability to concentrate, to a full loss of consciousness.^{Footnote 57} Incapacitation can compromise a pilot's ability to quickly escape from a helicopter and assist passengers in an emergency evacuation/survival situation.

The National Transportation Safety Board (NTSB) has found that the use of head protection can reduce the risk of injury and death. An NTSB review of 59 emergency medical services (EMS) aviation accidents that occurred between 11 May 1978 and 03 December 1986 was completed in 1988. This review resulted in the NTSB making recommendations to the FAA (A-88-009) and to the American Society of Hospital Based Emergency Aeromedical Services (A-88-014) that crew members be required to wear protective helmets to reduce the chance of injury and death, and that medical personnel be encouraged to do the same.

TC also acknowledged the safety benefits of head protection use in its 1998 Safety of Air Taxi Operations Task Force (SATOPS)^{Footnote 58} report in which it committed to implementing the following recommendation:

• Recommend Transport Canada continue to promote in the Aviation Safety Vortex newsletter the safety benefits of helicopter pilots wearing helmets, especially in aerial work operations, and promote flight training units to encourage student pilots to wear helmets.

In addition, SATOPS directed the following recommendation to air operators:

• Recommend that helicopter air operators, especially aerial work operators, encourage their pilots to wear helmets, that commercial helicopter pilots wear helmets and that flight training units encourage student helicopter pilots to wear helmets.

The TSB has documented a number of occurrences^{Footnote 59} where the use of head protection likely would have reduced or prevented the injuries sustained by the pilot, as well as occurrences in which the use of head protection reduced or prevented injuries.

Despite their well-documented safety benefits, and the challenging nature of helicopter flying, the majority of helicopter pilots continue to fly without head protection. Likewise, most Canadian helicopter operators do not actively promote, or require, the use of head protection by company pilots.

1.16 Test and Research

Not applicable.

1.17 Organizational and Management Information

1.17.1 General Organizational Background

Cougar Helicopters, which was established in 1986, holds operating certificates for operations under CARs subpart 704^{Footnote 60} and 702.^{Footnote 61} In 1990, Cougar started transporting offshore workers, employed in the petroleum industry, from Halifax, Nova Scotia, with Sikorsky S-61N and S-76A helicopters. One year later, Cougar Helicopters was awarded the first civilian contract to provide SAR services with an S-76A in Yarmouth, Nova Scotia, and SAR services continue to be an important component of its operations. In 1995, it was contracted to transport Hibernia production platform workers utilizing three AS332L Super Pumas.

In 2004 Cougar Helicopters was acquired by and became a part of the Vancouver Island Helicopters (VIH) Aviation group. VIH was established in Victoria, Canada in 1955. In addition to charter helicopter operations around the world, the VIH Aviation Group operates a helicopter repair centre, a corporate aircraft operation, and servicing facility at the Victoria International Airport.

In addition to its Canadian operations, Cougar Helicopters is also very active globally with substantial Offshore Oil and Gas operations in Louisiana, United States, and in Perth, Australia. It has occasionally operated in Alaska, Greenland, Angola, and the Northwest Territories. Cougar Helicopters estimates that 97% of its flying time is spent over open water.

1.17.2 Safety Management Systems

1.17.2.1 General

Cougar Helicopters is not required by the CARs to have a Safety Management System (SMS). Based on TC's SMS implementation schedule, regulation for 704 operations such as Cougar Helicopters is currently planned for 2012, with progressive implementation expected to take approximately 3 years. Nevertheless, Cougar Helicopters has been proactive in developing safety programs within its organization. In 1997, it became the first helicopter company in North America to receive ISO 9001:2000 certification (subsequently upgraded to ISO 9001:2008).

Since it is not yet a regulatory requirement, Cougar Helicopters' SMS has not yet been assessed by TC. However, Cougar Helicopters and all its operational programs are subject to external oversight and review by the oil companies it works for and the C-NLOPB. As a result, Cougar Helicopters' SMS has had several audits in the past, and no significant deficiencies were identified.

The safety program at Cougar Helicopters is very visible and all the employees of the company, from the owner on down, actively promote safety in all its activities. Cougar Helicopters promotes a non-punitive, "just culture"^{Footnote 62} within its organization as per industry recommended best practices for establishing an effective safety management system. Employees are encouraged to report any safety issue, even if it involves a personal mistake, knowing that they will not be penalized for an unintentional error.

1.17.2.2 Cougar Helicopters' SMS

Cougar Helicopters' SMS followed the elements identified in TC's SMS guidance material. The program elements include: event or hazard reporting either formally or confidentially, risk management, internal investigation processes, corrective action plans, safety issue trend tracking, performance analysis, employee safety training, and safety communication processes. An on-line safety information page allows all employees to check the latest safety information, to ask questions, to follow-up on safety issues they have reported previously, and to report new ones.

The proactive elements of an SMS are not required in the early phases of implementation, nor is it reasonable to expect an effective use of such elements until the later phases. TC expects the proactive SMS elements of investigation, analysis and risk management to be present in phase III of SMS implementation and the operational quality assurance element of SMS to be present in phase IV of SMS implementation. According to TP14135E(Safety Management Systems for Small Aviation Operations - A Practical Guide To Implementation), occupational safety statistics suggest that for every serious or disabling injury in an organization, there are upward of 600 previous safety deficiencies and minor incidents that may or may not have been reported. Aviation is a very complex environment and the successful proactive identification of latent safety deficiencies requires a considerable amount of time, resource commitment and organizational experience with these processes.

When the S-92A helicopter was added to the Cougar Helicopters fleet, some risk assessments and change management processes were completed to identify potential risks. Infrastructure deficiencies such as helicopter servicing, maintenance personnel/resources, and flight crew training were considered and addressed. Cougar Helicopters did not specifically assess the operational risks associated with flying the S-92A offshore as this was a new helicopter promoted as meeting the most stringent safety standards and was approved for operation by the FAA, TC and the Joint Aviation Authorities (JAA).^{Footnote 63}

1.17.2.3 Individual Flight Risk Assessment Matrix and the Cougar Dispatch Centre

Cougar Helicopters utilizes a risk assessment matrix (RAM) that is completed prior to each flight. As part of the departure planning, the pilots are assisted by the dispatch centre to assess risk factors related to pilot experience, environmental factors, flight complexity, time of day, lighting conditions, pilot fatigue, and personal crew factors. The RAM completed for CHI91 identified the first officer's low time on the S-92A and the multi-stop flight as risk factors; however, the total risk score was in the acceptable range. The RAM is designed such that certain risk values require the involvement of senior operational managers to ensure the risk is properly mitigated through crew changes, altering the planned flight, or by cancelling the flight. Considering the risks of each flight reflects a positive corporate safety culture and reinforces safety behaviour by encouraging pilots to actively consider risks.

Cougar Helicopters has a Co-Authority Type B dispatch or operational control system.^{Footnote 64} This CAR 705^{Footnote 65} style dispatch system had not previously been applied to a helicopter operation in Canada. Cougar Helicopters approached TC requesting to be approved to this standard and worked with TC to produce a system that exceeded the CAR 704.15 - Operational Control System requirement for helicopters. The system employed by Cougar Helicopters meets the airline Type B operational control standards defined in Commercial Air Service Standard (CASS) 725.20 - Operational Control System. Cougar dispatch centre personnel receive specialized training, are certified by TC, and are re-evaluated every year. By sharing operational decisions between flight crew and dispatchers another layer of safety oversight is put into place.

Flight following^{Footnote 66} is provided by the Cougar dispatch centre through a variety of communication methods and utilizes an Iridium satellite network for flight tracking. This type of flight tracking system exceeds the operational tracking required by regulation. The system tracks the helicopter, via its onboard transponder, regardless of where it might be worldwide, relaying information about the helicopter's position, altitude, speed, and heading. Update information is sent every 5 minutes when the helicopter is above 2000 feet, every 3 minutes below 2000 feet, and every fifteen seconds if the flight crew activates the emergency switch in the cockpit. An alert is presented to the Cougar dispatch centre if a helicopter fails to send an update report.

1.17.2.4 Flight Data Monitoring and S-92A Health and Usage Monitoring System

Cougar Helicopters also has a Helicopter Flight Data Monitoring (HFDM) program which uses both flight data recorder and health and usage monitoring system (HUMS) data to monitor flight crew performance. At the end of every day, flight data from each helicopter's flight recorder is downloaded and transferred to the HFDM workstation where it is analyzed for flight control quality and to detect deviations from Cougar Helicopters' standard operating procedures (SOPs). If necessary a flight animation is produced, it is then reviewed by a committee comprised of a trained data analyst and two senior pilots. The purpose of the review is to identify areas of improvement and discuss them with the pilot, while maintaining confidentiality. Systemic issues that are identified through the program are incorporated into future training programs and may also result in SOP revisions.

In addition to the HFDM program, the HUMS from each helicopter is downloaded every day and used to monitor the helicopter's systems for faults or to detect trends that could lead to faults. This allows for proactive steps to be taken by the operator and manufacturer to correct developing safety issues. The operator is not the sole user of the data. Sikorsky receives the raw HUMS data from S-92A operators around the world. This makes it easier to identify safety deficiency trends since data is gathered from the entire fleet rather than just a few aircraft.

1.17.2.5 Internal, External, and Regulatory Oversight of Cougar Helicopters Operations

Transport Canada has the regulatory responsibility for the oversight of the aviation industry. Cougar Helicopters holds a TC approved operating certificate and is a TC approved maintenance organization. The designated TC maintenance inspector for Cougar Helicopters is based at the TC office in St. John's. The principal operational TC inspector, a rotary wing specialist, is located in the TC regional office in Moncton, New Brunswick. The TC rotary wing specialist is type-endorsed on the S-92A and completes S-92A training yearly with Cougar Helicopters. This allows him to monitor the training program. Oversight is conducted regularly through inspections, audits, meetings and phone contact. Cougar Helicopters typically undergoes two separate audits, carried out by a team of TC inspectors, on either the operational or maintenance areas of the company. The audit history for Cougar Helicopters has not led to any significant findings. All incident reports involving a helicopter operated by the company are reviewed by TC and followed up when required.

In addition to the regulatory oversight by TC, Cougar Helicopters is subject to a considerable amount of oversight by the companies that it has contractual obligations with. The oil companies independently bring in aviation and safety management specialists to periodically audit Cougar Helicopters. Between 2007 and the date of the occurrence, Cougar Helicopters had been subject to 16 external audits.

Finally, Cougar Helicopters has its own internal audit processes defined in its SMS. Typically there are four separate internal audits performed each year on each Cougar Helicopters' base of operations. Additional audits or change management processes are completed as necessary when modifications have been made to the operational scope, which could include such things as opening a new base or the addition of a new helicopter. Between 2007 and the date of the occurrence, Cougar Helicopters performed 16 internal safety audits.

1.17.3 Cougar Helicopter S-92A Flight Crew Training

1.17.3.1 Regulatory Requirements

CAR 704.120 requires that every air operator establish and maintain a Company Operations Manual (COM). The air operator shall submit its COM, and any amendments, to TC for approval. The COM includes the necessary instructions and information that enables company personnel to perform their duties safely. The COM must also contain a detailed syllabus of a company's ground and flight training program, as well as its frequency. The COM also contains information regarding the use of aircraft flight manuals, helicopter operating manuals, SOPs, and minimum equipment lists.

CAR 704.115 identifies the basic training requirements that must be included in an operator's COM to provide personnel with the necessary competence to perform their assigned duties. Appropriate training and qualification records for each employee are required to be kept by the air operator under CAR 704.117.

The CARs also require air operators to ensure that adequate facilities and qualified personnel are provided for their ground and flight training program in accordance with the CASS.^{Footnote 67} The CARs outline the required qualifications for ground instructors, aircraft training pilots, simulator instructors, and the company chief pilot. Training pilots, simulator instructors, and the chief pilot share the responsibility for monitoring training programs and identifying additional training requirements. These same individuals are also responsible for the supervision of the training standards and for recommending amendments to operating procedures. In particular, they provide input for inclusion in helicopter operating manuals and SOPs, which contain the techniques pilots are expected to comply with during flight operations.

An air operator with an approved training program using an approved Level A^{Footnote 68}, or better, full flight simulator (FFS) is permitted to conduct most initial, upgrade, and recurrent training in that simulator. The simulator training stresses the SOPs for normal, abnormal, and emergency operation of the helicopter systems. It emphasizes the use of checklists and flight crew coordination. Hydraulic, electrical, and other system failures are covered in the simulator training among other items.

To take full advantage of the training value provided by simulators, Cougar Helicopters' policy is to make maximum use of simulators during helicopter type-training; however, the COM also contains an outline for a conversion course that is completed exclusively using a helicopter, without the use of a simulator.

The COM also states that technical ground training shall ensure that each crew member is knowledgeable with respect to the aircraft systems and all normal, malfunction, and emergency procedures. In accordance with the CASS 724.115,^{Footnote 69} section 8.6 of Cougar Helicopters' COM states that "instruction related to components or systems that flight crews cannot control, influence or operate are minimized".

As per regulation, technical ground training for pilots must be completed on a yearly basis. Both initial and recurrent ground training must include instruction on helicopter systems operation, RFM limitations, as well as pilot flying and pilot not flying duties/SOPs during normal, abnormal, and emergency procedures. The ground training shall have evaluation exams which should be performance oriented and stress the operation (normal, abnormal, and emergency) of the aircraft systems and equipment.

1.17.3.2 S-92A Classroom Training

For the S-92A, Cougar Helicopters sends many of its pilots to the Flight Safety International (FSI) facility in West Palm Beach, Florida, for the initial course and subsequent recurrent training. Although less frequently, Cougar Helicopters also sends pilots to the FSI facility at Farnborough, United Kingdom. The captain had completed his most recent recurrent training from 05 to 09 January 2009 at the FSI facility at Farnborough UK. Having completed his initial S-92A training in May 2008, the first officer was due for recurrent training in June 2009.

FSI has been the Sikorsky factory-authorized training source for pilots and maintenance technicians since 1983. The FSI web site advises that it is dedicated to keeping its instruction accurate and up to date. Similarly, the Sikorsky web site indicates that Sikorsky's alliance with FSI provides its S-92 commercial customers with the highest quality training available, with factory-approved curriculum for the helicopter at its Learning Center in West Palm Beach, Florida. Although Sikorsky does not actually approve the content of the S-92 Pilot Training Manual (PTM), Sikorsky pilots who take the S-92 ground school and simulator programs monitor the content, and provide recommendations for improvement to FSI. There is frequent contact between FSI and the Sikorsky customer service representative to address questions about training.

The recurrent ground training, including helicopter systems training, is taught referencing the FSI S-92A PTM and the S-92A RFM and consists of 22 hours of classroom instruction. An assessment of the course content was completed based on investigation interviews, a review of the FSI training module and a review of Chapter 10 of the PTM, which covers the S-92A powertrain.

The PTM powertrain chapter explains that lubrication of the MGB is through a dual lubrication pump system. The PTM includes a lubrication system schematic for the powertrain that depicts the dual lubrication pumps and a picture of the two external oil pumps mounted on the front of the powertrain. It also notes that if one pump should fail, the lubrication system can still supply sufficient lubrication; however, the pressure will drop to the lower green range (i.e., approximately 45 PSI). The PTM states that if both pumps should fail (loss of all lubrication), safe operation is still possible for a short period of time. There is no mention as to how long the gearbox would be able to continue operating, nor is there an identified recommended maximum time of continued safe operation, following a loss of lubricant in either the PTM or RFM.

The PTM is consistent with the RFM, part 2, section 1 with the exception of its explanation of the oil pressure sensing system. The PTM mentions that if the MGB oil pressure drops below 24 psi (sensed by the switch at the left accessory module) or 35 psi (measured by the pressure transducer in the input manifold), the red MGB OIL PRES warning message appears and a "gearbox pressure…gearbox pressure" audio sounds. However, the manufacturer has since clarified to the TSB that the information in the RFM is correct and that each sensor must independently record low oil pressure conditions; the transducer oil pressure must drop to 35 psi and the oil pressure at the left accessory module must decrease to 24 psi in order for the aural warning and the master warning to activate.

Other MGB components identified in the PTM include the chip detector, the oil temperature sensor, the MGB oil pressure switch, and the oil pressure sensor. The PTM does not include information regarding how the temperature gauge senses temperature (i.e., that it is a wet bulb requiring immersion in oil) or that it would be unreliable in the event of a total loss of oil, as it would, in such a case, measure ambient temperature inside the MGB case.

1.17.3.3 S-92A Flight Training Device and Simulator Training

An early S-92A helicopter prototype was used to gather baseline data, including handling qualities, performance, noise, and vibration data for the FSI pilot training simulators. A complete loss of thrust to the tail rotor is impossible to conduct in a real helicopter. As a result, the simulation for this emergency is based on Sikorsky's and FSI's best estimation of how the helicopter would react to such a failure.

Annual recurrent training typically consists of 6 hours flown in the right seat, 6 hours flown in the left seat, followed by a 5-hour pilot proficiency check (PPC), for a total of 17 hours per year in the simulator. In annual simulator training, the MGB oil system failure malfunction is normally practiced once and the scenario simulates a gradual loss of MGB oil pressure that culminates in vibrations which steer pilots toward an emergency landing or ditching. The exercise is repeated if necessary to achieve the required proficiency. This simulation includes the introduction of unusual vibrations shortly after the MGB oil pressure reaches 20 psi, progressively increasing in intensity as oil pressure decreases. During the simulation of a progressive loss of MGB oil, the MGB oil temperature indication shows an initial increase, and then decreases within the green zone.

1.18 Additional Information

1.18.1 Emergency Procedures and Emergency Handling

1.18.1.1 General

This section of the report discusses abnormal and emergency procedure and checklist design philosophies, the S-92A RFM, Cougar Helicopters SOPs, and the Cougar Helicopters' S-92A Pilot Checklist. It will conclude with an account of the crew's handling of the emergency, from the initial indication of a loss of MGB oil pressure to the eventual impact with the water. It will also focus on the abnormal and emergency procedures in place and the crew's actions in response to their situation. Section 2.6 provides a detailed account of the crew resource management elements of this occurrence.

1.18.1.2 Emergency and Abnormal Procedure Design Philosophy/Principles

Operators rely heavily on approved procedures to ensure that aircraft are operated within prescribed limits and that the correct actions are carried out in a particular situation. Abnormal procedures are designed to allow flight crews to recover from situations that could lead to an emergency situation; whereas, emergency procedures are designed to handle specific types of emergencies.^{Footnote 70} Typically, caution lights and/or messages are associated with abnormal procedures, and warning lights and/or messages are associated with emergency procedures.

In most cases, abnormal procedures consist of non-memory items that the pilot will complete in direct consultation with the aircraft checklist. Emergency procedures often begin with a series of time-critical actions (i.e., memory items), which are then followed by non-critical actions (i.e., non-memory items) that are completed in consultation with the checklist. The decision to identify a procedural step as a memory item is largely based on the urgency of the required action. Generally speaking, memory items are time-critical actions that are vital to the safe continuation of the flight.^{Footnote 71} In these situations, there is insufficient time to seek out or consult a pilot checklist. When designing an emergency procedure checklist, memory items should be clearly identified by the use of shading, boxing, or font.^{Footnote 72}

Studies have shown that pilots routinely omit memory items in emergency procedures because of memory limitations and a natural vulnerability to distractions,^{Footnote 73} particularly during periods of high workload.^{Footnote 74} The performance of memory items often results in errors in identifying the emergency condition, failure to select the proper checklist procedure, and actual errors in the checklist procedure.^{Footnote 75} At times, seemingly obvious actions are not as obvious to an individual who is overloaded due to a high stress situation and whose ability to analyze situations and devise solutions becomes drastically impaired by working memory limitations.^{Footnote 76} As a result, some manufacturers have attempted to reduce, if not eliminate, memory items from abnormal and emergency procedures.^{Footnote 77}In some instances, manufacturers expect pilots to perform specific actions without reference to the checklist; however, they do not identify these steps as memory items. In one example where this practice was identified, it resulted in an EASA recommendation that individual operators develop their own memory items in accordance with their operating philosophy.^{Footnote 78}

Another way that manufacturers have been able to reduce pilot workload during abnormal and emergency situations is to automate portions of the applicable procedure. This is particularly true for time critical actions. For example, it is possible to develop systems with automatic shut-offs or bypass functions in much the same way as caution or warning lights and/or messages are programmed to illuminate at preset values.

Most helicopter related abnormal and emergency procedures conclude with either "land as soon as practical (or practicable)"^{Footnote 79}, "land as soon as possible", or "land immediately". Generally speaking, non-critical malfunctions would likely result in "land as soon as practical". If the situation is more serious, or there is evidence that the problem has not been resolved, the procedure may conclude with "land as soon as possible". If the situation presents imminent danger to the crew and passengers, the procedure would likely end with "land immediately".

Each of these landing guidance terms implies a degree of urgency. However, the urgency associated with each of these definitions often differs among manufacturers and operators depending on the wording they use for the definition. Currently, there are no established standards for the landing guidance that is used in abnormal and emergency procedures, and this issue was the subject of TSB Safety Advisory A990002. ^{Footnote 80} TC's response to this safety advisory was to issue Commercial & Business Aviation Advisory Circular (CBAAC) 0163, which encouraged operators to "conduct a review of the flight crew interpretation of terms such as "possible", "practical", "practicable", "suitable" and "adequate" as they relate to aircraft emergency procedures with a view to developing consistent application of the terms." "Land immediately" was not included in this CBAAC. The onus for defining such landing guidance remains on the manufacturers and operators. While operators are sometimes willing to modify these definitions to fit their own needs, researchers have found that operators are often reluctant to question the procedures developed by manufacturers, viewing them as the resident experts who possess a better understanding of the procedure.^{Footnote 81}

In helicopter operations, "land immediately" is considered the highest priority emergency situation, and it is generally accepted as representing imminent danger to the crew and passengers. To illustrate, two definitions are provided from similar-sized military helicopters operated off the East and West coasts of Canada.

CH-124 Sea King:

• Land immediately - an immediate landing/ditching is mandatory. The consequences of continued flight are more hazardous than those of landing at a site normally considered unsuitable.

CH-149 Cormorant:

• Land Immediately - Imminent danger exists. An immediate landing/ditching shall be made in order to prevent loss of life.

In the S-92A RFM and Pilot Checklist utilized by Cougar Helicopters, "land as soon as possible" and "land immediately" are defined as follows:

• Land As Soon As Possible - Land at the nearest site where a safe landing can be accomplished.
• Land Immediately - Continued flight may not be possible. Ditching or landing in hazardous terrain is preferable to continuing flight.

Layout is another important consideration when designing abnormal and emergency procedures, particularly if abnormal and emergency procedures are combined into a single procedure. Studies have shown that pilots are often confused by checklists and subsequently make errors when completing the applicable procedure.^{Footnote 82} If the procedure is not well designed, there is greater risk that pilots will experience difficulties navigating through it, potentially delaying critical emergency actions.^{Footnote 83}

One way of presenting abnormal and emergency procedures is to list the steps in a linear-type sequence. Typically, linear procedures commence with memory items, and then conclude with non-critical follow-up actions. However, in some instances, abnormal and emergency procedures are combined into a single procedure. When a procedure combines both abnormal and emergency actions in a linear fashion, the pilot is required to read each line of the procedure to determine whether or not the step is required.

1.18.1.3 S-92A Rotorcraft Flight Manual

A RFM is required for helicopter type certification and is approved by TC in Canada. The RFM, which is produced by the manufacturer, must contain sections on the limitations, procedures, and performance required to operate the helicopter safely. The RFM must be available to flight crew members at their duty stations. Although a RFM was not recovered, it was determined that the pilots had copies available to them in the cockpit. The RFM takes precedence over pilot checklists and SOPs.

The investigation determined that some of the abnormal and emergency procedures in the Cougar Helicopters' S-92A Pilot Checklist and SOPs were different than those in the RFM. In particular, there were some minor differences noted between the RFM, S-92A Pilot Checklist, and Cougar Helicopters' SOP procedures for a dual engine failure during cruise and for the autorotative landing procedure. There were some significant differences noted between the MGB malfunction procedures in the SOPs and the S-92A Pilot Checklist compared to the RFM in effect at the time of the occurrence. The differences noted in the Cougar Helicopters' SOPs and the Cougar Helicopters S-92A Pilot Checklist will be discussed in sections 1.18.1.7 and 1.18.1.8.

The S-92A RFM contains a section dedicated to the MGB. Malfunctions of the MGB are broken down into lubrication failures, component failures, and transmission accessory failures (see Appendix D). In the case of a MGB oil system failure, abnormal and emergency conditions are incorporated into a single linear procedure. The non-critical malfunctions (i.e., abnormal conditions) are presented at the beginning of the procedure and the critical malfunctions (i.e., emergency conditions) are presented at the end of the procedure.

According to the RFM, MGB "temperature and pressure gauges, along with the main gearbox chip detection system, should give the pilot enough information to make an informed decision if a main gearbox problem arises." The subsequent line of the RFM warns the pilot to be alert to any of the following symptoms as warning signs of an impending MGB failure:

1. Chip lights from any of the main transmission modules;
2. Low transmission oil pressure and/or MGB OIL PRES caution;
3. High transmission oil temperature and/or MGB OIL HOT caution;
4. Increased power required at constant collective and airspeed;
5. Aircraft yaw kicks;
6. Howling, grinding, or unusual noise from the main transmission.

This section of the RFM also states that multiple symptoms should be considered a very strong indicator of an impending MGB failure. It continues by stating that if an impending MGB failure is suspected, then the primary consideration is to land the helicopter before failure progresses to gearbox seizure or loss of drive to the main or tail rotor. The RFM did not provide pilots with any guidance as to how long the aircraft would be capable of continued safe operation following a loss of MGB lubricant. Although it is common for helicopter manufacturers to market the run dry ^{Footnote 84} time of the helicopters, there is no regulatory requirement to include run dry time in the RFM.

The symptoms of an impending S-92A MGB failure are consistent with other large helicopters and it is common practice to look for secondary indications to confirm a potentially serious emergency condition. The S-92A's MGB oil pressure indicating system obtains data from two independent sources; the oil pressure sensor and the oil pressure switch. These sources provide data to a computer system which in turn provides information to the MFDs. The S-92A's MGB temperature indicating system requires the presence of oil in order to provide accurate temperature indications, and in the absence of oil the indications will be erroneous. However, in some helicopters, the caution/warning message and the related pressure or temperature gauge indications are both derived from a single sensor so pilots of these helicopters are normally taught to look for a secondary indication before taking action. For instance, in the absence of noise and/or unusual vibrations, many pilots have been taught that a loss of lubrication will result in an increase in temperature and that this increase in temperature would be considered a secondary indication of an actual problem.

In a helicopter, an imminent MGB failure is a critical situation. In a recent occurrence involving a similarly sized helicopter operating in the North Sea, the MGB failed, the helicopter immediately lost control and crashed into the ocean with no survivors.^{Footnote 85} In that occurrence, the pilots had no indication that the MGB was about to fail and the situation deteriorated so quickly the pilot barely had a chance to make a distress call.

In the S-92A RFM, the pilot is provided with the following guidance pertaining to a possible MGB failure:

Descend to an altitude from which a landing can be quickly made with minimal power changes and fly at an airspeed for which minimum power is required. Descent should be done at a reduced power setting, but with enough torque to drive the transmission. Avoid rapid or frequent power changes. High temperatures or loss of lubrication may result in loss of the main generators. The APU should be started so that the APU generator will be immediately available. A running landing is preferred since it requires lower power and smaller power changes. A no-hover landing should be performed if a running landing area is not available.

While there are no universally accepted torque settings for an imminent MGB failure procedure, some helicopter training programs recommend that an appropriate emergency descent profile is to fly at the airspeed for which minimum power is required to maintain flight, usually recommending torque values in the range of 15% to 30%, if the situation permits. The airspeed referred to above, commonly known as the bucket speed, is the airspeed where power required due to total drag is at its lowest. This airspeed coincides with a helicopter's maximum rate of climb/maximum endurance airspeed. Another airspeed commonly referred to is the maximum lift over drag (L/D) airspeed, which coincides with the airspeed for which total drag is at a minimum.^{Footnote 86} The maximum L/D airspeed represents a helicopter's best angle of glide airspeed or maximum range in an autorotation. The S-92A RFM MGB malfunction section does not specify a desired descent torque or airspeed to adopt in an imminent MGB failure situation.

The MGB oil system failure procedure on the S-92A includes a confirmation step that applies to a low oil pressure or high oil temperature condition. If the initial indication of problems is a low oil pressure indication, the confirmation step calls for the pilot to verify if the MGB oil temperature is greater than 130°C. Once the confirmation step is complete, the RFM contains a warning, plus several cautions and notes. The warning states the following:

BYP [Bypass] must be selected within 5 seconds after the MGB OIL PRES warning has illuminated to ensure an adequate quantity of oil remains in the gearbox. DO NOT activate BYP [Bypass] if the warning is not illuminated.

This warning in the RFM is followed by a caution that alerts pilots to expect the MGB oil temperature to increase into the red operational range following the activation of the MGB BYP. The caution goes on to state that the temperature increase associated with the activation of the BYP "should not be considered a secondary indication for determination of landing immediately". A subsequent note indicates that MGB oil pressure should stabilize or fluctuate in the range of 5 psi to 25 psi following activation of the MGB BYP. This note also reiterates the fact that gearbox temperature will slowly increase into the red zone (i.e., above 130°C) after the bypass has been activated. The RFM makes no mention of how MGB oil temperature will react to a complete loss of lubricating oil (i.e., that it will be unreliable because it measures ambient temperature inside the MGB case).

The following page in the RFM contains two additional notes. The first note states: "Either a massive MGB oil leak or failure of a MGB oil pump may cause the MGB OIL PRES warning light to illuminate." However, the RFM does not list any additional symptoms of a single MGB pump failure, or an associated emergency response. According to the S-92A PTM, the loss of one pump would make the pressure drop to the lower part of the green range and reach approximately 45 psi. Subsequent to the publication of the PTM, there were instances of S-92A helicopters experiencing a single pump failure with different symptoms than those identified in the PTM. From those occurrences, it was determined that a single pump failure could cause the oil to churn, resulting in fluctuating low oil pressure between 5 psi and 25 psi as well as the possibility of high temperatures in the corresponding accessory and input modules.

The second note highlights the fact that if the red MGB OIL PRES warning message appears, the amber MGB OIL PRES caution message will not be illuminated. Following the verification of symptoms, the confirmation step, a series of one warning, two cautions, and four notes, the emergency actions for a partial loss of oil begin. The first step of the procedure is to select MGB OIL BYP if the red MGB OIL PRES warning message is illuminated. If the amber MGB OIL PRES caution message is illuminated and the MGB pressure is at or above 35 psi, the next step in the RFM is to land as soon as practical. The third step advises the pilot to monitor the MGB oil pressure.

Following step 3, the RFM procedure then addresses a red MGB OIL PRES warning message or caution message with MGB pressure below 35 psi. If these conditions are present, the RFM directs the pilot to descend to the minimum safe altitude. No recommended altitude or airspeed is provided in the RFM to establish the minimum safe altitude. The procedure then calls for the pilot to bring the APU generator online, and to land as soon as possible. After reaching the "land as soon as possible" line in the RFM, the procedure continues by stating:

If the MGB OIL PRES warning or the MGB OIL PRES caution and any of the following secondary indications of gearbox failure are observed:

MGB oil pressure below 5 psi;
Smoke or fumes in the cabin;
Any subsequent hydraulic system failure;
Progressively increasing power required to maintain flight;

Unusual vibrations or noises.

Land immediately

The decision to land or ditch immediately could hinge on the pilots' interpretation of the "land immediately" definition and their assessment of the risks associated with landing immediately versus prolonging flight to reach a more suitable landing area. One possible factor which can influence a pilot's decision-making process is the consideration of a helicopter's run dry capability. If a pilot is concerned that a loss of lubricant may have occurred, knowledge of the run dry capabilities of the aircraft is of critical importance in determining the necessary flight profile to ensure that the helicopter is landed or ditched prior to a potential failure of the MGB or related component failure due to a loss of MGB lubricant.

In the offshore environment, the decision to ditch or prolong flight will weigh heavily on a pilot who must consider the risks of both options. Unless a pilot has had repeated exposure to similarly dangerous situations, the stress of a potential ditching scenario could have a significant adverse effect on his/her ability to properly assess the situation, resulting in less effective and potentially disorganized attempts to consider alternative solutions.^{Footnote 87},^{Footnote 88}

The potential loss of a helicopter at sea can greatly influence a crew's decision, particularly if they are aware of cases where it was later determined that the helicopter could have safely made it to shore. Given the reliability of modern helicopters, it is unlikely for the average pilot to have repeated exposure to potentially dangerous situations such as ditching.^{Footnote 89} In addition, people often succumb to confirmation bias, which causes an individual to attend primarily to the cues that support the most desired course of action, which may be to reach shore.^{Footnote 90} As a result, many helicopter pilots will try and make it to shore, unless faced with compelling indications of a catastrophic failure such as unusual noises and/or vibrations.^{Footnote 91}

In some extreme situations, pilots may find themselves required to make a decision that goes against the formally established procedure because of some type of extenuating circumstance like weather, darkness, or sea state. If a pilot determines that the risk of ditching is so high that prolonging flight is considered a safer option, careful consideration must be given to the flight profile chosen to reach a safe landing spot. While there is no universally accepted flight profile for prolonging flight with a suspected gearbox malfunction, the investigation determined that many helicopter pilots would opt for a "low" and "slow" profile. It is generally accepted that an altitude of 50 to 200 feet agl and an airspeed between 50 and 80 knots (i.e., at or near the bucket airspeed) reduces stresses on a compromised gearbox while still allowing for a rapid controlled ditch at the first indication of an impending gearbox failure.^{Footnote 92}

In Canadian Aviation Safety Board (CASB) occurrence 85-H54001, the pilot of a S-61N lost all the MGB oil while only 17 nm offshore. Recognizing the potential for a MGB failure due to a lack of lubrication, the pilot established the helicopter at 100 feet above the water and 100 knots to keep the helicopter in a position from which it could be rapidly ditched if the situation worsened. When unusual noises and vibrations were experienced, the pilot turned into wind, flared to reduce the helicopter's speed and altitude, and carried out a successful ditching from which everyone survived.

At the time of the occurrence, the RFM did not specify a preferred altitude/airspeed combination when "land immediately" is considered to be too risky and this scenario is not normally covered during training courses.

Suggested profiles for emergency situations are informal procedures that emerge as a result of corporate knowledge passed down from more experienced pilots.^{Footnote 93} In particular, pilots of older generation helicopters seem to have developed such profiles as a function of the age or reliability of the helicopter they flew in the past. When those pilots transitioned to a newer helicopter, they brought knowledge they had gained from their previous airframes. For newer pilots of more modern helicopters, exposure to, and the opportunity to discuss these situations, may be less prevalent than it used to be, due to improvements in modern helicopter safety and reliability.

1.18.1.4 Loss of Tail Rotor Thrust

The S-92A RFM identifies a loss of drive to the tail rotor as one of the possible consequences of a MGB failure. If a complete loss of drive to the tail rotor is experienced on the S-92A, the anti-torque effect of the tail rotor is removed causing the helicopter to yaw right. According to the S-92A RFM, it is impossible to maintain level flight following a loss of tail rotor thrust, and it will produce a sharp, uncommanded right yaw of the helicopter that requires immediate entry into autorotation if at cruise flight. The RFM also indicates that a loss of tail rotor thrust at 60 knots or above may cause roll excursions up to 10°, pitch changes up to 5°, and heading changes up to 50° until the helicopter is established in autorotation. Once in autorotation, the RFM advises that the helicopter can be flown to a stable pitch and roll attitude with an acceptable level of sideslip.

The RFM advises that an "impending tail rotor drive failure may be preceded by excessive noise or vibration from the tail rotor section, often felt by the pilot as a middle frequency ‘buzz' through the rudder pedals."

The RFM identifies the following actions in the event of a loss of tail rotor thrust in forward flight:

1. Enter autorotation;
2. Maintain 80 to 100 knots indicated airspeed;
3. Select the landing gear down; and
4. Select the throttles to STOP prior to touchdown.

1.18.1.5 Helicopter Autorotation

An autorotation is defined as the condition of flight where the main rotor is driven by aerodynamic forces, with no power being delivered by the engine. During an autorotation, the cyclic is used to control the airspeed and the collective is used to control the lift produced by the main rotor (i.e., main rotor rpm). If either or both of these controls are mis-managed during an autorotation, safety margins are reduced. In comparison to single-engine helicopters, the probability of having to conduct an autorotation in a large multi-engine helicopter like the S-92A is extremely low. Likewise, there is an increased risk of injury as well as costly repairs of helicopter components damaged during autorotation practice in these helicopters. Aside from initial certification, it is extremely uncommon to practice autorotations to touchdown for training purposes in large, multi-engine helicopters. Instead, most operators of large multi-engine helicopters restrict autorotations to initial and recurrent simulator training. The S-92A RFM prohibits practice autorotations to touchdown.

Airspeed is the primary control for rate of descent during an autorotation. A note in the S-92A RFM autorotation procedure indicates the minimum rate of descent (2200 to 2400 feet per minute) is attained by maintaining 80 knots indicated airspeed (KIAS) and 100% to 105% Nr. A higher or lower airspeed will result in an increased rate of descent. Proper control of the rate of descent is critical to the safe execution of an autorotative landing. During the autorotative landing phase the helicopter's forward speed and rate of descent are reduced by flaring the aircraft (increasing the nose-up pitch attitude) until the desired touchdown speed is achieved. The main rotor's kinetic energy is then used to minimize the helicopter's rate of descent just prior to touchdown. Performing an autorotation at a speed higher than minimum rate of descent speed, but lower than VNE-AUTO (120 KIAS), will require the crew to use a longer or more aggressive flare to reduce forward speed prior to touchdown - but can be performed safely. Performing an autorotation at a speed lower than the minimum rate of descent speed will provide very little flare effectiveness, resulting in very high rates of descent just prior to touchdown, a rate which may not be possible to reduce to an acceptable level prior to touchdown and could result in large impact forces.

The collective is used to manage rotor rpm in autorotative flight and rotor rpm must be maintained within the normal power-off range. In the S-92A, the maximum allowable Nr during autorotation is 110% and the minimum is 95%. The S-92A also allows a transient minimum Nr of 80%; however, no transient time limit is provided. If the rotor rpm is allowed to build above 110%, the pilot must raise the collective to return the rpm to the normal range. If the rotor rpm decreases below the normal range, the collective must be reduced. If main rotor rpm continues to decrease, the angle of attack of the main rotor blades will eventually increase to the point that they will begin to stall. If the blades enter a stall condition, lift will decrease and drag will increase causing the helicopter's rate of descent to increase rapidly, which further exacerbates the stall condition. As a result, it is critical that pilots avoid a main rotor blade stall condition by remaining within the normal power-off range.

If all the rotor blades stall, it may be impossible to regain a safe rotor speed to carry out the remainder of the autorotation to landing. Accordingly, the RFM warns that rotor rpm "will decay rapidly to an unrecoverable state with resultant loss of helicopter control unless autorotation is entered immediately after a dual engine failure" and that "dual engine failure requires immediate action for a power-off landing." To prevent unnecessary rotor decay when the engine shut-down is initiated by the pilots, the collective should be lowered fully before decreasing the throttles. The RFM also advises that a dual engine failure will cause the helicopter to swing to the left due to the reduction of torque and that "immediate collective reduction is required to maintain Nr within safe limits."

The autorotation procedure in the S-92A RFM, which does not identify any of the steps as memory items, calls for a reduction of collective to maintain 105% Nr and to establish the helicopter between 80 and 100 KIAS. The next steps of the procedure include lowering the gear, shutting off the fuel switches and throttles and then advising the cabin occupants. If time and altitude permit, the RFM procedure suggests attempting to restart one or both of the engines. If a relight proves unsuccessful, the next step in the procedure is to carry out the autorotative landing as per the RFM.

The landing phase of the autorotation is critical. One phenomena that can occur during an autorotation is "ground rush". This produces a sensation in the pilot that the ground is coming up faster than expected and they attempt to slow down this apparent rush towards the ground or water by either flaring early or increasing collective prematurely.^{Footnote 94} This can result in significant rotor energy management issues, and may jeopardize the safe completion of an autorotation landing.

The autorotative landing procedure in the S-92A RFM begins with a note, which advises the pilot that the Nr will droop well below 96% when increasing collective to cushion the autorotative landing. The note continues by stating that this rotor droop will cause the AC generators to drop off line. Unless the APU generator is online, only the battery bus will be available to power the helicopter's electrical systems.

The RFM includes a separate procedure for the landing portion of the autorotation, which also does not identify any of the steps as memory items. The autorotative landing procedure calls for pilots to establish the helicopter at 80 to 100 KIAS in an autorotative glide, with a recommended flare airspeed of 85 KIAS minimum. The procedure also calls for the pilot to maintain Nr at 105%. At 100 feet above ground, the pilot is supposed to execute a flare to decrease airspeed, decrease sink rate, and increase Nr. As the flare begins to lose effectiveness and the helicopter starts to settle, the procedure calls for the pilot to reduce pitch attitude to a maximum of 10° nose up. Prior to ground contact, the collective is to be increased in order to cushion the landing.

There are a number of significant challenges associated with ditching a helicopter at sea and even more for one that has experienced a complete loss of tail rotor thrust. While uncommon, there have been instances where a similar sized helicopter has experienced a loss of tail rotor thrust while flying offshore. In 1995, a Super Puma helicopter, with two pilots and 16 passengers onboard, was involved in offshore flying operations when it was struck by lightning while flying in cloud at 3000 feet asl.^{Footnote 95} The tail rotor gearbox ended up separating from the helicopter. The pilots immediately entered autorotation, secured the engines and successfully ditched the helicopter, accomplishing "a gentle touchdown on the sea, despite six to seven metre waves"^{Footnote 96} and 56 kilometres per hour winds. All occupants successfully evacuated the helicopter into a single 14-man liferaft and were picked up approximately 1 hour after the helicopter was ditched.

1.18.1.6 Comparison of MGB Malfunction Procedures

At the time of the occurrence, Cougar Helicopters was also using the S-61 in the offshore role. Despite significant technological differences between the S-61 and the S-92A, the abnormal and emergency procedures developed by Sikorsky share many similarities. There are however, two notable exceptions. First, the various MGB malfunction procedures for the S-61 included memory items. In the S-92A, memory items were not included in any of the published emergency procedures. In the case of the MGB malfunctions, Sikorsky and the FAA felt that pilots would have time to consult the malfunction procedure before it progressed to an emergency situation. As a result, it was believed that memory items were not necessary. However, while not identified as a memory item in the procedure, pilots were expected to activate the MGB oil bypass switch within 5 seconds of receiving the red MGB OIL PRES warning message. Despite the lack of memory items in S-92A RFM emergency procedures, some S-92A operators have taken it upon themselves to identify memory items in their respective pilot checklists.

The second exception relates to the order in which the abnormal and emergency procedures are laid out. In the S-61, the MGB malfunctions begin with memory items, and then address the most urgent situation, which is the land/ditch immediately scenario. This is consistent with recommended checklist design principles, which encourage designers to place critical emergency actions at the beginning of the procedure because the probability of successfully completing the first items on a checklist is the highest.^{Footnote 97},^{Footnote 98} If the "land immediately" criteria is met, the checklist is complete. However, if the "land immediately" criteria is not met, the emergency procedure continues with additional non-memory steps to determine if a "land as soon as possible" condition exists. In the S-92A, the MGB oil system malfunction procedure first addresses the non-critical conditions, followed by the "land as soon as possible" criteria, and then concludes with "the land immediately" criteria.

1.18.1.7 Cougar Helicopters SOPs

As required by CARs 704.124, Cougar Helicopters has established and maintains SOPs that enable its crew members to operate the helicopter within the limitations specified in the RFM. Accordingly, the S-92A SOPs include communications, crew coordination, use of checklists, and abnormal and emergency procedures. Cougar Helicopters' SOPs contain copies of the checklists, which are further expanded upon within the body of the various chapters of the manual.

Cougar Helicopters' SOPs state that "generally, the only memory procedures are for emergency drills which require immediate action and checks that are typically done in a high workload environment where a memory procedure would be advantageous, as on final approach."^{Footnote 99} Such memory items are indicated in the SOPs by text that is boxed and shaded. In the Cougar Helicopters' SOPs, memory procedures are incorporated in the dual engine failure procedures. There are no memory items in the MGB malfunction section of the Cougar Helicopters' SOPs.

Section 1.12.4 of Cougar Helicopters' SOPs, Radio Procedures - Crew Duties states that "during abnormal operations, in the absence of the PNF, when the PNF is engaged in other duties, or should the PF deem it appropriate, the PF will make any required radio transmission". Furthermore, no transmissions other than safety related transmissions to company organizations are permitted during abnormal or emergency situations except as required to deal with that situation.

From a crew coordination standpoint, Cougar Helicopters' SOPs provide the following guidance: "During the completion of the check portion of an emergency or abnormal procedure the PF should handle the external communication." Once the check has been completed, Cougar Helicopters' SOPs indicate that "the PNF should once again assume responsibility for the handling of external communications."

Chapter 7 of Cougar Helicopters' SOPs also included a number of abnormal and emergency procedures that are addressed in the RFM and the Cougar Helicopters S-92A Pilot Checklist. Minor differences were noted between the RFM and the SOP procedures for the dual engine failure during cruise and the autorotative procedure; however, these differences were inconsequential in the context of this occurrence. There were some significant differences in the MGB malfunction procedure in the SOPs compared to the current version of the RFM at the time of the occurrence. The confirmation step of the procedure in the SOPs included the reference to MGB oil pressure below 35 psi (which was removed from revision 7 of the RFM) in addition to the verification of temperature above 130°C. The procedure in the SOPs included the action steps listed in the RFM, however, the step calling for the activation of bypass if the red MGB OIL PRES warning message appears, is presented after the pilot would reach the "land as soon as possible" line of the procedure.

The latter portion of the MGB malfunction procedure in the SOPs differs significantly from the RFM, concluding with an explanation of the conditions that would warrant a "land as soon as possible" or a "land immediately" condition. In the SOPs, a specific minimum pressure (i.e., 5 psi as per the RFM) is not mentioned, there is no mention of smoke or fumes in the cabin, and there is no mention of a subsequent hydraulic system failure as being symptoms warranting a "land immediately" situation.

1.18.1.8 Cougar Helicopters S-92A Pilot Checklist

In accordance with CAR 602.60(1), flight crews are required to carry a checklist or placard that enables the aircraft to be operated in accordance with the limitations specified in the aircraft flight manual, aircraft operating manual, pilot operating handbook, or equivalent document provided by the manufacturer. The checklist or placard must also include abnormal and emergency procedures. Before a checklist is used, it is reviewed by TC. However, unlike a RFM, checklists do not require TC's approval before they can be used in the cockpit. The intent of the pilot checklist is to ensure that flight crews are able to retrieve the appropriate response quickly and accurately and carry out all the actions to contain and manage an abnormal or emergency situation.^{Footnote 100} Ideally, a checklist helps overcome human processing limitations and helps develop the crew's mental model by directing the pilots' attention to the appropriate systems and by providing recommended procedures to ensure the safety of flight. Checklists should be easy to use, should account for human performance limitations under stress, and should present the information in a logical way. If checklists are not used properly, or there are design flaws, it can lead to serious consequences.

To expedite locating the appropriate checklist response, pilot checklists or quick reference handbooks (QRH) usually have a quick-reference index which the pilot relies on to locate the page or tab number associated with an illuminated caution or warning message. Typically, the legend information is presented in some type of hierarchical or alphabetical order. In some instances, the legend resembles the layout of the annunciator panel to provide the pilot with visual and spatial cues to help them locate the appropriate procedure in a timely manner. If a legend is not provided, or certain caution/warnings are not listed, pilots must locate the appropriate procedure via the table of contents or by flipping through the pages of the checklist. The Cougar Helicopters' S-92A Pilot Checklist was a QRH-style checklist that was divided into sections, with tabs to allow quicker access to a particular section, and an index of lights and messages which was located at the end of the checklist. At the time of the occurrence, it was believed that the first indication of an MGB malfunction would be accompanied by the amber MGB OIL PRES caution message, which would then direct the pilots to the appropriate response. As a result, the red MGB OIL PRES warning message was not included in the legend at the back of the Cougar Helicopters S-92A Pilot Checklist (see Appendix E).

The first procedure listed in the Cougar Helicopters' S-92A Pilot Checklist is the Emergency Descent - Power On procedure. That procedure consists of a series of steps designed to expedite a descent from altitude during an emergency that may require an immediate landing or ditching. To ensure timeliness, the procedure begins with two memory items. The first memory item requires the pilot to descend as required at 80 knots. The second step is to make a mayday call to the appropriate controlling agency. These two memory items are clearly identified as such by a box encompassing the two steps. Once the first two items are completed, the remainder of the procedure focuses on preparing the crew to ditch the helicopter, or to be in a position where a rapid controlled ditching would be possible if required (see Figure 11).

While a RFM takes precedence over a pilot checklist and SOPs, pilots typically rely on the checklist when responding to abnormal and emergency situations. At the time of the occurrence, Revision 2 of the Cougar Helicopters S-92A Pilot Checklist (published in October 2007) was the one in use at Cougar Helicopters. Revision 2 of the S-92A Pilot Checklist had not been updated to include the changes associated with RFM Revisions 7 and 8 issued in April and October 2008, respectively. In particular, like the SOPs, the MGB malfunction procedure in the S-92A Pilot Checklist in effect at the time of the occurrence also contained the step of confirming MGB oil pressure below 35 psi, which had been removed in revision 7 of the RFM. In addition, the Pilot Checklist did not include four of the notes mentioned in the RFM, and it did not include changes to the actions for a "land as soon as practical" situation.

1.18.1.9 CHI91 Flight Crew Emergency Handling

This section examines the issues surrounding the flight crew's emergency handling, the crew's reaction to the MGB oil pressure warning, the decision to level off at 800 feet, the response to the loss of tail rotor thrust, and the eventual autorotation.

At 0945:14, upon receiving the red MGB OIL PRES warning message and aural alert, the autopilot was immediately disconnected, the helicopter was turned back towards St. John's, and a descent out of 9000 feet asl was started. Shortly thereafter, the PF requested the emergency procedure from the S-92A Pilot Checklist. During the first 50 seconds of the descent, the torque averaged 51% and the airspeed averaged approximately 100 knots. This is contrary to the first step of the Cougar Helicopters' Emergency Descent - Power On procedure, which identified 80 knots as a memory item (see Figure 11). The collective was lowered further, adopting a descent profile of approximately 32% torque and accelerated to 120 KIAS towards CYYT, on an assigned heading of 305° M. This produced a rate of descent of approximately 1800 feet per minute (fpm), which was maintained until the helicopter reached 6500 feet asl. Descending through 6500 feet asl, torque was applied and began increasing steadily until it reached approximately 40% just prior to levelling off at 800 feet asl. Between 4000 and 2000 feet asl, the rate of descent was approximately 1300 fpm. As the helicopter descended through 2000 feet asl, until it levelled off at 800 feet asl, the helicopter's rate of descent decreased to approximately 1000 fpm.

At 0945:21, the PF mentioned the bypass; however, instead of activating the oil bypass at that time, he first declared a mayday to Gander ACC, and then advised them of the nature of their emergency. Immediately thereafter, the PF relayed the same information to the Cougar dispatch centre. Following this, the first officer suggested that they slow themselves down. Communications then continued with ATC, and the captain advised ATC that they needed to be as close to the surface as possible in case of catastrophic failure. The captain also indicated that they were heading for the closest landfall and mentioned Cape Spear. The captain later returned to the MGB oil bypass switch, activating it approximately 77 seconds after the illumination of the red MGB OIL PRES warning message.

As they descended, there were difficulties locating the appropriate checklist page. These difficulties were communicated; however, no verbal assistance nor a transfer of control to expedite the locating of the appropriate emergency response was provided. Instead, the PF indicated that he was going to brief the passengers. However, instead of making the announcement, there was a series of communication exchanges with ATC. Two minutes and 41 seconds after the red MGB OIL PRES warning message appeared the first officer indicated that he had located the appropriate page for the procedure. During these efforts to locate the appropriate response, there was no mention of the RFMs, which were located in holders behind each crew seat, nor were there any positive indications that a RFM was consulted during the emergency response.

The procedure read by the first officer included the confirmation step (i.e., MGB oil pressure below 35 psi) that had been deleted from the RFM in effect at the time of the occurrence. The procedure also did not coincide with the current version of Cougar Helicopters' S-92A Pilot Checklist or Cougar Helicopters' SOPs. Cougar Helicopters' COM section 6.11 Aircraft Checklists states that:

Flight crews will use the checklist provided and where no checklist is provided, they are to follow the normal, emergency and abnormal procedures contained in the approved Aircraft Flight Manual. All multi-engine aircraft will have a company checklist.

In addition to verifying the MGB oil pressure, the confirmation step was completed to confirm whether or not the MGB oil temperature was greater than 130°C. The PNF indicated that the MGB oil temperature was normal, and that the problem could be related to a sensor. The PF acknowledged this as a possibility; however, they continued with the procedure just in case it was not the sensor.

At 0948:12, the PNF read the warning calling for the activation of the bypass within 5 seconds of the illumination of the red MGB OIL PRES warning message. Both pilots acknowledged that this action had been completed.

At 0948:32, there was continued reading of the procedure, stating that the temperature should increase following activation of the bypass. Shortly thereafter, the PNF mentioned that the oil pressure should stabilize or fluctuate in the range of 5 psi to 25 psi and that the temperature would slowly increase into the red zone. At this point, the PF pointed out that the MGB oil temperature did not increase following the activation of the bypass switch as indicated in the RFM. The PF then reiterated that he believed their indications were related to a sensor malfunction. The pilots did not discuss the fact that the oil temperature was not behaving as expected with the bypass activated.

At 0949:52, the PNF read the note which stated that "a massive MGB oil leak or the failure of a main gearbox oil pump could cause the warning light to illuminate". This is the only reference to a single MGB oil pump failure and no additional guidance is provided in the RFM pertaining to a single MGB oil pump failure. Shortly thereafter, it was suggested that the problem could be due to a pump failure. The crew agreed and a short discussion ensued in which they formulated a theory that they still had MGB oil, and that they only had splash lubrication. At no time did either pilot make reference to the presence of a second MGB oil pump, or their expectations following a single oil pump failure.

Shortly after discussing the possibility of a pump failure, the autopilot was engaged and the helicopter proceeded direct to CYYT. This resulted in a minor course change, taking them north of a direct track to Cape Spear. Based on calculations of the helicopter's flight path after turning around, proceeding direct to CYYT from this position would have taken them approximately 4.5 nm to the north of Cape Spear (see Figure 1).

At 0950:23, with the helicopter descending through 2200 feet asl, the PNF began reading the action steps of the emergency procedure. At 0950:42, the APU was started and brought on-line. As they reached the end of the procedure, the PNF read out the conditions which warranted a "land immediately" situation. As they went through the list of conditions, both pilots identified MGB oil pressure less than 5 psi as being one of the "land immediately" criteria as per the RFM and the S-92A Pilot Checklist. No further reference was made regarding pressure less than 5 psi by the pilots as being a secondary indication of an impending gearbox failure. At 0951:35, approximately 6 minutes and 26 seconds after the red MGB OIL PRES warning message illuminated, the PNF concluded by stating that they were now at "land immediately" in the emergency procedure.

The PF acknowledged the comment about having reached a "land immediately" situation; however, he then indicated his intention to stop the descent at 1000 feet. The PNF acknowledged the decision to stop the descent at 1000 feet asl. The PNF repeated that they were at "land immediately" and that the emergency checklist was complete. At this point, the helicopter began to level at 800 feet asl. Shortly thereafter, the autopilot was disconnected and the PF indicated his intention to hand fly the helicopter. The PF did not respond to the PNF's second declaration that they were now in a "land immediately" situation.

After levelling off, the PF advised the PNF that he believed they had a pump or sensor problem and that he was going to increase power and assess the helicopter's response. The PF continued by stating that, regardless of the response, he wanted to get to shore as fast as possible. The PNF mentioned that they should monitor the situation for secondary indications as a result of the power increase. The power was increased to approximately 73% torque, giving approximately 135 knots airspeed. This combination of torque and airspeed was maintained until the final descent was initiated. There was no indication that the crew had any additional secondary indications, at that time, such as increased power requirements, noise, smell, or vibrations.

The PNF did not firmly question the choice of altitude, power setting, and airspeed. Shortly after levelling off, the PNF lowered the landing gear, after receiving permission to do so. A discussion was initiated by the PNF about optimum power setting and mentioned that power setting was a bit of a trade-off in a situation like this because too much power may accelerate a gearbox failure and not enough may prevent them from reaching shore before the gearbox failed. The PF agreed but did not actively seek out more information from the first officer, nor did he offer any additional insight as to his choice of power setting and airspeed. The PNF then sought to clarify where they were headed, asking if they were still proceeding towards the closest landfall. The PF indicated that their present course would take them by the tip of Cape Spear.

The PNF then made a brief comment that it would take a bit of time to ditch from their present altitude and suggested that they should review the ditching scenario. The captain did not respond to this suggestion. Instead he engaged the autopilot to fly a heading of 290° M, at an altitude of approximately 800 feet asl and a speed of 135 knots. The winds at the time were 210° T at 35 knots, and the static air temperature was −2°C.

The PNF then asked about the "best L/D airspeed" for the S-92A. The PF appeared unfamiliar with that term so the PNF repeated it and explained it. The PF indicated that at this point it did not really matter; the PNF acknowledged. The PF then added that, unless they detected indications of grinding or pounding, he would continue with the flight. Again, the PNF acknowledged. The PF also indicated the only reason that would compel him to carry out a ditching would be if the helicopter started to come apart.

A radio discussion began with one of the senior company pilots that had proceeded to the Cougar dispatch centre to see if the crew of CHI91 required any additional assistance. During that communication exchange, the PF indicated that he suspected they had experienced a pump failure. This assessment was based on the fact that while the oil pressure indicator was at zero, the oil temperature indication had not increased and was still indicating normal operating temperatures. It was also indicated that they were headed directly for the closest landfall, in the event that the situation would deteriorate. The pilot in the Cougar dispatch centre acknowledged the information and added that the temperature would increase if the MGB oil bypass switch was selected. The PF acknowledged. The pilot in the Cougar dispatch centre then suggested that they review the emergency descent and ditching checklist to ensure that they would be ready for that eventuality.

At 0955:15, the main rotor rpm fluctuated between 103% and 107%. The PF, who was communicating with the Cougar dispatch centre, transmitted that they were ditching. No additional detail as to why they had decided, or were forced, to initiate ditching was provided. The collective was reduced from 73% to 50% torque and a descent from 800 feet asl was initiated. At 0955:22, the collective was further reduced to 34% torque and the pitch was increased to approximately 6 degrees nose up. At this point, with the helicopter approximately 35 nm from CYYT, CHI91's airspeed was approximately 122 KIAS (117 knots groundspeed) and decreasing slowly.

At 0955:25, the helicopter experienced a momentary right yaw, reaching a rate of 1.7 degrees per second, which may have been a yaw kick.^{Footnote 102} Two seconds later, the collective was lowered to a position that would provide approximately 17% torque, left cyclic was applied as well as left anti-torque pedal. The helicopter then began a left turn which reached a maximum of 19 degrees of bank before starting to decrease. The pedals were then neutralized and right cyclic was applied. The collective was also lowered further, resulting in torque values of approximately 6%. During this time, the pitch attitude stabilized at 11 degrees nose-up for approximately 3 seconds, and then momentarily increased to 14 degrees nose-up before it began to decrease. At 0955:34, the helicopter briefly stabilized on a heading of 265° M. At 0955:36, the first officer advised ATC they were preparing to ditch. Descending through 600 feet asl, the helicopter's airspeed was 90 knots (74 knots groundspeed) and decreasing, and torque had increased to 17%.

At 0955:37, the helicopter commenced a roll to the right with a corresponding yaw to the right at a rate of approximately 3.5 degrees per second. The bank angle reached approximately 9 degrees right, with a nose-up attitude of 2 degrees. Left cyclic and left pedal were applied, which caused the helicopter bank angle to reduce towards level flight. Within 2 seconds of the right yaw onset, the collective was raised from approximately 17% to 34% torque. At 0955:39, as the helicopter descended through 500 feet asl, the rate of descent reached approximately 1200 feet per minute. Over the next 7 seconds, the rate of descent decreased to approximately 600 feet per minute, while the groundspeed increased to 84 knots.

At 0955:44, right yaw increased significantly from 3.5 degrees per second to 20 degrees per second over a span of 3 seconds. At the time, the computed airspeed was 84 knots, torque was 32%, and the helicopter was at 475 feet asl. Full left pedal was applied and left cyclic was applied. The helicopter rolled left, momentarily reaching 10 degrees of bank. Within 2 seconds of the yaw excursion, the helicopter briefly pitched from 3 degrees nose-up to 9 degrees nose-up and the heading continued to increase with an increasing rate of right yaw. During the nose-up attitude change, there was an aggressive forward cyclic input, which was immediately followed by an aft cyclic movement that stopped at slightly forward of neutral. This movement reduced the pitch from 9 degrees nose-up to 3 degrees nose-down. During the left roll, lateral cyclic was changed from a left cyclic input to a significant right cyclic input, which was immediately followed by a rapid roll to the right. The airspeed at the time was approximately 80 knots.

At 0955:47, approximately 3 seconds after the loss of drive to the tail rotor, both of the helicopter's engines were shut down, reaching 0% within 2 seconds. Immediately following the engine shut-down, the collective was raised and maintained for just less than 2 seconds at a position that would have equated to approximately 40% to 50% torque had both engines been operating. This caused the main rotor rpm to quickly decrease from 105% to 95%. The collective was then rapidly lowered indicating the initiation of an autorotation, and main rotor rpm briefly recovered back to 105%. As the helicopter entered autorotation, airspeed slowed to 75 knots and the rotor rpm decreased to 98%. The helicopter was approximately 425 feet asl, descending, and passing through a heading of 340° M. For the next couple of seconds, the helicopter experienced some minor pitch changes and continued to roll to the right, reaching a maximum of 57 degrees of bank. As the helicopter heading passed through 360° M, the indicated airspeed dropped rapidly below 60 KIAS, while the groundspeed remained at approximately 54 knots. With the collective full-down, the rotor rpm increased, briefly recovering to 105%. At approximately 400 feet asl, the collective was raised briefly, causing the main rotor rpm to droop from 105%. The rotor rpm never recovered fully after this point and the rate of descent began increasing rapidly from 1000 fpm. The collective was subsequently lowered and then raised slightly, causing the main rotor rpm to stabilize briefly at 92%. During the yaw-induced right turn, the cyclic movements were mostly displaced left and forward. The yaw to the right continued, stopping at approximately 023° M. This placed the helicopter in a downwind condition with about 32 knots^{Footnote 103} of wind from behind prior to the flare and landing portion of the autorotation. During the right turn, the first officer was heard on the ATC frequency providing encouragement to the captain.

After approximately 6 seconds, the pilots managed to recover from the pitch and roll excursions that occurred following the initiation of the autorotation, gradually rolling back towards level as it descended through 250 feet asl. Approximately 220 feet above the water, at 0955:54, the collective was raised, followed quickly by the application of aft cyclic. The nose of the helicopter then pitched up from 10 degrees nose-down to 2 degrees nose-down. The rate of descent at the time was 3800 feet per minute and main rotor rpm increased slightly to 93%. The heading had stabilized at approximately 018° M, with airspeed below reliably measured levels.

At 0955:55, while passing through a calculated height of 163 feet asl, further aft cyclic was applied to increase the helicopter's pitch attitude and collective input was progressively increased until full-up collective was applied. During this time, the main rotor rpm began to decrease rapidly from 93%. Just prior to 90 feet asl, the first officer was overheard on the ATC frequency encouraging the captain and then verbalizing the low rotor rpm condition. At 90 feet, the main rotor rpm was recorded at 81% and decreasing. The helicopter pitch and roll attitudes had changed from 2 degrees nose-down and 55 degrees right bank, to the final values of 19 degrees nose-up and 2 degrees right bank on a heading of 007° M. During the final pitch up and application of collective, the calculated rate of descent had decreased while the groundspeed had increased, reaching final recorded values of approximately 2300 feet per minute and 66 knots respectively. At 0955:57, as the helicopter descended through 90 feet asl, flight data stopped being recorded.

1.18.2 Crew Resource Management Training

1.18.2.1 Objective of CRM

The objective of CRM in aviation is to reduce human error by providing flight crews with a variety of strategies to help improve their effectiveness. A widely accepted definition of CRM is the effective use of all human, hardware, and information resources available to the flight crew to ensure safe and efficient flight operations. Unlike traditional training programs focused on technical knowledge and skills required to fly an aircraft, CRM focuses on critical cognitive and interpersonal skills. Research has shown that pilots with recent CRM training are better able to handle novel situations than crews without recent CRM training.^{Footnote 104} Recent CRM training is important because the skills and attitudes gained during initial CRM training tend to fade in the absence of positive reinforcement through recurrent training and routine feedback during training and operations.

1.18.2.2 CRM Regulation in Canada

In 1995, the TSB issued Recommendation A95-11 which called for TC to establish guidelines for CRM and decision-making training for all operators and aircrew involved in commercial aviation. TC's response to this TSB Recommendation only targeted 705 operators and did not include 703 and 704 operators. Consequently, the TSB assessment of TC's response was Satisfactory in Part.^{Footnote 105}

As per TC's action in response to TSB Recommendation A95-11, CRM training is required by regulation only for CAR 705 airline category operations, a distinction that is governed solely by aircraft size and capacity rather than complexity of operation, or number of crewmembers. On 10 October 1996, this requirement came into effect as Commercial Air Service Standard (CASS) 725.124(39) Crew Resource Management Training. Following the introduction of this Standard, TC's System Safety program engaged in the delivery of Pilot Decision Making (PDM), Crew Resource Management (CRM), Human Performance in Aviation Maintenance (HPIAM), and Company Aviation Safety Officer (CASO) workshops. Effective 01 April 2003, TC discontinued the delivery of these workshops, announcing in Aviation Safety Letter (ASL) 1/2003, that TC was refocusing its "resources to those activities with the greatest safety benefit". The ASL further stated that System Safety was refocusing "energies and resources to meet new priorities and address evolving issues and directions, such as safety management system (SMS) and initiatives to reduce runway incursions." Following this announcement, in 2004, the title of the Standard was amended to CASS 725.124(39) Crew Resource Management Training for Crew Members to broaden the scope beyond pilots. The remainder of this standard has not been amended since its inception in 1996.

While there are a number of subjects listed in the standard, the content to be covered in each subject area is not prescribed. In addition, there is no overarching framework which determines the order in which material is presented, as each module can be presented as a stand-alone training module. The CRM topics may be covered in any order, based on the preference of the individual(s) conducting the training.^{Footnote 106}

CAR 705 operators are required to have their CRM course, whether acquired commercially or developed internally, approved by their Regional TC Office. This approval involves comparing the proposed modules to the topics in CASS 725.124(39). However, individuals who conduct CRM training are not required to undergo any type of formal training or accreditation process. The CRM training course, developed by TC, states that it meets the CASS 725.124(39) and is often used as the template for initial CRM training. This training package was created in the mid-1990s, with the emergence of the regulatory requirement for CAR 705 operators to conduct CRM training.

Despite the many similarities that exist among all commercial operators, CAR 703 and 704 operators are not subject to CASS 725.124(39), and therefore are not required by regulation to conduct CRM training. Recognizing the benefits of CRM training, many CAR 703 and 704 operators voluntarily conduct CRM training within their organizations.^{Footnote 107} Since these operators are not subject to the same regulatory requirements as CAR 705 operators, there is little oversight of these internal initiatives. Smaller companies with limited resources often find themselves seeking outside assistance to develop the training. In many cases, operators purchase generic "off-the-shelf" CRM training packages, but these generic off-the-shelf packages cannot address many of the unique challenges a pilot may encounter while flying with a particular operator.

On 09 October 2009, the TSB issued Recommendation A09-02 which stated:

The Department of Transport require commercial air operators to provide contemporary crew resource management (CRM) training for Canadian Aviation Regulations (CARs) subpart 703 air taxi and CARs subpart 704 commuter pilots.

On 13 January 2010, the following response was received from TC:

Transport Canada has accepted the recommendation in principle and in accordance with the Cabinet Directive on Streamlining Regulations (CDSR), the rule making process will commence with a more detailed risk assessment. Transport Canada is expecting to present the risk assessment and supporting recommendation to the Civil Aviation Regulatory Committee (CARC) in the spring of 2010. The resulting recommendation from CARC will trigger the rulemaking process.

As a result, TC's response to Recommendation A09-02 was assessed as Satisfactory Intent. TC was unable to meet the timeline established in its 13 January 2010 response to the TSB. TC has since advised a "Risk Assessment on CRM Training for 703 & 704 Pilots" was accepted by the CARC on 27 October 2010. The CARC Decision Record included the following decisions:

• Develop a contemporary CRM training standard for CAR 703 and 704 operations
• Increase proactive and reactive random surveillance
• Provide incentives to training providers to increase the availability of CRM training and
• Develop contemporary CRM guidance material for operators, pilots and TC inspectors, as well as training standards for CRM training providers.

The National Transportation Safety Board (NTSB) recently identified the need to improve CRM training as one of its top aviation-related safety concerns.^{Footnote 108} The NTSB has called for CRM training to be required by regulation for all commuter and on-demand air taxi flight crews. On 01 May 2009, the FAA responded by issuing a notice of proposed rulemaking (NPRM) which would require Part 135 operators^{Footnote 109} to provide CRM training to all crewmembers, including pilots and flight attendants.^{Footnote 110}

Despite the fact that CRM regulation in Canada has gone largely unchanged since its inception, there have been some developments in CRM. Three such examples are the Advanced Qualification Program (AQP), the Approved Check Pilot (ACP) program, and the Multi-crew Pilot Licence (MPL). The AQP program involves a systematic approach to proficiency-based training and evaluation, which focuses heavily on CRM, including threat and error management. The Approved Check Pilot (ACP) delegates authorized individuals to conduct flight checks, directing them to focus on threat and error management strategies and performance. Lastly, the MPL is a new competency-based pilot training program that identifies threat and error management as an over-arching pilot competency required for effective multi-crew operations. In addition to these developments, Transport Canada has produced several articles in its Aviation Safety Letter that highlight CRM issues and communicate the benefits of CRM as a tool in preventing aviation occurrences. Often these articles build upon findings identified in TSB aviation accident reports.

1.18.2.3 CRM Training at Cougar Helicopters

Despite the lack of regulation requiring CRM training for 703 and 704 operators, Cougar Helicopters voluntarily implemented pilot CRM training in 2005, to enhance safety and to increase flight crew effectiveness. Cougar Helicopters' CRM effort included initial and recurrent training sessions. These requirements were not included in Cougar Helicopters' COM. Initial CRM sessions were conducted at a workshop in St. John's and the intent was that pilots would participate in internal CRM workshops every 2 years. Recurrent CRM sessions were completed during annual simulator recurrent training conducted by FSI. As part of their recurrent simulator sessions, each pilot's CRM skills were evaluated by FSI personnel and recorded on their training records.

To take advantage of a readily available resource, the initial round of CRM training was a day and a half long workshop provided by an air ambulance pilot from Cougar Helicopters' parent company. The training was well received by pilots; however, the sessions were oriented primarily towards the challenges associated with the air ambulance environment. Following this initial round of CRM training, Cougar Helicopters determined that it needed to hire a pilot with the necessary qualifications and experience in CRM training to develop an in-house CRM solution. However, at the time of the occurrence, an individual had not been hired to fill this role.

As an interim measure, on 15 and 16 November 2008, Cougar Helicopters arranged a 2-day CRM workshop. Both occurrence pilots were out of the country at the time and did not attend the workshop, which covered all the required items listed in CASS 725.124(39). It was largely designed to increase awareness of human performance issues and relied heavily on accident case studies to show human performance breakdowns. The workshop did not focus on providing participants with practical CRM decision making and communication tools (i.e., models and/or strategies) that could be easily transferred into a procedurally structured multi-crew environment. The instructor who conducted the workshop had not received any formal CRM facilitator/instructor training or accreditation to provide CRM training, nor was it required by regulation.

A review of the captain's training record showed that he last attended a Cougar CRM training workshop on 26 September 2005, presented in conjunction with PDM training. This training session was presented by the air ambulance pilot from Cougar Helicopters' parent company. Training records from FSI indicate that the captain completed a 2-hour CRM recurrent training session on 05 January 2009. During that 2-hour session, general operational subjects were covered, including seven CRM elements. In addition, the 2-hour session also included training on flight planning, weight and balance, performance, and the approved RFM.

A review of the first officer's training record showed that he had not participated in initial CRM training or PDM at Cougar Helicopters. However, the first officer had received the Canadian Forces' Human Performance in Military Aviation (HPMA) training while a member of the CF. Training records from FSI indicated that the first officer received 2 hours of CRM training during the S-92A initial conversion course, completed in May 2008.

The CRM module provided by FSI was reviewed during the TSB investigation. The FSI CRM module presented during recurrent training was an abbreviated CRM course, and consisted of an overview of the goals of CRM, clues to a loss of situational awareness, leadership styles, the communication process, and an 8-step decision-making process. The content was consistent with earlier generation CRM training courses (i.e., generations 2-3), which focussed largely on increasing awareness of CRM concepts. Due to the scope of the FSI CRM module and the allocated time, the course presented during S-92A initial and recurrent training did not meet, nor was it intended or required to meet, the requirements listed in CASS 725.124(39).

1.18.2.4 Evolution of CRM

The origins of CRM can be traced back to 1979, following the NASA-sponsored Resource Management on the Flightdeck workshop which identified human error as the main cause of several high-profile accidents. Since that workshop, several generations of CRM have emerged. Early programs (i.e., first generation) were very modular in nature and were adapted from management training courses which were based heavily on psychology.

In 1986, second generation CRM programs began focusing more on group dynamics and the name changed from "Cockpit" to "Crew" Resource Management. Similar to first generation CRM programs, second generation CRM programs were also presented in a very modular fashion, covering such topics as decision making, team building, briefing strategies, situation awareness and stress management. This generation of CRM saw a shift in attitude towards CRM training, and recognition that CRM should be embedded in all aspects of training and operations.

At around the same time as the second generation CRM programs began, third generation CRM programs emerged which advocated a systems approach to training, broadening the target audience to include other flight crew, dispatchers, and maintenance personnel, and often included discussions about organizational issues such as corporate culture. This generation of CRM also resulted in increased efforts to integrate CRM into training and operations, identifying specific skills and behaviours that would enhance crew coordination, and providing dedicated CRM training to check airman and other personnel responsible for the training, reinforcement, and evaluation of CRM skills and behaviours.

The fourth generation of CRM emerged in the early 1990s when the Federal Aviation Administration initiated the voluntary AQP. AQP gave operators increased flexibility over training to fit the needs of the organization; however, it required operators to provide CRM and line oriented flight training (LOFT) and to integrate CRM into technical training. As a result, there was some movement towards integrating CRM into routine manuals and checklists as well as the evaluation of CRM skills in a simulator environment.

As a result of growing concern that the original focus of CRM had been lost, a fifth generation of CRM has emerged.^{Footnote 111} The International Civil Aviation Organization (ICAO) states that the fundamental purpose of CRM training is "to improve flight safety through the effective use of error management strategies in individual as well as systemic areas of influence" and proposes the integration of threat and error management (TEM) into CRM. The fifth generation of CRM represents a return to the traditional aim of CRM, which is the reduction of human error, which can be defined as an "action or inaction that leads to deviation from crew intentions or situational requirements such as policies, regulations, and standard operating procedures." Error management, in the context of CRM training, is the actions taken either to reduce the probability of errors occurring (error avoidance) or to deal with errors committed either by detecting and correcting them before they have operational impact (error trapping) or to contain and reduce the severity of those that become consequential (error mitigation). Fifth generation CRM programs also include instruction on human performance limitations, and focus on providing strategies to effectively avoid, trap, or mitigate errors that may be encountered during a flight. Previous topics from earlier generations of CRM training are often included in fifth generation programs; however, the modules were aligned with the overall theme of error management.

The latest generation of CRM continues where fifth generation programs left off. Following a series of Line Operations Safety Audits (LOSA) studies, the University of Texas Human Factors Crew Resource Project team found that pilots were often required to manage threats, errors, and undesired aircraft states. TEM advocates the careful analysis of potential hazards and taking the appropriate steps to avoid, trap, or mitigate threats and errors before they lead to an undesired aircraft state. In other words, TEM stresses anticipation, recognition, and recovery as the key principles behind threat and error management.^{Footnote 112} TEM also recognizes the importance of undesired aircraft state management as it represents the last opportunity for flight crews to prevent an adverse outcome.

1.18.2.5 Recent Developments

Research into the field of human factors as it applies to CRM is on-going, and new initiatives continue to emerge. The integration of CRM into training and operations, via clearly defined SOPs, represents a move towards the establishment of CRM processes rather than simply awareness training. Many operators have recognized the importance of LOFT training as an effective way of teaching effective CRM skills because it allows pilots to practice the skills and to receive valuable reinforcement.

In recent years, there has been a move towards increasing focus on decision making during CRM training. This approach views effective decision making as the most important indicator of flight crew success, and traditional CRM subjects presented as processes that assist decision making.

In the UK, the CAA has established a series of stringent accreditation requirements for CRM Instructors (CRMI) and for CRM Instructor Examiners (CRMIE).^{Footnote 113} This accreditation process is designed to help ensure an acceptable standard of CRM instruction and evaluation, as individuals who receive this accreditation must meet a number of experience related pre-requisites, as well as demonstrate that they possess the necessary knowledge and skill to instruct or evaluate CRM before they are permitted to carry out those duties. In the UK, the accreditation process also involves a renewal process to ensure that previously qualified CRMIs and CRMIEs continue to meet the required standard. In Canada, there are no experience, training, or qualification requirements needed to teach CRM.

1.18.2.6 CRM Best Practices

1.18.2.6.1 Task and Workload Management / Emergency Handling

The industry standard for multi-crew aircraft is to designate a pilot flying (PF), who is responsible for controlling the aircraft and a pilot not flying (PNF), who is responsible for handling other crew duties related to radio communications, checklist management, and FMS operation. This division of duties is designed to optimize crew efficiency, prevent task saturation, and avoid confusion regarding in-flight responsibilities.

In an emergency, the appropriate delegation of tasks is critical to maximizing crew effectiveness and ensuring the safety of flight. This is best accomplished by explicitly assigning PF and PNF responsibilities.^{Footnote 114} During an emergency, it is generally accepted that the captain should try to reduce information processing demands by delegating routine tasks to the first officer.^{Footnote 115} Cougar Helicopters' SOPs state that:

For some corrective action it may be appropriate for the PIC [Pilot-in-Command] to pass control to the F/O [First Officer] to more effectively manage the emergency. In many cases, the experience that a PIC possesses may be better utilized in overall management of an abnormal or emergency condition than in the manipulation of flight controls.

This frees up critical mental capacity so a captain can better process cues from the environment, troubleshoot an emergency, work through the appropriate checklist response(s), and coordinate activities inside and outside of the aircraft. If an individual attempts to take on too many responsibilities, critical tasks may be unnecessarily delayed or omitted.

A captain of a multi-crew aircraft must learn to recognize strengths and weaknesses in themselves and others, and delegate tasks to make best use of the available resources. For example, a first officer with extensive experience on an aircraft type will be better able to assist with critical troubleshooting than a first officer with relatively little experience on an aircraft type. However, an inexperienced first officer will likely have little difficulty performing routine flying tasks based on the captain's directions. When faced with an unfamiliar task, such as coordinating an ambiguous checklist response to a potentially critical emergency, inexperienced first officers may quickly find themselves task saturated. This may result in important steps being delayed or omitted, breakdowns in communication, and possibly a reversion to previously learned behaviours from a different aircraft type.

Due to human information processing limitations, pilots must be careful to avoid becoming task saturated. To combat task saturation, tasks must be carefully prioritized, cockpit duties allocated effectively, and distractions managed. One of the most widely recognized philosophies in aviation for the prioritization of tasks is the aviate, navigate, and communicate philosophy. The captain is ultimately responsible for ensuring that this prioritization is maintained, and it is even more critical during an emergency. As stress levels increase, flight crews must remain focused on the critical tasks at hand, ensuring adherence to SOPs, and the timely completion of checklist responses. Of utmost importance during any emergency is the flying of the aircraft, and dealing with immediate emergency actions. If external communication becomes a higher priority than aviate or navigate, safety margins can be reduced significantly.

1.18.2.6.2 Decision Making

Effective decision making involves the accurate understanding of the situation, an appreciation of the implications of the current situation, formulation of a plan(s) and contingencies, followed by the implementation of the best course of action. Equally important is the crew's ability to recognize changes in their situation and to reinitiate the decision-making process to ensure that changes are accounted for, and plans modified accordingly. Failure to adequately consider the potential implications of a situation increases the risk that a decision will produce an adverse outcome that may result in an undesired aircraft state. As stress levels increase, it can adversely impact a pilot's ability to perceive and evaluate cues from the environment and may result in attentional narrowing.^{Footnote 116} In many cases, this attentional narrowing can lead to confirmation bias, which causes people to seek out cues that support the desired course of action, to the possible exclusion of critical cues that may support an alternate, less desirable hypothesis.^{Footnote 117} The danger this presents is that potentially serious outcomes may not be given the appropriate level of consideration when determining the best possible course of action. As a result, it is crucial that pilots consider the worst-case scenario during the decision-making process, particularly when they are handling a potentially serious emergency situation.

Another important aspect of the decision-making process is the concept of shared mental models.^{Footnote 118} An individual's mental model is largely dependent on their understanding of the circumstances, expectations about the future, and past experience. The experience, or knowledge, that persons bring to a situation plays a significant role in their decision-making process. Repeated exposure through practice, instruction, or informal learning such as reading or group discussion, helps prepare an individual for potentially difficult situations such as an in-flight emergency. The more experience an individual has, the more accurate the mental model is likely to be.

In a crew environment, every effort should be made to align mental models. If the crew is unable to align mental models due to differences in personality, communication style, or authority gradient, critical information may not be accounted for when considering the potential implications of a situation and during the formulation of plans and contingencies. From a CRM standpoint, effective communication plays a critical role in the alignment of the crew's mental models. However, these communication skills require practice and reinforcement to be effective, particularly in the stressful environment of an emergency situation.

1.18.2.6.3 Crew Communications

In order to align mental models, increase crew situational awareness (SA), and optimize the decision-making process, crews must be highly effective communicators. This can be a challenge in the cockpit when faced with time pressure, competing priorities, or an inappropriately balanced trans-cockpit authority gradient. Trans-cockpit authority gradient refers to the manner in which the captain and the first officer interact.^{Footnote 119} If individuals of similar experience are paired together, a captain may not be willing to exercise his/her authority or a first officer may be reluctant to speak up for fear of offending the captain. This is referred to as a shallow trans-cockpit authority gradient. If there is a significant difference in the experience levels between a captain and a first officer, or if a captain with a strong personality is paired with a first officer that has a non-assertive personality, a first officer may be reluctant to voice concerns that could potentially enhance safety. This is referred to as a steep trans-cockpit authority gradient.^{Footnote 120} The communication styles that can emerge as a result of individual personalities can impede effective communications if the styles are not compatible. Modern CRM programs highlight barriers to effective communication and provide multiple communication strategies that allow individuals to select the most appropriate strategy depending on the severity of the situation, the time available, and the other person(s) involved in the communication process.

Crew members must feel comfortable in providing input to a captain to assist his decision making. If a steep trans-cockpit authority gradient exists, either due to experience levels or personality types, there is an increased risk that decisions will be made based on incomplete or inaccurate information. Modern CRM training encourages first officers to assert themselves; however, this can be very difficult for certain people. It is generally accepted that crew members should assert themselves when they are unsure of something or there is a genuine concern about the current course of action. Ideally, this begins with non-threatening statements or questions. If those efforts fail to address the concern, then a more assertive approach must be taken. This escalation in communication strategies is difficult for new employees, who may be fearful of career implications. If first officers are expected to assert themselves, they must be provided with the proper level of training in communication escalation strategies and given an opportunity to practice those skills.

A captain must ensure that crew members feel their input is valued by actively seeking out and encouraging open communication. It is important for a captain to recognize that in most cases, inexperienced first officers will be predisposed to use subtle, non-aggressive communication strategies to voice concerns that they are afraid to raise for fear of being wrong, or for being chastised for questioning a more experienced individual. To ensure that a first officer's message has been received and clearly understood, captains should provide timely and relevant feedback. This shows crew members that their input is being considered in the captain's decision-making process. If input from crew members is not acknowledged, the originator of the message may be left with the sense that their input was not important, or that it was incorrect. Feedback helps ensure that all parties to the communication process have a clear understanding of the current situation.

1.18.2.6.4 Standard Operating Procedures (SOPs) and Checklists

Checklists and SOPs are designed to help establish shared mental models and are meant to assist pilot decision making, particularly for infrequent scenarios such as ditching. In essence, SOPs and checklists generally provide pilots with pre-determined successful solutions to various situations by accounting for risk factors that may not be readily apparent to a pilot during an emergency. In most cases, following the procedure laid out in a checklist will provide pilots with the safest possible course of action. However, if checklist discipline is not taught, practiced, and reinforced, there is a danger that pilots will not follow the prescribed procedure when it is needed.

1.18.3 Previous Occurrences and Follow-up Activities

1.18.3.1 Previous MGB Oil Pump Failures

On 26 September 2008, Sikorsky issued SSA-S92-08-006 titled "Rotorcraft Flight Manual Revision for Main Gearbox Malfunctions" to operators of S-92A helicopters. It stated that Sikorsky had been "investigating recent events" involving the S-92A MGB lubrication system and they had "determined that some of the indications for an impending gearbox failure currently listed in the RFM were not representative of the MGB performance/capability during a malfunction. As such, Sikorsky will be removing these items as indications of an impending gearbox failure."

Most notable was the removal of MGB oil pressure less than 5 psi as one of the criteria that warranted a "land immediately" condition. Instead, the SSA provided the following information:

An impending transmission failure may be indicated by:

1. an increase in power required at a constant collective setting;
2. yaw kicks
3. unusual vibrations or unusual noise

Multiple symptoms are a very strong indication of an impending failure.

However, the SSA still made reference to a requirement to

Descend to an altitude from which a landing can be quickly made with minimal power changes and fly at an airspeed for which minimum power is required. Descent should be made at a reduced power setting, but with enough torque to drive the transmission.

In addition, the following guidance was provided in advance of the RFM revision:

The main gearbox temperature and pressure gauges, along with the main gearbox chip detection system, provide the pilot with information to diagnose and take corrective action in the event of a main gearbox malfunction.

The recent events referred to in the SSA included a January 2008 incident where a S-92A operating near Sarawak, Malaysia experienced a MGB input module overheating event which led to a slow oil leak. In this occurrence, the flight crew received indications that they had high MGB oil temperature and low MGB oil pressure, accompanied by a burning smell; so the flight crew elected to carry out a precautionary landing. Prior to this occurrence, in April of 2005, another S-92A in Norway experienced a vespel spline failure in a MGB oil pump drive that presented low MGB oil pressure indications to the flight crew. Only a short distance from an oil platform, the flight crew carried out a precautionary landing. In neither was there any serious damage to the MGB.

This SSA was intended to provide advance notice of forthcoming changes to the RFM. Cougar Helicopters did not distribute information related to SSAs, issued in advance of formal RFM amendments, to its flight crews to ensure that they continued to follow the approved RFM procedures. The investigation determined that the proposed revisions to the RFM outlined in SSA-S92-08-006 did not play a role in the occurrence. Following the accident, the FAA issued a Special Airworthiness Information Bulletin recommending that the procedures proposed in the subject SSA should not be implemented.

1.18.3.2 CHC Helicopter Incident in Western Australia on 02 July 2008

On 02 July 2008, a S-92A helicopter (registration VH-LOH, serial number 920036) operated by Canadian Helicopters Corporation (CHC) Australia was returning from an offshore oil facility en route to Broome, Australia with 2 pilots and 14 passengers onboard. The helicopter had been flying at 6000 feet asl for approximately 90 minutes when there was a red MGB OIL PRES warning message followed by the audio warning "Gearbox Pressure...Gearbox Pressure." The MGB oil pressure was less than 5 psi and decreasing and the MGB oil bypass switch was activated approximately seven seconds after noticing the low oil pressure warning.

The PF, who was the first officer, commenced an immediate descent. The captain elected to continue the non-flying pilot duties to carry out the emergency checklist and to focus on the diagnosis of the problem. It was the flight crew's understanding that the MGB would fail in a progressive manner rather than suddenly. Since the "less than 5 psi" condition coincided with the illumination of the red MGB OIL PRES warning message, the crew did not initially consider the low pressure to be a secondary indication of an impending gearbox failure. In addition, there were no other secondary indications detected and the MGB oil temperature remained below 80°C. This led the crew to respond as if they were in a "land as soon as possible" condition. The rapid drop in oil pressure was so different to their simulator training that they initially believed they had experienced a sensor or indicator problem. However, through collaboration, the pilots realized that the warning and oil pressure indication did not come from a single sensor, eliminating that possibility.

As the crew approached the only suitable landing area nearby, the rate-of-descent was increased and the pilots carried out a landing without further incident approximately seven minutes after the first warning. The captain indicated that if they had been flying over water, and there had been no other secondary indications, he would have continued flight toward land at an altitude of 200 feet agl and an airspeed of 80 knots.

The initial visual examination by CHC maintenance personnel and a Sikorsky field representative revealed that two of the three MGB oil filter bowl studs had fractured and the filter bowl had partially separated from the MGB causing a total loss of oil. One of the failed studs had been repaired on 09 June 2008 (see 1.18.3.4).

A boroscope inspection was subsequently carried out to assess the condition of the internal MGB components. Following this inspection, it was determined that the helicopter was safe to fly to the maintenance base. The MGB was subsequently removed and shipped to Sikorsky on 20 July 2008. The MGB was disassembled, refurbished at a Sikorsky-approved overhaul facility, then returned to service and installed on another helicopter. Based on the information available at the time, the Australian Transport Safety Bureau (ATSB) chose not to investigate and the FDR/CVR data was not retrieved or analyzed.

1.18.3.3 Sikorsky's Safety Management Process

Sikorsky has a safety management program integrated into its operation. This program utilizes several processes to identify hazards and manage risk from preliminary helicopter design, field operations, and the continuing airworthiness program. Once potential hazards are identified, the level of risk is assessed utilizing processes such as: functional hazard assessments; fault tree analysis; failure mode and effects analysis; and common cause analysis.

Sikorsky has many ways of detecting hazards such as operator reports or deficiency trend monitoring. One of Sikorsky's primary sources of hazard identification is its network of field service representatives. Throughout a helicopter's life cycle, Sikorsky assigns a Lead System Safety Engineer who is responsible for providing guidance for safe designs, identifying potential safety hazards, conducting risk assessments, tracking safety hazards, and verifying that risk has been eliminated or properly mitigated. When a mitigation plan is arrived at and a corrective action is put in place, Sikorsky closes the safety process loop by continuing to monitor the outcome of the corrective action. Mitigation decisions for higher-level potential safety hazards are reviewed by an internal Senior Safety Council at Sikorsky.

Sikorsky has the highest-level Organization Designation Authorization^{Footnote 121} issued by the FAA, and works closely with both the Boston Aircraft Certification Office and the Rotorcraft Directorate's Aircraft Evaluation Group in addressing potential safety issues.

1.18.3.4 Previous Maintenance and Follow-up Action

VH-LOH's MGB oil filter bowl had been removed and reinstalled 17 times during the helicopter's total time in service (1233.4 hours). Approximately 58 flight hours before the July 2008 incident, on 09 June 2008, a MGB oil filter bowl mounting stud had fractured during removal of the attachment nut. Because a new stud and the proper tools were not immediately available, after consulting with Sikorsky's local field service representative, CHC carried out a temporary repair, installing a self-locking nut on the fractured stud. The self-locking feature of this nut did not fully engage the shortened length of the fractured stud so a hole was drilled in the nut to lockwire it for security. Although Sikorsky's engineering department was not specifically consulted, no technical objections to the temporary repair were presented by the Sikorsky field service representative.

Following the 02 July 2008 incident, Sikorsky unsuccessfully attempted to have the failed studs returned to them. In the absence of the parts, Sikorsky relied on photographs and written observations to determine if there was an issue that may affect the S-92A fleet. Based on the information that was available at the time, Sikorsky believed that the repair carried out on the stud likely led to the MGB's total loss of lubricant. Even though Sikorsky began a design review of the stud, without their metallurgists examining the studs, they could not positively identify the cause of the failure nor could they conclude if there was an issue that would affect the S-92A fleet.

On 14 July 2008, the Australian Civil Aviation Safety Authority and CHC decided to have the fractured studs inspected by an Australian engineering firm.

On 22 July 2008, the Australian engineering firm examined the studs. Representatives from Sikorsky were not present for this examination. The firm's preliminary conclusion was that the stud fractures were most likely due to overload, probably from over tightening of the nuts. Although the report noted that the examination had not been comprehensive, and recommended that a full metallurgical examination be carried out, the findings appeared to support Sikorsky's belief that the failure was likely due to the CHC maintenance actions.

1.18.3.5 Early Action Taken by Sikorsky

Each week, Sikorsky conducts a webcast with its S-92A operators, covering various topics. These webcasts have very good participation and operators are not hesitant to ask questions or provide comments. On 12 August 2008, Sikorsky's S-92A weekly webcast addressed the CHC incident, stating that while the exact failure mode was still under investigation Sikorsky personnel suggested that extra attention be given to the condition and torque of filter bowl fasteners. They then discussed the field repair as the possible cause of the stud failure. Sikorsky did not receive any feedback about this information from any of its S-92A customers. Cougar Helicopters personnel participated in the 12 August 2008 webcast; however, this incident was not considered a cause for concern since the problem was attributed to another company's field repair.

1.18.3.6 Independent Examination Work in Canada

CHC contracted a Canadian engineering firm to carry out a further examination of the fractured studs from VH-LOH. The Australian Government Civil Aviation Safety Authority (CASA) contacted the TSB and requested that the TSB oversee the examination on its behalf. On the 26-27 August 2008, a TSB investigator, along with Sikorsky and CHC representatives, attended the examination of the fractured studs. The TSB provided examination notes and observations to CASA and the FAA (29 August 2008). Based on the information that was available, the Canadian engineering firm's 25 September 2008 report indicated that two oil filter housing attachment studs failed in a low cycle, one way bending, fatigue mode of progressive cracking. The most probable cause for the stud to fracture was either inadequate preload^{Footnote 122} when the nuts were installed or a loss of preload after the nuts were installed. While the cause of the preload discrepancy could not be positively determined, one possibility that was identified was galling on the titanium studs.

1.18.3.7 Further Analysis and Risk Assessment by Sikorsky

Sikorsky received the failed studs from the CHC occurrence on 04 September 2008. By 09 September 2008, Sikorsky's material laboratory produced its initial results. Even though titanium studs had been successfully used in other MGB oil filter attachments, Sikorsky commenced a review of the use of titanium studs in the S-92A MGB oil filter bowl application. Sikorsky, with FAA consultation, performed a risk assessment and determined that the titanium studs should be replaced by steel studs. However, Sikorsky determined that the immediate risk of a reoccurrence could be mitigated by modifying existing maintenance procedures. By the end of September 2008, Sikorsky began working on S-92A Aircraft Maintenance Manual (AMM) Revision 13.

On 08 October 2008, Sikorsky issued Safety Advisory (SA) SSA-S92-08-007, to advise operators of upcoming changes to the AMM which included an interim enhanced inspection procedure for the removal and installation of the MGB filter bowl assembly. These procedures included an enhanced visual examination of the studs, checking run-off and run-on torques, and mandatory replacement of used nuts with new nuts.

Task 63-24-02-210-001 of Revision 13 of the AMM required a 10x magnifying glass and an inspection mirror. The AMM provided the following direction for the inspection of the gearbox mounting stud threads:

(1) Using magnifying glass and inspection mirror, inspect gearbox mounting studs for damage:

• Galled threads
• Broken threads
• Missing threads
• Flattened threads

NOTE: A slight shininess on stud threads from silver plating on nuts is acceptable.
(2) No damage of any kind is allowed. Contact Sikorsky field representative if any damage is found.

On 05 November 2008, with AMM Revision 13, these enhanced inspection procedures became mandatory industry-wide. As of that date, Sikorsky had not received any reports of damaged MGB oil filter bowl attachment studs nor had any of the operators ordered replacement studs, with the exception of the Australian incident helicopter.

On 20 October 2008, Sikorsky released Engineering Instruction (EI) 92-725-35-080 requiring the replacement of the titanium studs with steel studs. This internal document, issued specifically to address a safety related issue, was effective from that date onward. As a result, titanium studs would no longer be used during the manufacture of new S-92A helicopters, and any failed titanium studs from the field would have to be replaced with steel studs.

On 04 and 09 September 2008 and 04 November 2008, Sikorsky's S-92A weekly webcast provided operators with an update on their investigation into the CHC loss of lubricant incident. Personnel from Cougar Helicopters were online for the 09 September and 04 November webcasts. All three of these webcasts provided information pertaining to the titanium studs. During these webcasts, discussions included the obvious signs of damage (galling) to the stud threads. In addition, Sikorsky recommended that a new nut be used with each installation and they also indicated that work was underway to change the studs from titanium to steel because steel was stronger and more resistant to galling. Some of the operators who participated in the webcasts questioned how the field replacement of the studs would be carried out, asking when the material evaluations would be available and they also requested some general information about the use of titanium versus steel. During the 04 November 2008 webcast one operator indicated they were performing the run-on torque measurement, as described in SSA-S92-08-007, and requested clarification as to the final torque procedure. No comments were received pertaining to the 10X visual examination of the stud threads or to the enhanced inspection procedures.

On 28 January 2009, Sikorsky issued Alert Service Bulletin (ASB) 92-63-014 requiring the replacement of the MGB filter bowl titanium mounting studs with steel studs, within 1250 flight hours or 1 year. The compliance time was based on Sikorsky's assessment of the risk and the time it would take to replace the studs in the field without compromising safety. At the time the ASB was issued, the replacement of the studs was an overhaul facility maintenance action and Sikorsky needed time to develop, validate, and verify the field procedures. Because the enhanced inspections had been mandatory since the release of AMM Revision 13, both Sikorsky and the FAA felt the immediate risk of reoccurrence had been adequately mitigated and would allow continued safe operation during the specified compliance period. In January 2009, there were approximately 80 S-92As in operation worldwide. In addition, the S-92A had been in service for about 6 years prior to the CHC occurrence, which was the first reported instance of a MGB total loss of lubricant related to a stud failure.

1.18.3.8 TSB Examination of CHI91 Filter Bowl Mounting Studs and Nuts

Fatigue initiation was at the minor diameter of the first fully engaged thread on one stud and at the inboard radius of the serrations of the other stud. Fatigue cracking in the first engaged thread of a stud is consistent with insufficient preload causing an excessive vibratory loading to be transmitted to the stud.

Galling was observed on the threads of the occurrence helicopter's studs, as well as on some of the studs removed from other Cougar helicopters. The galling noted on these studs would have been detectable using 10X magnification, and on some studs the damage would have been visible without the aid of magnification (see circled area - Photo 15). The TSB examination suggested that the occurrence nuts and studs had accumulated sufficient galling damage to prevent the correct preload from being applied during installation. The reduced preload led to an increase of the cyclic load experienced by the studs during operation and to initiation and propagation of fatigue cracks. The TSB's examination of new studs found that even though the studs were manufactured with a coating to prevent galling, galling damage developed after the first installation of a nut, and the damage became more severe the more frequently the nut was removed and re-installed. The occurrence helicopter, as well as at least three other Cougar helicopters, had MGB oil filter bowl attachment nuts with a grey paint residue that had been applied when the MGB was manufactured.

1.18.3.9 TSB Examination of Cougar Helicopters' MGB Filter Replacement Practices

On 07 November 2008, Cougar Helicopters inserted AMM Revision 13 into its maintenance computers and acknowledged it by signing off on the revision.^{Footnote 123} Company procedures require that maintenance personnel become aware of AMM revised procedures. Cougar Helicopters maintenance personnel are required to read each new instruction and acknowledge having done so, by signing off on the mandatory "Must Read" board.

At the time of the accident, the nuts that were used on the MGB filter bowl were considered free issue and therefore, if any were used they would not be recorded in the helicopter's maintenance records. Cougar Helicopters relied on a standard industry practice for determining the serviceability of a self locking nut, which is to replace the nut when the self locking feature is no longer effective.

Between the time the occurrence helicopter was manufactured and the accident the helicopter underwent 11 MGB oil filter replacements. During the last two MGB oil filter replacements on the occurrence helicopter, AMM Revision 13 was in effect. At the time of the accident, there was no record of the 10X magnification inspection being performed, nor was there a record of a torque wrench being used to measure the run-off torques on any of Cougar Helicopters' S-92As, even though required by AMM Revision 13. AMM Revision 13 also required the oil filter mounting nuts to be changed at each removal; however, the nuts installed on the occurrence helicopter were original.

When Cougar Helicopters receives an ASB,^{Footnote 124} it looks at the compliance date/hours to determine how quickly it will comply with the work defined. Typically, the priority of an ASB with a 12-month compliance timeline is considered lower than one with a much shorter compliance timeline. Cougar Helicopters ordered the parts and tools to carry out ASB 92-63-014 on 19 February 2009, the parts request form indicated the items were a routine order for base stock and the purchase order stated that the items could be shipped in the next consolidated shipment.

Since the CHC occurrence had been linked to improper maintenance, Cougar placed a lower level of importance on the issue, and this had an influence on the priority of completing ASB 92-63-014. Additionally, as none of the operators participating in the webcast indicated they were having problems with the filter bowl mounting studs, there appeared to be general consensus among the S-92A community that the issue was not urgent.

1.18.3.10 Sikorsky Actions

About 2 months after the filter bowl stud problem was discussed during the Sikorsky webcast, Sikorsky issued SSA-S92-08-007 on 08 October 2008 that stated:

Sikorsky has been advised that an operator experienced the loss of MGB system oil due to a leak at the filter bowl. The investigation revealed that two of the three MGB filter bowl assembly titanium studs had sheared allowing the filter bowl to displace. As a result, Sikorsky is enhancing the current Aircraft Maintenance Manual (AMM) procedures to aid in identifying potentially damaged studs during the removal or installation of the filter bowl. It is recommended that particular attention and care be taken during the removal and installation of the MGB filter bowl assembly to minimize any potential damage to the threaded portions of the mounting studs.

Approximately 3.5 months after the SSA, Sikorsky released ASB 92-63-014 on 28 January 2009 to its customers, which stated:

Undetected damage to an oil filter stud can lead to failure of the stud. Enhanced procedures are being added to the maintenance manual to help identify potentially damaged studs. To further enhance reliability of this connection, the titanium studs are being replaced with steel.^{Footnote 125}

Between 05 November 2008 and 23 March 2009, none of the S-92A operators reported to Sikorsky they had found any damaged studs while performing the enhanced inspection, nor had they contacted Sikorsky to comment on the steps involved with the enhanced procedures.

On 23 March 2009, the FAA issued Emergency AD 2009-07-53 for Sikorsky S-92A helicopters, which required, before further flight, removing all titanium studs that attach the MGB filter bowl assembly to the MGB and replacing them with steel studs. Sikorsky did not receive any reports of damaged studs between issuance of AMM Revision 13 in November 2008 and when AD 2009-07-53 was issued in March 2009. However, it did receive 59 studs from various operators after they had complied with the AD. Sikorsky examined these studs and found that they had varying degrees of galling of the threads, indicating multiple nut removals. Some of the thread damage was visible without the use of magnification. Photo 16 shows a sample of studs returned to Sikorsky, with varying degrees of galling, ranging from coating loss and minor damage to the threads (stud 1), coating loss and moderate damage to the threads (stud 2), to extensive coating loss and severe damage to the threads (stud 3). The thread damage in stud 3 of Photo 16 was visible to the naked eye. Sikorsky could not provide the time-in-service for the returned studs; however, considering the timing of the AMM revision on 05 November 2008 and the issuing of AD 2009-07-53 on 23 March 2009, and the average S-92A utilization times, they would have come from helicopters that had their filter bowls removed at least three times.^{Footnote 126}

1.18.4 Emergency Flotation Systems

1.18.4.1 Background

Offshore oil and gas installations that rely on helicopter flights to transport workers exist around the world. In the North Sea, the United Kingdom (UK) operates some 215 such installations, employing approximately 30 000 workers. By comparison, in Canada, there are presently 7 offshore oil and gas installations with some 2000 workers. Worldwide, there are approximately 2800 offshore platforms on which workers are regularly employed. Between 1976 and 2009, there were 14 fatal helicopter accidents in UK offshore helicopter operations for a total of 136 fatalities. In Canada there has been only one other fatal accident of an offshore helicopter before CHI91.^{Footnote 127} In 2004, there were approximately 20 offshore helicopter accidents reported worldwide.

In October 2008, a study of Canadian registered helicopter accidents into water identified drowning as the leading cause of death, a finding that is consistent with research work published in other countries.^{Footnote 128} Likewise, the UK CAA conducted a study into UK military and world civil helicopter water impacts over the period from 1971 to 1992. In that study, the CAA found that the majority of fatalities in both UK military (83%) and world civil (57%) helicopter impacts on water were attributed to drowning.

1.18.4.2 Adequacy of Emergency Flotation System Requirements for Helicopters

A ditching is described as an emergency landing on water, deliberately executed, with the intent of abandoning the helicopter as soon as practical. Most helicopters currently used in support of the global offshore oil and gas industry, of which the S-92A is one of the most modern, have been certified to accomplish a ditching in accordance with the requirements of FAR 29.801 and the complementary guidance material contained in FAA Advisory Circular AC 29.2C (Amendment 29-12). Accordingly, any helicopter so certified will be equipped with an emergency flotation system (EFS) that provides adequate ditching stability in reasonably probable water conditions of at least sea state 4 WMO.

According to the UK CAA Paper 2005/06 entitled Summary Report on Helicopter Ditching and Crashworthiness Research, a helicopter equipped with EFS, in accordance with the requirements of FAR 29.801, should remain upright to give occupants sufficient time to escape to the life-rafts. Helicopters typically have a high centre of gravity due to the weight of engines and MGB located on the cabin roof. Consequently, there is a strong likelihood that the helicopter will capsize. When helicopters do capsize they invariably turn upside down, leading to complete flooding of the cabin and immersion of all doors and windows. Escape is very difficult because all escape routes are submerged and occupants who do not escape from the cabin within a matter of seconds are likely to drown.

Ditching certification is intended to ensure safe procedures for water entry, floatation stability and trim characteristics and occupant evacuation and survivability characteristics in reasonably probable water conditions (usually sea state 4). However, such helicopters frequently operate over water where conditions exceed sea state 4. A study cited in CAA Paper 2005/06 of wave climates in the northern part of the North Sea, regarded in JAR-OPS 3 as a "hostile environment", indicated that during the entire year sea state 4 will be exceeded 36% of the time and 65% during the period extending from December to February.

Statistics obtained from Environment Canada show that sea state 4 is exceeded in the waters off Newfoundland more often than in the "hostile environment" of the northern North Sea. Specifically, sea state 4 is exceeded approximately 50% of the time over the course of the entire year, and 83% of the time between December and February. By comparison, sea state 6 is far less frequently exceeded; 3.3% over the whole year and 8.9% between December and February.

The CAA presented the findings from its ditching and water impact research to the Joint Aviation Authorities (JAA) Helicopter Offshore Safety and Survivability (HOSS) working group and to the FAA/JAA/Industry Joint Harmonization Working Group on Water Impact, Ditching Design and Crashworthiness Group (WIDDCWG) in 2000. Consequently, both working groups recommended changes to the current JAR/FAR 29 airworthiness requirements that the current interpretation of "reasonably probable water conditions" for ditching equipment certification should be amended to take into account regional climatic sea conditions. Specifically, in a "non-hostile environment", emergency flotation equipment based on sea state 4 was appropriate. However, in a "hostile environment", a higher standard of sea state should be required for ditching equipment certification.

1.18.4.3 EFS Research and Development

A Review of Helicopter Offshore Safety and Survival (RHOSS) was commissioned by the CAA following a March 1992 fatal helicopter accident in the North Sea. The RHOSS Report, published in 1995, distinguished between a ditching, described as a controlled descent (with some measure of warning) into a non-hostile sea, and a crash, which encompassed all uncontrolled or inadvertent impacts with the water, controlled descents into a hostile sea, and a helicopter falling off a heli-deck. Accident statistics indicated that there was no significant difference between the rate of occurrence of survivable impacts on water and ditchings. They concluded that since survivable crashes due to either technical failure or operational error would still occur it would not be reasonable to optimize safety measures entirely in favour of one over the other.

The RHOSS report noted that important safety features such as flotation equipment were specifically designed for a ditching scenario and more needed to be done to improve the prospects of survival after a crash. It stressed the need to improve flotation capabilities after a severe water impact, including the possibility of installing extra flotation devices specifically catered to a crash scenario. Increasing the total number and distribution of flotation units on the helicopter provides additional spin-off benefits by increasing the overall level of redundancy, and hence crashworthiness, of the emergency flotation system.

In 1996, the FAA completed a study titled Survey and Analysis of Rotorcraft Flotation Systems which looked at 67 helicopter water accidents from the NTSB database. The FAA study found that occupants generally survived impact conditions more severe than those defined in the FAA's ditching regulations.

A BMT Fluid Mechanics study published in a Study of Crashworthiness of Helicopter Emergency Flotation Systems (CAA Paper 2001/2) evaluated the variability in water impact loading on typical flotation components over a wide range of possible survivable water impact scenarios and sea conditions. The results showed that in high-impact crashes there is a 30% probability that a conventional helicopter with four flotation units will sink because it does not possess sufficient redundancy to keep the aircraft at the surface in the event of flotation unit failures. The CAA paper identified that a six-float configuration, using additional flotation units installed high on the cabin walls, provided flotation redundancy since they are well protected from all but side impacts. This study also concluded that doubling the design loads (i.e., strength) of a conventional four-float configuration resulted in a 15% improvement in crashworthiness.

The CAA also reported its findings from its ditching and water impact research to the JAA HOSS working group and to the WIDDCWG. Both working groups recommended changes to current JAR/FAR 27 and 29 airworthiness requirements relating to helicopter ditching and water impact crashworthiness. They recommended that the potential benefits of the side-floating helicopter concept should be recognized, and a helicopter type specific design study should be commissioned as support for its further development. However, the WIDDCWG also recommended that structural ditching requirements should not be expanded to consider crashworthiness due to: a) the high variability of the impact loads, and b) impact loads in survivable accidents being too high to design for in a practical manner.

As a result of these recommendations, a Study on Helicopter Ditching and Crashworthiness (EASA.2007.C16) was completed in 2007. The project was to establish the design objective for side-floating flotation devices; to identify the practicalities of the concept by performing an initial design study (retrofit to EC225); to analyse the safety benefit and economic impacts; and to study the technical feasibility of the side floating concept. The final report recommended that floatation systems should be improved to achieve a side-floating attitude to enhance the chances of survival but noted that new EFS developments would have to take place and further research was required. In addition, the report also noted that for the particular installation selected for the initial design study, (retrofit to EC225), the weight penalty of adding additional EFS would be equivalent to removing at least two passengers or an equivalent amount of fuel. Also it would be challenging to reduce the probability of inadvertent EFS deployment in-flight to an acceptable level. Finally, the development costs for an effective retro-fit design of this type were estimated at several million euro. However, EASA noted that other EFS installation arrangements may achieve similar benefits without incurring the penalties to the extent discussed in this study.

1.18.4.4 EFS Component Features and Development

In addition to the research into EFS configurations, the TSB investigation reviewed other EFS initiatives. The EFS system in the S-92A, one of the most modern helicopters certified under FAR 29, was designed to withstand the forces that would be expected under FAR 29.801 for a controlled ditching. Unlike some other modern helicopters that have EFS designed to withstand being deployed in flight at speeds up to 120 knots and to withstand water landing speeds up to 30 knots, the S-92A's EFS is not approved for deployment in flight and the helicopter must be ditched in the water before the EFS is deployed.

1.18.4.5 Independent Power Supply

It is standard practice for helicopter EFS to be powered from the helicopter's emergency bus or directly from the main battery. In some accidents with survivable water impacts flotation systems have failed to activate because the necessary electrical power to fire the pyrotechnic devices (squibs) on the gas supply tanks was disrupted. As a result, the gas is unable to inflate the flotation bags.

An independent power supply to activate the flotation system following a crash landing on the water has been designed and certified to complement current electrical supply systems. This is a small, low mass device designed to be installed a short distance from the squibs, limiting the potential for power loss due to wiring harness damage.

1.18.4.6 Cool Gas Generator Technology

The S-92A's EFS is manufactured by GKN Aerospace. In February 2008, GKN Aerospace announced that it had developed a direct inflation EFS that utilized cool gas generator (CGG) technology. CGG units store gas as an uncompressed solid material in small, lightweight, rugged units instead of the larger pressure vessels currently installed in the S-92A. The CGG unit releases a sufficient amount of gas at ambient temperature, through a controlled reaction, to inflate the EFS bags. These small units, mounted adjacent to the EFS bags, replace the traditional heavy pressure vessels and greatly reduce the length of gas supply line needed. CGG units were evaluated for the S-92A EFS design; however, Sikorsky determined that they were not sufficiently developed to meet S-92A certification requirements.

1.18.5 S-92A MGB Certification

1.18.5.1 Certification Requirements

The certification basis for the S-92A was 14 Code of Federal Regulations Part 29. ^{Footnote 129} According to Part 29.917(b), a design assessment and failure analysis, as per Amendment 29-40, of the entire rotor drive system must be conducted with two purposes. First, it must identify all failures that would prevent continued safe flight or a safe landing. Second, it must identify the means to minimize the likelihood of their occurrence, as far as possible, by a means that is both technically feasible and economically justifiable, as defined in FAA Advisory Circular 29-2C: Certification of Transport Category Rotorcraft (AC 29-2C). The design assessment must include any part necessary to transmit power from the engines to the rotor hubs, including components such as gearboxes, rotor brake assemblies, and supporting bearings for shafting. AC 29-2C also requires that multiple failures be considered in cases where a primary failure is likely to result in a secondary failure.

Part 29.927(c)(1), lubrication system failure, identifies the lubrication system requirements for proper operation of rotor drive systems. The FAA provided the background and explains the purpose of the certification rule in the preamble to the Notice of Proposed Rule Making^{Footnote 130} and the final rule^{Footnote 131}. The preamble for Part 29.927(c)(1) indicates the rule was necessary because both the government and the rotorcraft industry recognized that the certification rules were outdated with the rapidly advancing rotorcraft technology. The FAA explains that Category A aircraft must have significant continued flight capability after a failure of lubrication in order to optimize eventual landing opportunities. (emphasis added)

In developing the rule, the FAA was aware that the rotorcraft industry was able to meet the U.S. military's requirement that a helicopter's rotor drive system must include a ballistically tolerant transmission that, after a projectile impact, will continue to operate for 30 minutes after a total loss of lubricant. Therefore, the FAA believed the rotorcraft industry as a whole could design and manufacture commercial rotor drive systems that would meet higher safety standards. This eventually led to issuing the requirements in 29.927(c)(1), which imposed more realistic rotor drive system lubricant failure conditions for Category A requirements.^{Footnote 132}

This rule, as initially proposed, was very similar to the U.S. military requirement, in that it would require that Category A certified helicopters be able to operate for at least 30 minutes under limited powered operation after the crew recognized they were experiencing a drive system loss of lubricant.

The FAA's Notice of Proposed Rule Making (NPRM) was published on 27 November 1984. For section 29.927(c)(1) Category A rotorcraft the NPRM stated:

It must be shown by tests that each rotor drive system, where the probable failure of any element could result in the loss of lubricant, is capable of continued operation, although not necessarily without damage, for a period of at least 30 minutes at a torque and rotational speed prescribed by the applicant for continued flight, after indication to the flightcrew of the loss of lubricant.

The FAA's Final Rule was published on 02 September 1988. The Final Rule took into account comments received from stakeholders. One commenter had noted that, as proposed, the requirement in paragraph 29.927(c) could be interpreted to preclude credit for auxiliary lubrication systems or to require consideration of lubricant failures to self-lubricated bearings. The FAA stated that this was not intended, and the wording of paragraph (c)(l) was revised to eliminate this possible ambiguity. The proposed rule was therefore modified to require that:

Unless such failures are extremely remote, it must be shown by test that any failure which results in loss of lubricant in any normal use lubrication system will not prevent continued safe operation, although not necessarily without damage, at a torque and rotational speed prescribed by the applicant for continued flight, for at least 30 minutes after perception by the flight crew of the lubrication system failure or loss of lubricant. (emphasis added)

While Part 29.927(c)(1) does not define the term "extremely remote", regulatory documents and industry practices, describe these failure conditions as those not anticipated to occur to each aircraft during its total life but which may occur a few times when considering the total operational life of all aircraft of the type. Where numerical values are used, this is normally interpreted as a probability in the range of 10-7 to 10-9 hours of flight.

AC 29-2C, section AC 29.927, provides applicants with guidance for demonstrating compliance with Part 29.927(c)(1). The explanation in AC 29.927 Amendment 29-17^{Footnote 133} states:

This paragraph prescribes a test which is intended to demonstrate that in the event of a major failure of the lubrication system used on the rotor drive system, no hazardous failure or malfunction will occur in the rotor drive system that will impair the capability of the crew to execute an emergency descent and landing. The lubrication system failure modes of interest usually are limited to failure of external lines, fittings, valves, coolers, etc., of pressure lubricated transmissions and/or gearboxes.

AC 29-2C describes the loss of lubricant test as the capability of the residual oil in the transmission to provide limited lubrication.

At the time of the S-92A certification, the FAA had certified only one helicopter, the McDonnell Douglas Helicopters MD900, to Part 29.927(c)(1). This helicopter met the certification requirements by draining the MGB lubricating oil, leaving only residual oil,^{Footnote 134} and continuing operation for 30 minutes.^{Footnote 135} Therefore, the remoteness of any failure did not need to be considered or determined in this certification process. Up until the S-92A certification process, compliance with Part 29.927(c)(1) was demonstrated by performing the loss of lubricant test using only residual oil on a representative transmission.

1.18.5.2 S-92A MGB Certification Experience

The required design assessment and failure analysis for the S-92A was conducted by Sikorsky, and the results were approved by the FAA. Both Sikorsky and the FAA indicated that a loss of lubricant from the MGB oil filter bowl due to a failure of its attaching fasteners was not considered when performing the initial design assessment based on past service history. This was consistent with industry practices. After the Australian loss of lubricant occurrence, Sikorsky revised the design assessment taking into consideration the MGB oil filter bowl assembly and attaching fasteners.

Throughout the S-92A's development, Sikorsky and the FAA expected that, based on the similarities between the S-92A's MGB and the Sikorsky S-60 Black Hawk's MGB, the S-92A's MGB would successfully operate for 30 minutes after draining the lubricating oil. The FAA indicated that the initial test was thought to be a low risk test, and Sikorsky scheduled it very late in the overall S-92A certification program.

On 06 August 2002, Sikorsky carried out its initial certification loss of lubricant test by draining the MGB and using only the remaining residual oil (approximately 1.3 gallons) then continuing operation in accordance with the requirements of AC 29-2C.^{Footnote 136} The purpose of this test, outlined in the test documentation, was to demonstrate that the S-92A transmission could provide, "continued safe operation for a minimum of 30 minutes following a complete loss of lubricating oil in accordance with the requirements of FAR 29.927(c)(1)."

The MGB suffered a catastrophic failure about 11 minutes after the test was started. The root cause for the loss of drive was determined to be the complete loss of teeth from the sun gear due to excessive temperature caused by lack of lubrication.

1.18.5.3 S-92A MGB Certification with Oil Cooler Bypass

Following the loss of lubricant test resulting in catastrophic failure, instead of taking steps to redesign the transmission to provide a 30 minute run dry capability for the MGB, Sikorsky re-visited the requirements of Part 29.927(c)(1). Relying on guidance from AC 29-2C and the FAA Rotorcraft Directorate, Sikorsky and the FAA concluded that, except for a potential failure of the oil cooler and its exterior plumbing, all other MGB failures leading to a total loss of oil were extremely remote. Neither the FAA nor Sikorsky specifically considered a failure in the MGB oil filter bowl assembly, or its attaching fasteners, in the context of Part 29.927(c)(1).

In considering what "extremely remote" might mean in the context of Part 29.927(c)(1), Sikorsky and the FAA looked at what they considered to be reasonable criteria. They looked at factors such as excess strength, very low loads, historical data that included the service history of the Black Hawk, and by having these criteria reviewed by a number of different persons at both Sikorsky and the FAA.

Because there was still a possibility that a component in the oil cooling system might leak, the MGB lubrication system was redesigned to incorporate a bypass valve. The loss of lubricant test was repeated on 16 November 2002 with the bypass system installed. The test's purpose was to demonstrate that the S-92A MGB could provide:

continued safe operation for a minimum of 30 minutes following perception from the flight crew of loss of lubricating oil in accordance with the requirements of FAR 29.927(c)(1).

This test was carried out by draining oil from a leak in the oil cooler system. The leak was isolated and further oil loss was prevented when the bypass valve was activated. About 4.3 gallons or 40% of the maximum oil quantity remained in the MGB. The test was repeated five times and at the end of this testing the MGB displayed no indication of loss of drive or impending seizure, and the MGB was able to be turned by hand.

A bypass valve had not previously been used as a method of maintaining an oil reserve to meet the loss of lubricant requirements of Part 29.927(c)(1). However, the FAA considered it to be consistent with the typical failure modes of interest identified in AC 29-2C.

It is required that the pilot activate the bypass valve within 5 seconds after MGB OIL PRES warning has illuminated.

On 17 December 2002, the S-92A helicopter received Category A certification approval in the United States by the FAA.

1.18.5.4 S-92A MGB Certification Validation by the Joint Airworthiness Authorities (JAA)

EASA indicated that applicants in its jurisdiction normally complied with Part 29.927(c)(1) by draining the MGB and continuing operation with only residual oil. Prior to the S-92A certification validation it had already tested and certified at least four helicopters using this criterion.

During its S-92A validation project the JAA considered that "extremely remote" had been met in the context of JAR 29.927(c) (equivalent to FAR Part 29.927(c)). The JAA accepted Sikorsky's design assessment which did not identify the MGB oil filter bowl's attaching fasteners as a potential source of an oil leak.

Following the initial failure of the MGB assembly to pass the 30-minute loss of lubricant test, Sikorsky notified the JAA of a design change in the main rotor gearbox oil system.The JAA agreed that the MGB oil cooler bypass system provided a good method of allowing continued operation in the event that a leak occurred in a component of this system. However, it required Sikorsky and the FAA to substantiate that all other possible failures of the MGB that could result in a rapid loss of oil were extremely remote. Sikorsky's subsequent submission of an analysis of possible failure modes and their likelihood of occurrence was eventually accepted by JAA as confirming compliance with the requirements of JAR 29.927(c). Sikorsky re-issued the appropriate reports and after extensive discussions with the FAA and the JAA, the JAA accepted Sikorsky's means of compliance and the FAA's determination of compliance. The JAA's decision was based on relevant Black Hawk airworthiness data, the inclusion of the bearing monitoring system in the S-92A basic design configuration, and the assumption that service experience on the S-92A would prove to be similar to, or better than, that of the Black Hawk.

During the JAA's discussions with the FAA, the FAA stated:

The Rotorcraft Flight Manual does not state that the aircraft is capable of 30 minutes of flight after loss of lube. Additionally, there is no requirement to consider other gearbox failures, such as a case failure, as part of compliance to this rule. The intent of the rule is to address the failure of oil coolers and associated exterior plumbing since these areas are the most likely cause of lubrication loss.

On 14 May 2004 the S-92A helicopter received the JAA (Validation) Recommendation and on 08 June 2004, it received the EASA Type Certification.

1.18.5.5 S-92A MGB Certification Validation by Transport Canada

TC has certified the Bell Helicopters 427 and 429 to meet the requirements of AWM 529.927 (equivalent to FAR Part 29.927(c)). The Bell 427 was certified by draining the MGB and continuing operation for 30 minutes with only residual oil. The Bell 429 was determined to be similar to Bell 427 and therefore received approval based on the test results of the Bell 427.

Prior to granting Canadian type certification to a foreign aeronautical product, TC conducts a review of the certification request based on the principles of risk management. In the case of the S-92A certification validation, TC conducted a level 2 airworthiness review^{Footnote 137} which involved an on-site visit by TC specialists to become familiar with the product and to review the manner in which the product complies with the certification requirements. Prior to conducting the review, TC had received all of the Issue Papers^{Footnote 138} raised by FAA. TC has indicated that its foreign product validation policy does not expect its certification specialists to consider third party issue papers. Therefore, TC did not review any concerns identified by the JAA.

TC has indicated that at the time the S-92A was being certified, the MGB oil filter bowl and its attaching fasteners would not have been considered in the context of AWM 529.927. TC expects that the transmission lubricating oil will be drained while the transmission is operating and that the rotorcraft original equipment manufacturer will follow the test procedure in accordance with AC 29-2C. TC did not identify any concerns related to a loss of lubricant in the S-92A's MGB being defined as "extremely remote" even though they expected manufacturers to drain the transmission. TC requires that the applicant demonstrate one successful loss of lubricant test.

TC produced a concern paper which stated that 5 seconds was insufficient for the pilot to engage the MGB oil bypass switch. Requiring the pilot to action a system of this type in such a short time was considered unusual, and TC stated its belief that this function should be automated. Sikorsky's response was to explain that 5 seconds represented the worst-case scenario. TC did not agree with Sikorsky's position. In an effort to mitigate risk, TC requested that Sikorsky provide additional guidance that would help the pilot determine whether the switch was selected quickly enough to trap sufficient oil, and to monitor the health of the transmission in bypass mode. In response, Sikorsky revised the Rotorcraft Flight Manual (RFM) to identify the range of MGB oil temperature and pressure indications pilots should expect to see after the bypass switch had been activated. Sikorsky also identified symptoms which would warrant a "land immediately" situation. TC accepted the RFM revision and on 07 February 2005, the S-92A helicopter was granted a TC type certificate based on a validation of the FAA approval.

1.18.5.6 Run Dry Gearbox Perception

Due to the inherent risk of military operations, the drive system component, which includes the MGB, of many military helicopters are required to meet higher standards for continued operation for a given amount of time after a total loss of lubricant. The standard baseline specifications for the Black Hawk's rotor drive system include a transmission system with 30-minute run dry capability.

Although MGB loss of lubricant capabilities originated from military applications, there is a perception in some parts of the aviation community that helicopters that meet the certification requirements of Part 29.927(c)(1) will have a MGB which has a 30 minute run dry capability. This perception is fostered by numerous sources such as manufacturers' brochures, websites, magazines, and trade journals. Often, these information sources are not verified, or approved, by the applicable aircraft manufacturer.

When it comes to the performance specifications of an aircraft, the manufacturer's aircraft or rotorcraft flight manual, and no other document, is the only authoritative source. In some cases, manufacturers include the maximum expected operation time of a MGB following a loss of lubricant. For example, the EC155B Flight Manual states that "landing must be accomplished within 25 minutes" following the appearance of a low MGB oil pressure indication. Likewise, the EC225LP Flight Manual identifies a maximum flight time of 30 minutes following a loss of MGB lubricant. In contrast, the S-92A RFM does not contain any information regarding how long the MGB could continue operating following a total loss of lubricant.

Even though the term "run dry" is not used in the FAR/AWM/JAR publications or their associated advisory material, it was noted that the FAA, TC, and the JAA used the term informally when discussing the requirements of Part 29.927(c)(1). With the exception of the S-92A, all other Category A helicopters certified by the FAA, the JAA, and TC to Part 29.927(c)(1), or its equivalent, have met the requirements by draining the MGB then continuing operation using only residual oil for 30 minutes.

1.18.5.7 Marketing of the S-92A

The Sikorsky S-92A program start-up was formally announced at the Paris Air Show in 1995. From the first announcement, the new design was promoted as providing unprecedented levels of safety and reliability.

Sikorsky published a technical brochure for the new helicopter in April 1998 to highlight its features and performance to potential buyers. The brochure identified one of the S-92A's safety features as a "30 minute run-dry drive system". This brochure was published well before any certification testing in 2000. During this period, Sikorsky marketing presentations to prospective buyers of the S-92A also indicated it would be capable of safe MGB operation for 30 minutes following a total loss of oil.

In the 1998/1999 edition of Jane's All the World Aircraft, a well known aviation publication listing aircraft technical specifications, the S-92A transmission was described as a compound planetary gearbox with a 30-minute run dry capability. This information came directly from technical journals and marketing brochures since aircraft specifications are neither supplied nor verified by the various aircraft manufacturers.

In February 2003, following certification testing in 2002, Sikorsky published a new technical information brochure which was changed to state the S-92A MGB was capable of "30 minutes safe operation following an oil leak". During subsequent articles about the S-92A and marketing presentations given to prospective buyers/operators of the helicopter, Sikorsky described it as 30-minute safe operation following an MGB oil leak. Sikorsky never publicly announced that its original marketing information about the MGB's run dry performance was inaccurate.

Although the Sikorsky S-92A marketing brochure had been changed to remove the term "30 minute run-dry drive system", a Sikorsky marketing comparison of the S-92A and the EC225 delivered to prospective clients in 2007 indicated that both the EC225 and the S-92A have "30 minute run dry transmissions". The TSB investigation could not determine the extent to which this promotional material was distributed.

1.18.6 Social Media

The internet has greatly increased opportunities for individuals to interact and exchange information and viewpoints. Internet forums, a form of social media,^{Footnote 139} have become a widely popular source of information exchange. On one such internet forum, the S-92A generated an enormous amount of discussion. Starting in March 2000, before the S-92A went into commercial use, website visitors engaged in discussions about the introduction of the S-92A. Many of the individuals who posted on this website chose to remain anonymous. However, others such as one of Sikorsky's senior managers for the S-92A program, who was a regular contributor to the online discussion, chose to identify themselves. Over the course of several years, the subject of the S-92A's compliance with Part 29 was discussed at length among members of this internet forum. From these online discussions, it was evident that those involved understood that the S-92A did not have a run dry capability.

It was determined during the TSB investigation that at least one senior manager, and several other pilots at Cougar Helicopters periodically reviewed the material posted on the above mentioned internet forum.

Social media content such as internet forums can also be useful in judging cultural beliefs within a specific group such as helicopter pilots. For instance, some visitors indicated that the discussions mentioned above caused them to review the run dry capabilities, if any, of the helicopters they were flying. The online discussions also seemed to indicate that the typical offshore pilot would continue flight toward shore rather than ditching, no matter what the checklist said, until they were confronted with secondary indications that the transmission was about to fail catastrophically.

1.19 Useful or Effective Investigation Techniques

1.19.1 Recovery Vessel

The recovery of the helicopter and victims from the North Atlantic Ocean in the middle of March presented some significant challenges. The motor vessel (M/V) Atlantic Osprey and its crew made available by Husky Energy allowed the recovery team to overcome these challenges. The ship is equipped with a Class 2, Kongsberg SDP 21 dynamic positioning system. Dynamic positioning (DP) is a computer-controlled system to automatically maintain a vessel's position and heading by using its own propellers and thrusters where mooring or anchoring is not feasible. Various sensors provide position and movement information to the computer which contains a mathematical model of the vessel's wind effect, current drag, and thruster location. The computer calculates the required steering angle and thruster output to allow the vessel to remain perfectly positioned.

The ship is also equipped with a National Oilwell Boom Crane with a 50-ton capacity and active heave compensation (see Photo 17). Essentially, an active heave compensation system removes any vertical motion from a vessel affecting the position of a load suspended, at depth, with respect to the seabed. This was extremely important to effectively and safely recover the wreckage.

1.19.2 Wreckage Recovery

Recovery planning began 13 March 2009, with the TSB accepting the lead role for coordinating the recovery activities. Two main sea-borne options were made available to the TSB; Husky Energy offered the services of the Atlantic Osprey, a UT722-L Anchor Handling Tug Supply Vessel, and the Canadian Coast Guard offered the services of its St. John's based vessels. TSB regional investigators involved in the recovery had prior experience working with the Atlantic Osprey and its crew during an exercise in 2005 and this very capable resource played a significant role in the CHI91 recovery.

On 13 March 2009, while proceeding from the offshore oil rig towards St John's harbour, the Atlantic Osprey sailed over the last reported position of CHI91. Using its sonar, it located an object on the sea bottom.

On 14 March 2009 at 0455 the Atlantic Osprey departed St. John's harbour for the crash site, with two technical investigators from the TSB, a Cougar Helicopters representative, a technical representative from Sikorsky, and two members from the Royal Canadian Mounted Police who represented the Medical Examiner's office. Also onboard the Atlantic Osprey were personnel from Oceaneering International, Inc. and Fugro GeoSurveys Inc. to operate the remotely operated vehicles (ROVs) and side-scan sonar.

Shortly after arriving on site, the search for the wreckage began utilizing the ROV. A few hours later, the wreckage site was located at 47°26′4.17″ N and 51°56′42.52″ W at a depth of approximately 169 metres. A ROV was used to conduct an initial survey of the wreckage and surrounding ocean floor. The focus of the initial activity was on recovering the victims of the accident and if possible locating the MPFR.

By 17 March 2009, all victims had been recovered as well as the MPFR. Due to the fragile condition of the main wreckage, the TSB determined early in the recovery operation that it would not be effective or safe to lift the main wreckage, unsupported, to the surface and onto the ship. With this in mind, a rigid spool deployment frame was modified to serve as a large cage. After two of the main rotor blades were cut underwater to allow the wreckage to sit in the cage, a strap was secured around the main rotor head and used to lift the main wreckage into the cage, and then the cage was lifted to the surface (see Photo 18). The Atlantic Osprey, with the main wreckage aboard, arrived in St. John's harbour the afternoon of 18 March 2009.

The vessel returned to the crash site a final time on 19 March 2009 to recover the remaining pieces of wreckage, including the tail section, and the fuselage section containing the main wheels. The portion of the aft fuselage containing the emergency locater transmitter and the tail flotation bag broke off during recovery and were not recovered. Throughout the recovery phase, the sea state remained relatively calm, unusual for that time of year and location. This allowed ROV operations, which were limited to 1.5 metre seas or less, to continue without delay.

The flight crew diverted back towards St. John's in response to a red MGB OIL PRES warning message and an aural warning "GEARBOX PRESSURE... GEARBOX PRESSURE". During the transit towards shore, a loss of MGB oil led to the eventual failure of the tail rotor take-off pinion. This caused a loss of drive to the tail rotor, which forced the crew to enter an autorotative descent. While attempting to ditch, the helicopter struck the water and sank rapidly.

In an effort to understand why this accident happened, this analysis will focus on the events, conditions and underlying factors that caused or contributed to the accident. In addition, many risks to the system will be analyzed with the objective of improving aviation safety.

2.1 S-92A Certification

By the 1980s, the FAA recognized that, due to the phenomenal growth in the rotorcraft industry and the challenging conditions in which some rotorcraft were operating, it needed to upgrade the certification standards for transport category rotorcraft to improve safety margins. One purpose of the upgrades was to ensure Category A helicopters would be manufactured with enhanced gearboxes. The thinking was that these gearboxes should have a significant capacity to operate following a loss of lubricant in order to optimize eventual landing opportunities. In determining what the exact capacity should be, the FAA arrived at 30 minutes because it knew that industry was able to design and build main gear boxes with this capability. The 30-minute requirement formed an essential part of the Notice of Proposed Rule Making.

However, after receiving comments from industry stakeholders the FAA modified the wording of the proposed rule to include the "extremely remote" concept. This meant that, if any failure mode was considered to be "extremely remote", the manufacturer would not be required to show by test that, during that failure mode, the helicopter was capable of continued safe operation for 30 minutes in the event of a loss of lubricant. Neither Sikorsky nor the FAA considered the possibility that the MGB oil filter bowl attachment system could fail. On this basis, the FAA certified the S-92A even though it had failed the initial loss of lubricant testing. By focussing on the "extremely remote" concept, both the FAA and Sikorsky lost sight of the purpose of this rule.

The JAA questioned the FAA as to why they should accept the S-92A when it had not demonstrated the MGB loss of lubricant test, especially since JAA had already certified at least four helicopters to that criterion. While there was considerable correspondence between the JAA and the FAA regarding the decision to use the extremely remote rationale, the JAA ultimately agreed with the FAA and certified the S-92A.

Although TC had certified one helicopter to FAR 29.927(c)(1) after demonstrating the MGB could operate for 30 minutes following a loss of lubricant, it also accepted the FAA certification for the S-92A. While TC did question the 5 second MGB oil cooler bypass requirement, indicating that it believed this function should have been automated, TC accepted an enhanced RFM procedure as an acceptable risk mitigation strategy.

2.2 Mitigation Measures Following CHC S-92A Australian Occurrence

In the Australian occurrence the helicopter was not damaged and there were no injuries. The failure initially appeared to have been related to an isolated field repair. Sikorsky advised its customers of these early findings and also suggested that extra attention be given to the filter bowl fasteners.

After an independent engineering firm flagged galling as a possibility on the titanium studs, Sikorsky completed a safety review of the Australian accident and the failed studs. Sikorsky and the FAA came to understand that the source of the problem was in fact galling. Sikorsky, utilizing a risk management process, made an assessment of the Australian occurrence flight, noting that it was able to continue flight for several minutes following the loss of lubricant without causing serious damage to the helicopter. Based on this assessment, Sikorsky developed its safety action, which the FAA accepted. SSA-S-92A-08-007 was communicated on 08 October 2008 to alert operators of the upcoming AMM Revision 13. These mandatory enhanced inspection requirements aimed to ensure damaged studs would be detected and removed.

Believing that the mandatory enhanced maintenance procedures would mitigate risk to acceptable levels, Sikorsky established a compliance time to the Alert Service Bulletin for the replacement of the titanium studs of one year or 1250 flight hours.

As of 05 November 2008 (date of issue of AMM Revision 13), Sikorsky had not received any reports of damaged MGB oil filter bowl attachment studs. Therefore, all of the S-92A helicopters in service at that time (except VH-LOH) would have been equipped with the original MGB oil filter bowl attachment studs. These studs would have had the nuts installed and removed a minimum of 3 times and, in helicopters with similar flight hours as the occurrence helicopter, the nuts would have been installed and removed over 10 times.

The TSB's examination of new S-92A MGB studs and nuts, similar to the type used on the occurrence helicopter, showed that galling damage developed during the first installation of the nut and became progressively worse with repeated installations. The galling was further exacerbated when the nut was reused. AD 2009-07-53 was issued on 23 March 2009, about 5 months after AMM Revision 13. During this 5 month period, every time the MGB oil filter was changed, it was mandatory for operators to carry out the enhanced inspection and to replace any damaged studs.

After AD 2009-07-53 had been issued, Sikorsky requested that operators return the studs they had removed to comply with the AD. As operators were under no obligation to comply with the request, Sikorsky only received a total of 59 studs from various operators. All of these studs, as well as the studs recovered from the occurrence helicopter and the other Cougar helicopters, had different severities of galling, which would be consistent with a difference in the number of times the nut was installed and removed. Based on the S-92A fleet average monthly flying hours, and the average time between MGB oil filter replacements, it is likely that most, if not all, of the 59 studs returned to Sikorsky would have been subject to inspection at least once during that period.

Since the thread galling was detectable using the new procedures, and given that no damage was reported and that there were no reported problems complying with the enhanced inspection procedure, it must be concluded that most S-92A operators, including Cougar Helicopters, did not implement the new maintenance procedure as specified by AMM Revision 13 and, therefore, damaged studs on the filter bowl assembly were not detected or replaced. As these maintenance procedures were mandatory, the low compliance rate can perhaps be attributed to the possibility that operators did not clearly understand the underlying reasons behind the enhanced procedures and the need to detect and replace damaged studs. That is, they did not appreciate that a failed MGB filter bowl assembly mounting stud would cause an uncontrolled total loss of MGB oil that would eventually lead to the failure of the MGB.

2.3 CHI91 MGB Failure

2.3.1 General

Titanium alloy surfaces are susceptible to galling under conditions such as the removal or installation of a nut. Every time this operation is repeated, the damage becomes more severe. The total number of removals and installations of the nut would have exacerbated the galling condition. Additionally, using the same nut during all of the installations would have further worsened the condition. In this occurrence, the MGB oil filter on CHI91 was replaced a total of 11 times. The presence of grey paint found on the MGB oil filter bowl attachment nuts inspected after the occurrence demonstrates that the original nuts were in use whereas, according to the current AMM revision, new nuts should have been installed. When galling occurs, there is increased friction. As a result of this increased friction, the torque will not be converted into bolt preload. On the occurrence helicopter, the nuts and studs had accumulated sufficient galling damage to prevent the correct preload from being applied during installation. The reduced preload led to an increase of the cyclic load experienced by the studs during operation and to the initiation and propagation of fatigue cracks. Fatigue cracking then developed in a second stud due to increased loading resulting from the initial stud failure. The two studs broke in cruise flight resulting in a sudden loss of oil in the MGB.

The disassembly of the CHI91 MGB led investigators to conclude that the loss of lubrication oil caused a catastrophic failure of the tail take-off pinion, which resulted in the loss of drive to the tail rotor shafts. This is a different failure than the one experienced during the initial certification test, where the loss of lubrication oil caused a catastrophic failure of the sun gear resulting in the loss of drive to the main rotor. However, CHI91 was not being operated under the same parameters as those used during the initial certification test. Therefore, it would be reasonable to expect a different mode of failure. Since CHI91 was operated at a higher torque and airspeed than the minimum required in the RFM, it would require more tail rotor thrust to maintain its heading. The higher thrust requirement would result in a higher load on the tail take-off pinion. Sikorsky has indicated that a loss of drive, which could occur in either the main or tail drive sections, is more likely to occur if the MGB is operated at a high power and if rapid or frequent power changes are made. Since there are so many variables at work within the gearbox, it is not possible to determine exactly where a specific loss of drive will occur in any particular situation.

2.3.2 Thirty-Minute Run Dry Perception

AC 29-2C describes a test where the oil is drained while the MGB is operating. If the oil is allowed to drain (with only residual oil remaining) then it would be reasonable to consider the gearbox as being dry. Therefore, it would also be reasonable to describe this type of test as a run dry test. Based on this, a helicopter that met the requirements of Part 29.927(c)(1) by draining the MGB and continuing operation for 30 minutes would have a 30-minute run dry capability.

Prior to the initial certification tests, Sikorsky advertising material indicated that the S-92A had a 30-minute run dry capability. This advertising information was picked up by prospective operators, various trade journals, and internet sources. After failing to demonstrate that the MGB was capable of successfully completing the loss of lubricant test, Sikorsky changed its material to indicate that the S-92A had a "thirty minute safe operation following an oil leak" capability. The wording of this statement was close enough to the original wording, which specifically mentioned a run dry capability, to potentially lead some to believe that the S-92A had a 30-minute run dry capability. In addition, instances such as the 2007 marketing comparison of the EC225 and the S-92A identifying that both helicopters have a 30-minute run dry capability indicates that at least some Sikorsky marketing personnel were unaware that this capability had not been achieved during certification or that some older marketing material had not been updated following the loss of lubricant test. Even with limited distribution, this type of marketing information would serve to reinforce any perception that the S-92A had a 30-minute run dry MGB.

At the time of the occurrence, some individuals believed the S-92A had a 30-minute run dry capability. However, at least as many people, if not the majority, had no misconceptions about the capability of the S-92A's MGB following a complete loss of lubricating oil. It is unlikely that qualified S-92A pilots would believe that the S-92A had a 30-minute run dry capability, since this critical performance information is not found in any of the S-92A manuals or training material. Likewise, when determining their course of action, at no time did either of the occurrence pilots make a comment which would indicate that they believed the S-92A MGB had a run dry capability. However, the inclusion of explicit information in a RFM concerning the approximate duration of MGB operation following a loss of lubricant would help pilot decision making during such situations. If manufacturers do not clearly identify critical aircraft performance capabilities in flight manuals (e.g., run dry capabilities), there is an increased risk that pilots will make decisions based on incomplete or inaccurate information during abnormal and emergency situations.

2.4 Loss of Recorder Data

Valuable CVR and FDR data was lost during the final moments prior to impact. The most likely reason for this loss of data was the g-switch, which will close if subjected to a 5g, 4 millisecond pulse, or even quicker if subjected to higher g pulses. Even though the MPFR data did not reveal any 5g or higher pulses just prior to the loss of power, the most probable reason for the power interruption to the MPFR was that the g-switch received a 5g or higher pulse of sufficient duration to energize the dedicated relay which cut power to the MPFR. Power was restored to the MPFR when there was a temporary loss of power to the Battery Bus, as Nr dropped below 80% causing the primary generators to drop off line and the APU generator to come on line, effectively de-energizing the relay during the momentary power interruption. The use of g-switches for the purpose of stopping a CVR or combined CVR/FDR will likely continue to result in the loss of potentially valuable CVR or CVR/FDR data, impeding accident investigation.

2.5 Emergency Procedures and Handling

2.5.1 General

In order to better understand what happened to CHI91, it is important to analyze the abnormal and emergency procedures in the RFM, Cougar Helicopters' SOPs, and the S-92A Pilot Checklist. It is also important to examine the crew's actions, and to determine, what, if any emergency handling considerations played a role in this occurrence. The analysis will compare the crew's response to RFM-approved and recommended procedures and practices for emergency handling offshore.

A detailed analysis of the crew resource management aspects of this occurrence is provided in section 2.6.

2.5.2 Abnormal and Emergency Procedures

In an abnormal condition, time may be available to first consult the appropriate procedure before carrying out any corrective actions. In an emergency situation, there is greater urgency. As a result, one would expect that time-critical actions of an emergency procedure would be clearly identified as memory items. While there are clear benefits to reducing the amount of items a pilot is expected to remember, efforts to eliminate memory items must be carefully weighed against the potential consequences of having the action completed after consultation with a checklist. If it is unreasonable to expect a pilot to first consult the appropriate emergency procedure before carrying out the applicable action, then that action should likely be considered a memory item. In response to a red MGB OIL PRES warning message, pilots would not have adequate time to consult the MGB malfunction procedure, read through the appropriate steps in the procedure, and activate the bypass within 5 seconds. The decision not to identify time-critical actions as memory items in the S-92A MGB malfunction procedure is contrary to, and inconsistent with, basic emergency procedure design principles and could lead to delays in carrying out actions that are vital to the safe continuation of flight.

The automation of emergency systems frees up mental processing resources that pilots can use for other steps in the procedure and for the overall management of the situation. As seen in this occurrence with the delayed activation of the MGB oil bypass system, automation also reduces the risk that abnormal or emergency actions will be omitted or delayed unnecessarily because of mental processing limitations or external distractions. The decision not to automate emergency system activation, such as the MGB oil bypass system in the S-92A, increases the risk that critical actions will be omitted or delayed unnecessarily.

TSB Safety Advisory A990002 identified the lack of standardization for abnormal and emergency landing guidance as a safety deficiency. Although the resultant CBAAC 0163 recommended that operators review these terms, it did not include "land immediately". In addition, no regulatory standard has established common definitions and as a result, there is considerable variation in the different landing guidance definitions. This places a significant amount of responsibility on the pilot to interpret and assess the meaning of the definition in relation to the actual severity of the situation. If the guidance is not explicit, it could be easily misinterpreted by pilots during an abnormal or emergency situation. The use of the words "mandatory" and "shall" in the "land immediately" definitions given in other helicopters' RFMs make them very directive to the pilot, and assist the pilot's decision-making process. The definition of "land as soon as possible" in the S-92A RFM is directive in nature, giving the pilots clear instructions that they are required to land at the nearest site where a safe landing can be made. In contrast, the S-92A RFM definition of "land immediately" contained the wording "may not" and "preferable", and was more suggestive than the "land as soon as possible" definition. The subjectivity of the "land immediately" definition arguably places the onus on the pilot to decide whether to land/ditch or prolong flight. The lack of established standards for landing guidance definitions used in abnormal and emergency procedures leaves the definitions open to misinterpretation.

2.5.3 S-92A Rotorcraft Flight Manual

MGB malfunction procedures for the Sikorsky S-61 model quickly bring a pilot to the "land immediately" determination. This avoids unnecessary delays during a potentially critical situation and is consistent with accepted checklist design principles which suggest that procedures should first address the most critical situation before addressing the less critical conditions.

In the S-92A RFM, responses to multiple MGB malfunctions, critical (red) and non-critical (amber), are combined into a single procedure, with the less critical malfunction at the beginning and the most critical at the end. The decision to alter the order of the S-92A's MGB malfunction procedures appears to have been based on the manufacturer's assessment that a non-critical MGB malfunction would precede, or was more likely than, an emergency condition. This can result in unnecessary delays as crews must first complete the non-critical steps of the procedure before they reach the critical malfunction procedure. The combination of abnormal and emergency procedures into a single procedure, which focuses first on the abnormal condition, increases the risk that critical emergency actions will be delayed or omitted.

The preamble of the gearbox malfunction section in the RFM directs pilots to consult the MGB oil temperature and pressure gauges, along with the associated chip system, to determine if a MGB problem exists. Likewise, the confirmation of the MGB oil system failure procedure draws the pilots' attention to the MGB oil temperature. In the remainder of the MGB oil system failure procedure, pilots are warned to be on the lookout for high MGB oil temperature and/or the MGB OIL HOT caution message. Pilots are also advised to expect the MGB oil temperature to increase following the activation of the MGB oil bypass system. The emphasis placed on MGB oil temperature led the pilots to believe that they would see an increase in MGB oil temperature if they had an actual MGB oil system failure. The RFM did not describe the symptoms of a complete loss of MGB oil (i.e. that the wet bulb oil temperature sensor would not be reliable) or a single MGB oil pump failure. As a result, the pilots relied heavily on the MGB oil temperature indication, which was not reacting as they had expected. In an effort to rationalize the lack of temperature change, both pilots hypothesized that they may have experienced a sensor failure or MGB oil pump failure. The S-92A RFM MGB oil system failure procedure was ambiguous and lacked clearly defined symptoms of a complete loss of MGB oil and of a single MGB oil pump failure. This ambiguity contributed to the flight crew's misdiagnosis that a faulty oil pump or sensor was the source of the problem and their conclusion that ditching could be delayed.

The RFM identified the potential for a loss of drive to the main or tail rotor as a result of a MGB malfunction to assist pilot decision making and preparations for possible outcomes that may result from a MGB failure.

The S-92A RFM did not provide pilots with a recommended maximum duration of flight time following a loss of lubricant. As a result, the pilots did not have any written guidance, or reminder, that the aircraft would likely not be capable of continued safe operation beyond 10 minutes following a loss of lubricant. If manufacturers do not clearly identify critical aircraft performance capabilities in flight manuals, there is increased risk that pilots will make decisions based on incomplete or inaccurate information during abnormal and emergency situations.

In helicopters such as the S-92A, where the pressure indication and the caution/warning messages are derived from two independent sources, the pressure indicator is a secondary indication following the illumination of an oil pressure-related caution or warning message. In addition, the S-92A utilizes a wet-bulb system for MGB oil temperature indications. Both of these pieces of information are critical and could help a pilot in analyzing a loss of lubricant condition. While there are limits to how much technical information a pilot should be required to know, manufacturers and operators must ensure that pilots fully understand the significance of an abnormal or emergency indication and any associated caution and/or warning messages. Inadequate systems knowledge related to abnormal and emergency conditions increases the risk of pilots relying on previously learned knowledge. This could lead to unintentional errors in interpreting symptoms of a system malfunction.

The RFM's guidance in the preamble of the MGB malfunction section is consistent with industry recognized practices and standards. While the RFM recommends that pilots fly at the airspeed for which minimum power is required, it does not identify a target airspeed (e.g., maximum L/D or bucket airspeed) in the MGB malfunction section of the RFM. Likewise, the RFM does not provide a recommended "reduced power setting" range to pilots. In the absence of past training, experience, or corporate knowledge, pilots may have difficulties identifying the ideal torque and airspeed combination for a given situation following a malfunction of the MGB oil system. In this occurrence, the lack of information may have adversely influenced the captain's decision-making process with respect to the flight profile, as well as the risk assessment of ditching versus prolonging flight. The lack of specific guidance or recommendations in the RFM pertaining to optimum airspeed and torque setting could influence the selection of a flight profile that accelerates a gearbox's failure.

In the absence of formal guidance, pilots must rely on previously learned information or their best guess when selecting an appropriate flight profile with a potential impending gearbox failure. While corporate knowledge is valuable, if it is not documented there is a danger that valuable lessons learned will be lost over time due to turnover of personnel. In the case of over water emergency situations, the reliability of modern helicopters may contribute to a lack of dialogue between pilots relating to the challenges of over water emergencies, which may decrease the corporate knowledge. The failure to incorporate valuable lessons learned from previous experience into existing procedures or manuals increases the risk that pilots will lack the necessary knowledge to safely handle an emergency situation.

2.5.4 Cougar Helicopters SOPs and S-92A Pilot Checklist

To meet regulatory requirements, Cougar Helicopters had a RFM, a S-92A Pilot Checklist, and company SOPs. Several of the S-92A's abnormal and emergency procedures were repeated in each of these documents. A comparison of the RFM, the S-92A Pilot Checklist, and SOPs revealed several procedural differences. While most of these differences were very minor in nature, the MGB oil system failure procedure in the SOPs differed significantly from the current RFM. Additionally, the S-92A Pilot Checklist that was in effect at the time of the accident did not incorporate the most recent changes to the RFM, as illustrated by the confirmation step requiring the pilot to verify that MGB oil pressure was below 35 psi. The use of non-current publications such as RFM, SOPs, and checklists, increases the risk that critical steps of an approved procedure will be omitted or delayed.

2.5.5 CHI91 Flight Crew Emergency Handling

The pilots in this occurrence found themselves dealing with a rare, critical emergency. Instead of being presented with symptoms that they had come to expect, the indications deviated from what they had been taught during initial and recurrent training. In this occurrence, the pilots misdiagnosed the reason for the complete loss of MGB oil pressure, which contributed to decisions that were made regarding the helicopter's flight profile. In particular, the flight crew continued flight after having acknowledged that they were at "land immediately" in the emergency response. Subsequently, they adopted a flight profile that placed themselves and their passengers at significant risk. During the final seconds of the flight, the pilots experienced difficulties controlling the helicopter following the loss of drive to the tail rotor, contributing to the severity of the impact which destroyed the helicopter and caused it to sink rapidly.

The crew's initial reaction to return to shore and begin a descent was appropriate based on the initial indication of a MGB malfunction. During the initial portion of the descent, both pilots considered ditching as a strong possibility. This is evidenced by their communications with ATC, the request to lower the landing gear, which is the first item in the ditching checklist, and comments made about readying their immersion suits.

The RFM guidance advises that "descent should be done at a reduced power setting, but with enough torque to drive the transmission" in preparation for landing. The captain initiated the descent by reducing power from the cruise setting, eventually selecting approximately 32% torque. This power setting is consistent with RFM guidance, which does not identify a recommended value. It is also consistent, albeit at the upper end, of a generally accepted descent profile power setting range with a suspected gearbox malfunction. It is unlikely that the torque values selected during the initial descent accelerated the failure of the tail rotor drive.

Similarly, the RFM calls for the pilot to "fly at an airspeed for which minimum power is required". In this occurrence, the helicopter stabilized at 120 knots, 40 knots above the airspeed identified as a memory action in the S-92A Pilot Checklist, Emergency Descent procedure, as well as the approximate bucket speed of 80 knots. An airspeed that is higher than the bucket speed will require an increased torque setting. Together, this increased airspeed and torque can place additional stress on a potentially failing gearbox and also puts the helicopter in a situation where it may not be possible to quickly carry out a controlled landing or ditching.

The initial mention of the requirement to activate the oil bypass came approximately 7 seconds beyond the maximum allowable time of 5 seconds. The activation of the bypass was delayed 1 minute and 17 seconds because higher priority was placed on communicating with ATC and company dispatch. However, due to the nature of the leak encountered on CHI91, the delayed activation of the MGB oil bypass switch did not play a factor in the outcome.

The PF coordinated the initial steps of the emergency response by directing the PNF to get out the checklist and locate the emergency response. However, the PNF experienced difficulties locating the appropriate emergency response, and there is no evidence to suggest that the PF assisted the PNF to locate the appropriate page. Much like the crew of the Australian occurrence, it is likely that the pilots of CHI91 never noticed the momentary illumination of the amber MGB OIL PRES caution message. If either pilot did detect the momentary illumination of the caution message, their attention would have immediately switched to the more critical concern of the warning light. It is likely that the PNF referred to the back of the checklist, using the caution/warning legend in an attempt to locate the appropriate page for the procedure.

Since the pilots had been trained in the simulator to expect a time lapse between the caution message and the warning message, it is likely that the PNF had never been required to locate the red MGB OIL PRES. As a result, he was unaware that the warning was not included in the caution/warning legend at the back of the checklist. The absence of corrective guidance from the PF also suggests that he was unaware that the warning was not located in the legend as well. This contributed to the delay in finding the appropriate page in the checklist. Unable to locate the red MGB OIL PRES warning message on the legend, the PNF likely spent additional time double-checking the various caution and warning messages in case it had been overlooked. It is unclear exactly how the PNF arrived at the appropriate page. It is possible that the PNF found it by first locating the caution message in the legend and then going to the associated procedure, by flipping through that section of the S-92A Pilot Checklist, or by locating it in the RFM, which were located behind the crew seats. As seen in this occurrence, the omission of caution or warning messages from a quick reference legend could result in delays in locating the appropriate abnormal or emergency response in a pilot checklist.

The PNF was not using the most current version of the RFM, the S-92A Pilot Checklist, or the Cougar Helicopters' SOPs. It is likely that he was using a previous version of the RFM procedure, or a modified personal copy of the S-92A Pilot Checklist. However, only minor differences were evident between the procedure that was carried out by the pilots and the applicable RFM procedure. As a result, this discrepancy was not considered as being contributory to the occurrence.

The pilots misdiagnosed the emergency due to a lack of understanding of the MGB oil system and an over-reliance on the prevalent expectation that a loss of oil would result in an increase in oil temperature. For example, discussions between the pilots about the possibility of a pump failure and splash lubrication indicate that the pilots did not recall that the helicopter was equipped with two independent MGB oil pumps. Likewise, on several occasions the pilots made reference to the MGB oil temperature, and that because it was not rising they still had oil in the system. This led the pilots to incorrectly rely on MGB oil temperature as a secondary indication of an impending MGB failure. This points to a potential deficiency in the pilots' systems knowledge pertaining to the MGB oil system, their training, or both.

When designing training for modern aircraft such as the S-92A, one of the challenges is determining how much systems knowledge is required by the pilots. This issue is addressed in the CASS, and echoed in the Cougar Helicopter's COM, which state that aircraft systems knowledge training should be limited to components or systems that are directly controllable by the flight crew. This training philosophy relies heavily on adherence to approved procedures as a way of mitigating the risks associated with lower levels of systems knowledge. Problems with this training philosophy can arise, however, if pilots find themselves in a situation where they feel compelled, due to the perceived risk of carrying out the procedure, to consider alternate options. If pilots lack adequate understanding of the systems involved, they may make decisions based on inaccurate or incomplete information, thereby increasing the risk to the crew and passengers. As a result, careful consideration must be applied when determining what is taught during initial and recurrent training to avoid the omission of critical information required to help diagnose a malfunction or emergency. Although the S-92A PTM indicated the presence of two MGB oil pumps, it is possible that a lack of emphasis on the components of the MGB oil system contributed to the diagnosis and troubleshooting problems experienced by the pilots. There were some inconsistencies between the factory approved curriculum at FSI and the current understanding of the MGB system reflected in current RFM revisions such as what oil pressure would be expected following a single pump failure. Even though Sikorsky knew as early as 2005 that a single pump failure would result in oil pressure fluctations between 5 psi and 25 psi and could cause illumination of the red MGB OIL PRES warning message, the PTM still indicated that oil pressure would only drop to the lower part of the green range (approximately 45 psi). It could not be determined why these inconsistencies were not detected by the Sikorsky personnel monitoring the S-92 training program.

Both pilots acknowledged that they had reached the "land immediately" step as per the RFM and S-92A Pilot Checklist. However, the crew did not consider MGB oil pressure below 5 psi as a reliable secondary indication of an impending gearbox failure. This is most likely a function of their training and the generally accepted belief that a secondary indication would be something different than the originally identified condition. The pilots had been taught during initial and recurrent S-92A simulator training that a gearbox failure would be gradual and always preceded by noise and vibration. This likely contributed to the captain's decision to continue towards CYYT.

The decision to level off at 800 feet, to increase power to approximately 73% torque, and to fly at 135 KIAS towards shore is contrary to the RFM, which advises a pilot to "descend to an altitude from which a landing can be quickly made with minimal power changes and fly at an airspeed for which minimum power is required". At 800 feet asl, an airspeed of 82 KIAS would have resulted in the minimum power for straight-and-level flight, and equated to approximately 47% torque. The choice of flight profile was also inconsistent with the Emergency Descent procedure in the S-92A Pilot Checklist which calls for level-off at 200 feet in preparation for a potential emergency landing or ditching. In this occurrence, approximately 22 seconds elapsed from the moment the pilots became aware that the MGB was failing to the point when they experienced a loss of drive to the tail rotor. From an altitude of 800 feet asl and an airspeed of 135 KIAS, the pilots had insufficient time to carry out a controlled ditching before the loss of drive to the tail rotor. Rather than continuing with the descent and ditching as per the RFM, the helicopter was levelled off at 800 feet asl, using a higher power setting and airspeed than required. This likely accelerated the loss of drive to the tail rotor and significantly reduced the probability of a successful, controlled ditching.

The final descent was initiated approximately 3.5 minutes after the helicopter had levelled off at 800 feet asl. The commencement of main rotor rpm fluctuations, the momentary illumination of the rotor brake on indication, and the power loss to the MPFR, likely coincided with the onset of the failure of the tail take-off pinion, which ultimately led to the loss of drive to the tail rotor. Since the MGB oil pressure had reached less than 5 psi long before the final descent, and there was no increased power requirement to maintain altitude, the crew must have experienced some other secondary indications (e.g., increased noise, control feedback or vibrations) that caused them to initiate the final descent from 800 feet. Although the exact nature of these secondary indications is unknown because of a power interruption to the MPFR, it was prominent enough to cause the crew to immediately lower the collective and start descending to the surface. At the onset of the descent, the control inputs are consistent with a pilot adopting a descending, decelerating attitude in preparation for a straight-ahead ditching.

Following the apparent yaw kick that occurred at 0955:25, the PF increased the rate of descent by lowering the collective even further to approximately 17% torque, indicating that the pilots realized that the situation was deteriorating. The left turn that was initiated was likely an attempt to put the helicopter into wind for the final descent and straight-in approach for ditching on the water. As the helicopter rolled out of the left turn, the helicopter attitude was increased to a maximum of 14 degrees nose-up in an attempt to flare off excessive airspeed, which was approximately 110 knots and decreasing.

The uncommanded right yaw at a rate of approximately 3.5 degrees per second and the simultaneous roll to the right coincide with a loss of yaw control leading up to the loss of drive to the tail rotor. The pilots took corrective action by applying left cyclic and left pedal, which momentarily returned the helicopter to a near-level attitude as it descended towards the surface. The increased application of collective following the initial onset of right yaw indicates that the PF likely did not immediately recognize the loss of tail rotor control, as the appropriate response in a loss of tail rotor thrust situation would be to lower collective to reduce the torque, which would reduce the right yaw tendency. Additionally, this increase in collective momentarily reduced the rate of descent considerably, delaying the descent to the water.

The onset of the rapid yaw to the right in the order of 20 degrees per second, combined with pitch and roll excursions, is consistent with a total loss of tail rotor thrust as described in the S-92A RFM. While this condition would have proved difficult for any pilot, the relatively high airspeed and power setting at the time of the loss of tail rotor thrust may have had a destabilizing effect on the helicopter, exacerbating the pitch and roll excursions. In response to these rapid attitude changes, the PF experienced some difficulties trying to keep the helicopter under control, and made some abrupt cyclic and pedal control inputs in an attempt to return the helicopter back to a stabilized attitude. The continuous and full application of left pedal would have produced no effect on the helicopter once drive to the tail rotor was lost. This pedal input was likely done instinctively, in an attempt to correct for the uncommanded right yaw. The application of right cyclic in response to the left roll excursion was likely influenced by the stress of the situation, which resulted in the over-application of right cyclic causing the helicopter to rapidly roll to the right.

It is unlikely that the two pilots had much opportunity to communicate required actions during the first few seconds following the loss of tail rotor thrust. Contrary to the loss of tail rotor thrust procedure in the RFM, the engines were shut down before the collective was reduced to enter autorotation indicating that the engine shut-down may not have been fully coordinated between the pilots. The throttles were shut off prior to lowering the collective, in response to the loss of tail rotor thrust. This caused significant main rotor rpm droop.

As the helicopter approached 400 feet above the water, roll, pitch, and yaw excursions exceeded those prescribed in the RFM by a significant margin, causing the helicopter to become unstable in the pitch and roll axes. This instability would have considerably increased the workload for the pilots as they attempted to execute an autorotation to the water. This is shown by the fact that the first officer was overheard on the radio providing verbal encouragement to the captain. It is likely that the first officer inadvertently activated the cyclic microphone while providing physical assistance on the controls to help the captain overcome the pitch and roll excursions and to establish the helicopter in a controlled autorotation. The pilots recovered from the significant amount of right bank on a downwind final approach heading, with main rotor rpm below the minimum acceptable range, low indicated airspeed, and a relatively high ground speed. This put the helicopter in a very precarious situation, with a rapidly building rate of descent.

As the helicopter descended rapidly towards the surface, the pilots would have experienced a certain degree of ground rush, which likely caused the PF to raise the collective and apply aft cyclic to decrease their perceived groundspeed and rate of closure with the water. This would have also contributed to the low main rotor rpm and airspeed conditions that developed, as well as a misjudgement of height for the initiation of the autorotative flare. At the normal flare height of 100 feet, indicated airspeed was significantly less than the 85 KIAS minimum recommended in the RFM. Likewise, main rotor rpm had decreased to 81%, which is significantly lower than the minimum power off limit of 95% rotor rpm, and even further from the recommended rotor rpm of 105%. Main rotor rpm and airspeeds this low would have resulted in significant loss of control authority and very little kinetic energy for the autorotative flare and subsequent application of collective for landing. In this occurrence, the airspeed and rotor rpm values prior to the flare would normally be expected during the final stages of cushioning an autorotative landing. Downwind, with low airspeed and very low main rotor rpm, the early application of collective and cyclic during final approach caused the main rotor to decay to the point where the main rotor blades likely reached a stalled condition. This would have caused the helicopter rate of descent to increase dramatically during the final seconds before impact, such that it would be impossible to recover prior to impact. The pilots experienced difficulties controlling the helicopter following the engine shut-down, placing the helicopter in a downwind autorotative descent with main rotor rpm and airspeed well below prescribed RFM limits. This led to an excessive rate of descent from which the pilots could not recover prior to impact.

2.6 Crew Resource Management

2.6.1 CRM Regulation in Canada

Current regulations require only CAR 705 operators to conduct CRM training. This distinction is based solely on aircraft size and passenger capacity, and does not take into account the complexity of the aircraft or the operation. CAR 703 and 704 operators are not required to provide CRM. Some operators do provide such training on a voluntary basis. The investigation determined that this voluntary training may not incorporate the most modern CRM concepts. As a result, there is an increased risk that crews operating under CAR 703 or 704 will experience breakdowns in CRM.

It is evident that some Transport Canada programs (e.g., AQP, ACP, and MPL) recognize the importance of modern CRM training, which includes threat and error management, in training and operations. Despite these advances, CASS 725.124(39) has not been revised to reflect the latest improvements in CRM training, indicating a lack of consistency within TC as it pertains to CRM training. This inconsistency appears related to TC's 2003 decision to cease CRM and other similar workshops to "refocus energies and resources to meet new priorities" such as SMS and runway incursions. While important in their own right, these new priorities appear to have caused CRM efforts to stagnate within TC. While TC continues to make material available on-line for purchase, it is at least 2 to 3 generations behind modern CRM training programs which advocate threat and error management. In addition, recurrent CRM requirements do not require any review of the initial core CRM subject matter. This can lead to memory decay, and a return to previously learned behaviours. While CAR 705 operators are required to have their CRM programs approved by TC, the programs are merely compared against the items listed in the standard. CRM packages are not compared against stringent standards to verify the quality of each module's content. The requirement is even less stringent for CAR 703 and 704 operators who voluntarily conduct CRM training, as they are not required to have their CRM training approved by TC. The current CRM regulation and standard for CAR 705 operators has not been updated to reflect the latest generation of CRM training. As a result, there is a risk that any flight crews trained to this standard may not be trained in the latest threat and error management techniques.

Unlike the UK, Canada does not require CRM instructors to undergo an accreditation process. As a result, TC currently has no way of measuring the quality of CRM instruction in Canada. Under the current regulatory structure, the content and quality of CRM training in Canada hinges primarily on the individual or agency conducting the CRM training. Without the proper level of regulatory oversight, there is little way of ensuring that CRM is taught to an acceptable standard. The lack of regulatory standards for CRM instructors in Canada increases the risk that flight crews will not receive the most effective CRM training.

2.6.2 CRM Training at Cougar Helicopters

Cougar Helicopters' initiative to voluntarily implement initial and recurrent CRM training for all of its pilots, despite a lack of regulatory requirement, demonstrates a strong commitment to safety. The inclusion of CRM training, and evaluation of CRM skills, during simulator training is an excellent way of reinforcing CRM skills that have been taught and increases the likelihood that those skills will be employed in the cockpit. The requirement to complete an internal comprehensive CRM workshop every 2 years also helps ensure that critical CRM skills are properly understood, and provides an opportunity for different views on CRM to be discussed outside of the cockpit.

Neither of the pilots had recently completed an internal CRM workshop at Cougar Helicopters; the captain having not completed a workshop in the past 3.5 years, the first officer having not completed one in the 10 months he was employed by the company. However, both pilots had been exposed to some recent CRM training during their simulator sessions. The CRM training provided by FSI to the occurrence pilots was an abbreviated CRM module, and covered a limited amount of material in a short period of time. It is unlikely that the 2-hour session provided the pilots with much opportunity to reinforce CRM skills that could be used effectively in the cockpit. The lack of recent, modern, CRM training likely contributed to the communication and decision-making breakdowns experienced by the pilots of CHI91.

2.6.3 CHI91 Crew Resource Management Issues

2.6.3.1 Task and Workload Management

Prior to the initial indication of the MGB oil pressure, PF and PNF duties were conducted in accordance with company and industry recommended practices. As soon as the crew was alerted to the MGB oil pressure problem, the division of crew duties deviated from accepted CRM best practices.

Contrary to the recommended task delegation practices in Cougar Helicopters' SOPs, the PF elected to retain control of the helicopter, while attempting to manage the emergency response, and communicate with ATC and the Cougar dispatch centre. This placed considerable processing demands and stress on the PF, and he approached task saturation. This is first seen 11 seconds after the initial indication of a problem, when the PF indicated that he needed to go into bypass. Instead of activating the bypass at that moment, the captain made the initial mayday call to ATC. This began a series of events that resulted in a significant delay (i.e., 77 seconds) from the moment the MGB oil pressure aural alert first sounded to the time the bypass was activated. The PF's workload prevented him from recognizing, and taking timely action to address difficulties the PNF, who had relatively little experience on the helicopter and very few hours in the past 90 days, encountered while attempting to locate the checklist reponse. On three different occasions, the PNF stated that he could not find the appropriate checklist page. Preoccupied with communicating with ATC and the Cougar dispatch centre, the PF did not provide any verbal assistance or guidance to the PNF. As a result, it took the PNF 2 minutes and 32 seconds to locate the appropriate page in the checklist. Once the checklist response was initiated, it was interrupted several times by the PF to talk with ATC and the Cougar dispatch centre. At no time did the PF advise ATC and the Cougar dispatch centre to standby while the crew carried out the checklist response. This resulted in significant delays, as it took 6.5 minutes to reach the "land immediately" line in the checklist. These delays in completing critical tasks made it difficult for the pilots to effectively work through the situation together, and to come up with the best possible course of action. The captain's decision to carry out PF duties, as well as several PNF duties, resulted in excessive workload levels that delayed checklist completion and prevented the captain from recognizing critical cues available to him.

2.6.3.2 Decision Making

The inherent risks to crew and passengers of ditching can weigh heavily on a pilot when deciding whether or not to prolong flight. In this occurrence, the pilots found themselves dealing with a time-critical situation that placed enormous demands on their mental processing abilities. The initial decision to turn back towards the closest piece of land, get as low to the surface as possible, and to ensure their immersion suits were ready, was appropriate and consistent with RFM guidance pertaining to a possible MGB failure. In the first few minutes after the aural alert, the crew thought ditching was a very real possibility. As the situation unfolded, the pilots were influenced by an incomplete mental model of the situation which led them to conclude that they had experienced a pump or sensor failure. It is evident that the pilots were not influenced by a misconception about the S-92A MGB's run dry time. The flight crew's misdiagnosis led them to believe that oil was still present in the MGB, and influenced the choice of flight profile and the decision to proceed towards land instead of ditching. By the time the crew of CHI91 had established that MGB oil pressure of less than 5 psi warranted a "land immediately" condition, the captain had dismissed ditching in the absence of other compelling indications such as unusual noises or vibrations.

Despite the pilots' apparent belief that oil was still present in the MGB, the possibility of an emergency landing was not completely abandoned, as seen by multiple references to Cape Spear as a possible emergency landing spot. In addition, the first officer made non-assertive statements indicative of someone who believed they should be closer to the surface at a reduced power setting to permit a rapid, controlled ditching. While Cape Spear was discussed as a contingency plan, the radar plot of the return portion of the flight shows that the helicopter's return track was direct to CYYT, and would have taken the helicopter approximately 4.5 nm north of Cape Spear. Likewise, it is also possible that 800 feet asl was selected for the return portion of the flight because it would allow for terrain clearance back to the airport once the helicopter crossed the shoreline. At this point, the choice of flight profile appears to have been influenced by confirmation bias. Rather than establish the helicopter at a lower altitude and airspeed that would facilitate a rapid and controlled ditching, the PF intentionally selected a high power setting and airspeed in order to reach shore as soon as possible. In this occurrence, each pilot appeared to have a different mental model based on their past experience, and neither took the necessary steps to align their mental models. This appears to be a function of heightened stress levels, potential task saturation, and ineffective crew resource management.

2.6.3.3 Crew Communications

In this occurrence, there are two different personality types. The captain was an experienced and confident pilot with a more directive style of leadership. The first officer was a relatively new company pilot with a non-assertive personality. Although both pilots enjoyed flying with each other, some of the natural characteristics of both pilots' communication styles became important in the context of a highly unusual, time-critical situation.

Following the red MGB OIL PRES warning message and aural alert, the first officer provided several very relevant pieces of information to assist the captain; however, these statements were not made in a confident, assertive manner. The first officer's mentioning of slowing down and getting lower is consistent with traditional MGB-related malfunctions, and was likely intended to assist the captain's decision-making process. This is very likely a function of the first officer's background flying Sea Kings, where over water emergencies were drilled extensively. As he worked through the checklist, the first officer's suggestions about potential causes of the indication were attempts to initiate further analysis to help determine the best course of action in response to the situation. After levelling the helicopter at 800 feet asl, the comments about L/D airspeed appeared to be an attempt to voice concern about pulling too much power with a suspected MGB problem. Not being familiar with the term "L/D", the captain dismissed the idea and the first officer did not persist in his efforts to influence the captain's choice of power setting. Shortly thereafter, the first officer's suggestion about going over the ditching scenario was an attempt to get the captain to verbalize what he was going to do in the event that a ditching could not be avoided. Each of these efforts by the first officer to communicate concerns was an attempt to improve crew situational awareness and decision making by resolving ambiguities. However, the first officer was likely reluctant to assert himself because of a non-assertive personality, inexperience with the company and the helicopter, and a steep trans-cockpit authority gradient.

Immediately following the first indication of the MGB problem, the captain's communication style became more directive in nature. As the situation unfolded, the captain did not actively seek out or encourage input from his first officer, who had extensive over water experience and over water emergency training. When input was provided by the first officer, the captain had difficulties recognizing that the first officer was trying to suggest that the selected course of action was not optimal, and the captain did not actively explore these comments.

The captain's fixation on reaching shore combined with the first officer's non-assertiveness prevented concerns about CHI91's flight profile from being incorporated into the captain's decision-making process. These breakdowns in crew resource management contributed to the selection of an unsafe flight profile.

2.7 Survival Aspects

2.7.1 General

Helicopter crash survivability on land is usually dependent on tolerable deceleration forces, an uncompromised occupant space, and the absence of post-crash fire. A severe water impact adds a significantly different dimension to occupant survivability; the possibility of rapid submersion. Although the deceleration force and fuselage deformation in this occurrence were survivable, the severe structural break-up prevented the helicopter from remaining afloat, and combined with the impact force, impaired the ability of the occupants to escape.

Even though the survivor had some serious injuries, his age, fitness, previous water experience, recent BST training, mental preparation, and strong desire to survive enabled him to escape the wreckage as it descended below the surface. In all likelihood, he escaped the wreckage at a depth between 20 to 30 feet and he was able to hold his breath, despite the cold water shock, long enough to reach the surface. The female occupant found deceased on the surface also managed to escape the wreckage after the impact, despite her injuries and the effects of cold water shock, because of the survival factors in her favour such as her age, fitness, survival instinct, and BST training just one year previously. However, she could not hold her breath long enough to reach the surface or drowned shortly after reaching the surface.

The survivor's body temperature had dropped approximately 0.09°C every minute in the water. If that same rate continued in a linear fashion, it would have reached a critical temperature of 24°C in another 64 minutes. This would have provided a maximum survival time in the immersion suit of approximately 2.5 hours. This maximum time is considerably less than the expected survival time of 4 hours, determined through CESM modeling, for a reasonably fit, youthful individual used to cold water immersion. There are several variables which could explain the increased rate of temperature decrease; most likely it occurred due to a combination of the effects of trauma, wind, waves, fit of suit, exposure of face and hands, and water ingress.

The initial impact and severe injuries suffered by the flight crew would likely have caused a transient loss of consciousness. As the helicopter became submerged in the extremely cold water, the two flight crew members would have had an uncontrollable reflex inspiratory gasp due to the cold water shock and inhaled sea water, likely resulting in drowning shortly after that.

The severe impact, sudden submersion in the freezing water and cold water shock were significant factors against passenger survival. Some passengers may have been momentarily unconscious. Analysis of the effects of the impact force suggests that some were likely conscious for a short period of time after the impact and during the initial descent in the water. The eight uninjured occupants seated next to windows or nearby exits had the best chance for survival provided they were ready and prepared, both mentally and physically, for the limited escape opportunity that existed. If they did not release their seat harnesses within a few seconds after the helicopter started to sink, the effects of the cold water shock would have likely caused them to break their breath holds in ten to fifteen seconds.

The seats were stroked by the impact and significantly lowered. The seat belt mechanisms were operational. Combined with the debilitating effects of the impact, injuries, submersion, and cold shock and associated breath hold issues, it would have been extremely difficult to locate and release the buckle of the restraining harness in the time available. This conclusion is supported by the fact that only two passengers managed to release their seat belts.

In addition to the other factors against their survival, the passengers with more serious injuries would have experienced varying degrees of pain making it more difficult to concentrate on the situation. This likely would have caused them to break their breath holds earlier than the uninjured passengers.

Of the eight occupants that had no significant injuries, six of them were located next to a window or near an exit and their most recent BST training varied from 1 year previously to 2.5 years. Although studies suggest that more recent and realistic training provides a better opportunity of surviving a ditching, the outcome of this accident would suggest that more recent BST alone would probably not have made a difference following an impact as violent as that of CHI91. In order to survive an impact of this magnitude, survivors need to have many factors in their favour.

2.7.2 BST Training Standards

The independent review^{Footnote 140} of the Canadian BST training indicated that both facilities met the requirements of the standard but identified several areas for improvement. In particular, the current standard lacks guidance to the individual providers on course duration, instructor competency, course completion requirements, and level of realism that should be included in their programs. While some agencies have proposed standards calling for BST training that requires equipment and participant clothing to be representative of the participant's actual operating environment, Canadian BST standards do not require training to simulate realistic ditching scenarios that are representative of the actual operating environment (e.g., cold water exposure, manually releasing a window, blocked exits, stroked seats, etc.). As a result, it is possible for significant training and equipment differences to exist between the training programs and the actual operating environment. The current BST standards in Canada lack clearly defined, realistic training standards and equipment requirements. This could lead to differences in the quality of training and probability of occupant survival following a ditching or crash at sea.

In Canada, the BST(R) is completed every 3 years. According to research, this may be too long. Frequency of training is important because repetitive exposure, using equipment representative of the operating environment, has been shown to reduce the time required to escape. Like training realism, repetition also helps to make procedures more automatic and reduces the time required to escape. In addition to more frequent training, increased exposure during each recurrent training session (i.e., saturation training), would help participants retain the required knowledge and skills during the intervening period. An interval of 3 years between BST(R)s may result in an unacceptable amount of skill decay between recurrent training sessions. This skill decay could reduce the probability of successful egress from a submerged helicopter.

At the time of the occurrence, most of Cougar Helicopters' flight crews had completed the five day initial BST program. However, it was not mandatory and occasionally some flight crew were only completing a one day HUET training session every 3 years. In addition, flight crew were not required to egress from one of the pilots' seats. Much like the fidelity and frequency of HUET training for passengers is of concern, if flight crew are not familiar and confident in their chances of escaping an inverted submerged helicopter, they could be influenced in their decision to ditch, especially in a high sea state.

2.7.3 Current PTSS Standards and CARs

In order to provide a second immersion suit to offshore workers when they were on the offshore facility, some PTSS, such as the E-452, were designed to meet both the standards for a marine immersion suit system and for the helicopter PTSS. There is considerable overlap in the buoyancy and thermal protection requirements. This produces a suit that represents a compromise between two very different applications. Typically, the abandonment of an offshore facility would occur during extremely bad weather when rescue may be delayed for several hours due to the adverse conditions. Whereas a helicopter ditching or crash event would take place during suitable flying conditions, which implies that rescue could be anticipated without as much delay.

Furthermore, in a helicopter ditching, an individual may be required to manoeuvre through small openings in order to egress from the helicopter. If an individual's suit is too bulky or too buoyant to allow for movement about the helicopter underwater, egress may not be possible. A large individual, wearing the current PTSS and attached ancillary safety devices (e.g., PLB, strobe light, etc.) would find it difficult to egress through an opening such as one of the S-92A side pop-out windows. Passenger Transportation Suit Systems (PTSS) designed to meet the standard for marine abandonment have increased buoyancy and flotation capabilities. While useful in a marine abandonment situation, the increased suit buoyancy and bulkiness may interfere with a successful egress from a submerged helicopter.

2.7.4 PTSS Introduction Phase

When the E-452 immersion suits were introduced at Cougar Helicopters, suit sizing was carried out using visual estimates based on height and weight, hood donning ability and the passenger's assessment of mobility. A confirmation of appropriate PTSS size based upon passenger measurements or physical checks of the hood and wrist seals were not performed by PTSS technicians during the PTSS introduction phase in 2007 or during subsequent pre-flight sizing performed at the heliport. This approach confirmed mobility, but it did not necessarily confirm they had the proper suit size and seal.

During BST training, passengers wore the same size suit they would be issued during regular offshore flights. If their suit was improperly sized, they became used to that size and assumed it was correct. In addition, many passengers, at the time, based their assessment of PTSS size on comfort rather than fit, which compounded the problem. A properly fitted PTSS is somewhat uncomfortable; therefore, most passengers were selecting a PTSS that was comfortable, but too large.

Relying on visual estimates of height and weight, and passenger assessments of hood donning ability and mobility, without confirmation of PTSS size through functional testing performed by PTSS technicians may result in passengers wearing inappropriate PTSS sizes.^{Footnote 141} The use of improper PTSS fitting techniques may result in unacceptable levels of water ingress and a subsequent rapid loss of body temperature, following a ditching or crash at sea.

2.7.5 Cougar Helicopters' Flight Crew Immersion Suits

Unlike the PTSS requirement, flight crew are not required by regulation to wear an immersion suit, and there are only minimal standards or regulations related to the maintenance of flight crew immersion suits like those worn by the occurrence pilots. Originally, aviation regulations required pilots and passengers to wear protective suits. The PTSS regulations that emerged in the CARs did not contain any provision for flight crew suits. This is most likely due to the fact that applying the PTSS standard to flight crew would result in a flight crew suit too bulky and hot to permit proper operation of the helicopter. In contrast, EASA's immersion suit requirements clearly apply to both crew and passengers.

No problems were detected with the flight crew immersion suits used in this occurrence. However, the operator's inspection of its flight crew suits shortly after the occurrence showed that many of the suits were unserviceable; therefore, pilots would have been placed at an additional risk if exposed to cold water. There are minimal regulations or standards pertaining to offshore helicopter flight crew suit use and maintenance. This increases the risk that flight crews will be inadequately protected following a ditching or crash at sea.

The occurrence pilots wore dark blue flight crew immersion suits and a bright yellow flotation vest. The CGSB standards require PTSS to be international safety orange or yellow (or an equivalent colour of high visibility). This is intended to increase the chance of detection by SAR crews. While flight crew immersion suits did not play a role in this occurrence, and Cougar Helicopters pilots wear a bright yellow flotation vest, a dark blue immersion suit would be harder to detect in open water than a suit that meets the colour specifications in the CGSB standards. Offshore helicopter flight crew suits that are not a high visibility colour reduce the probability of detection by SAR crews following a ditching or crash at sea. This could significantly delay rescue at night or in bad visibility.

2.7.6 Personal Locator Beacons

PLB are not required by Canadian aviation regulation for the occupants of a helicopter flying prolonged distances over water. As a result, there are no aviation standards for their design, function, and performance capabilities. Unlike the PLBs used by the occurrence flight crew, the PLBs carried by the passengers of CHI91 were designed for a man overboard situation and did not transmit on 406 MHz. As a result, they would not have been detected by the COSPAS-SARSAT satellite system, which would provide location information to SAR personnel following a ditching or crash at sea. Without a helicopter occupant PLB regulation and standards, inappropriate PLB types may be selected for helicopter transportation, resulting in delays locating a person floating in the ocean.

2.7.7 Emergency Underwater Breathing Aids

In this occurrence, it is likely that several of the occupants remained conscious after the impact with the water, eventually breaking their breath hold and drowning before they could egress from the sinking helicopter. Although the E-452 PTSS were not fitted with EUBAs, nor required to be by regulation, the addition of such equipment would increase the time available to escape from a helicopter that is submerged underwater by providing the user with breathable air. In the case of cold water shock, the involuntary reflex to gasp could be mitigated if the individual had a EUBA in place allowing them to take in air instead of water and possibly release their seatbelts and egress from the helicopter. There is no requirement for occupants of a helicopter to be equipped with EUBAs for prolonged over water flight. As a result, occupants are exposed to increased risk of drowning following a ditching or crash at sea.

2.7.8 Helicopter Pilot Helmets and Visors

Although not fatally injured during the impact sequence, both pilots received severe injuries due in part to striking their heads and faces against the instrument panel. In a similar event where the impact force were less, possibly in the 10g range, pilots without helmets and visors could still incur severe injuries and possibly be unable to provide assistance during the subsequent evacuation of the helicopter. As shown in this occurrence, without ongoing promotion of the benefits of head protection usage, helicopter pilots will continue to operate without head protection, increasing the risk of head injury and consequent inability to provide necessary assistance to crew or passengers. The lack of a requirement for pilots to wear helmets and visors places them at greater risk of incapacitation due to head injuries following a ditching or crash. This type of injury jeopardizes the pilots' ability to assist in the safe evacuation and survival of their passengers.

2.7.9 Emergency Flotation Systems

2.7.9.1 General

The majority of the occurrence helicopter's systems, including the emergency flotation system, were rendered inoperable at the time of impact because the impact forces caused the fuselage to immediately break up, which resulted in multiple breaks in the EFS system's associated wires, cables, and lines.

The electrical wiring to the immersion switches and the forward inflators were severed at numerous locations. As a result, no electrical power would have been available to activate the squib circuit and cause the inflators to release their charge. This is consistent with finding the bottles with a full charge. Even if the flotation EFS electrical wiring had not been damaged, and the squibs fired, the fractured lines would have prevented the gas from reaching, and inflating, the bags.

2.7.9.2 Adequacy of Emergency Flotation System Requirements for Helicopters

CHI91 was equipped with an EFS system certified for sea state WMO 4. Given the high probability of encountering sea state conditions greater than 4 (i.e., a "hostile environment") in the waters off Newfoundland, without the use of helicopters equipped to provide ditching stability in excess of sea state 4 conditions, immediate capsizing is highly probable, increasing the risk of loss of life during a ditching scenario.

It is unknown whether other helicopter operations are similarly at risk due to the use of helicopters fitted with standard emergency flotation equipment while operating over Canadian waters in which the prevailing sea state conditions exceed sea state 4 conditions.

2.7.9.3 Future EFS Research and Development

Occupant survival following a survivable helicopter crash at sea initially depends on the individual's ability to quickly exit the helicopter if it capsizes and begins to sink. Past accidents have shown that shock, disorientation, and the disabling effects of the impact on the occupants often adversely influence the outcome. In the event of a survivable crash at sea, a helicopter's EFS is one of the primary defences to reduce the possibility of occupant fatalities due to drowning.

Currently, EFS only need to meet the certification requirements for a controlled ditching, despite the fact that research has shown that crashes into the water happen almost as frequently as ditchings. In a crash situation, there is a risk that the EFS may be disabled by the impact forces and that the occupants drown before they can successfully escape from the sinking helicopter. The CHI91 accident is one example where occupants survived the crash impact only to drown in the rapidly sinking helicopter before they could escape.

This is due in part to enhanced over-land survivability features. Aircraft certified under Part 29 are designed with strict crash survivability requirements; however, these requirements are largely oriented towards an over-land crash scenario. In contrast, helicopters certified under Part 29 are not subject to a comparable level of over water crash survivability. Although studies like the WIDDCWG in 2000 have suggested structural ditching requirements should not be expanded, they have also suggested more work needs to be done to improve EFS crashworthiness by considering designs like the side-floating concept. As technology advances, the future may hold some promise for more robust EFS systems as ongoing research and development continues. If offshore helicopter EFS systems are only designed to withstand the force associated with a ditching there is a continued risk that these systems will be disabled in survivable impacts contributing to occupant deaths from drowning. While CHI91 is only the second offshore helicopter accident in Canada, there is an important risk due to the large numbers of workers being transported to offshore facilities not only in Canada but internationally.

2.7.9.4 Emergency Locator Transmitters

As identified by the CAA, helicopters typically have a high centre of gravity due to the weight of the engines and main rotor gearbox located on the cabin roof. Consequently, there is a strong likelihood that the helicopter will capsize in a ditching scenario in the absence of an effective EFS.

If an aircraft crash occurs over land, an ELT that survives a crash will normally transmit at full strength after the required 50-second delay. In a helicopter crash in water, there is a strong possibility that a fixed ELT antenna will end up below the surface of the water before the 50-second delay has elapsed. In this case, it is possible that the ELT signal will be badly attenuated and rendered incapable of detection by the COSPAS-SARSAT satellite system.

As shown in this occurrence, without an immediate signal being transmitted from an ELT installation, water attenuation of a useable ELT signal from a submerged aircraft may continue. This increases the risk of an ELT signal not being received and SAR resources not being launched in a timely manner.

2.8 Safety Management Systems

An effective SMS can be instrumental in detecting and mitigating deficiencies before they contribute to an accident if those processes are applied thoroughly and without biases. While SMS can reduce the potential for accidents by applying proactive safety processes, it would be unrealistic to expect that an SMS could prevent every accident. This occurrence highlights that vulnerability, as seen by the fact that both Sikorsky and Cougar Helicopters had safety management and risk management processes.

Cougar Helicopters had been in the process of implementing modern safety management concepts into its operations for several years; however its program was still not fully implemented and all the proactive elements were not yet being utilized effectively. It is likely that an operator with a fully mature SMS would have identified the need to apply hazard identification and risk management processes to all aspects of the introduction of a new helicopter, like the S-92A, into its operation. In this case, Cougar Helicopters believed that the manufacturer's and regulator's own safety processes had mitigated all potential risks. Despite Cougar Helicopters' commitment to SMS, some additional risks associated with its operation went undetected prior to this occurrence, including flight crew immersion suit maintenance, MGB inspection procedures, CRM training, checklist revision practices, and emergency procedures training conducted during annual and recurrent simulator training.

A fully functioning safety management process would be expected to rigorously challenge and validate any underlying assumptions about safety risks. Sikorsky did not identify any unacceptable risk in using titanium studs on the MGB filter bowl, primarily because of satisfactory prior service experience on other Sikorsky helicopter models. Following the loss of lubricant test resulting in catastrophic failure of the MGB, Sikorsky invoked the "extremely remote" rationale permitted under the requirements of Part 29.927(c)(1). Sikorsky and the FAA concluded that, except for a potential failure of the oil cooler and its exterior plumbing, all other MGB failures leading to a total loss of oil were extremely remote. Neither the FAA nor Sikorsky specifically considered a failure in the MGB oil filter bowl assembly, or its attaching fasteners, in the context of Part 29.927(c)(1). Following the Australian occurrence, Sikorsky identified and mitigated the risk of galled studs by implementing AMM revision 13. However the communication of the rationale for this revision and the guidance in the associated maintenance manual revision proved ineffective in stressing the potential consequences of non-compliance.

3.1 Findings as to Causes and Contributing Factors

1. Galling on a titanium attachment stud holding the filter bowl assembly to the main gearbox (MGB) prevented the correct preload from being applied during installation. This condition was exacerbated by the number of oil filter replacements and the re-use of the original nuts.
   
2. Titanium alloy oil filter bowl mounting studs had been used successfully in previous Sikorsky helicopter designs; in the S-92A, however, the number of unexpected oil filter changes resulted in excessive galling.
3. Reduced preload led to an increase of the cyclic load experienced by one of the titanium MGB oil filter bowl assembly attachment studs during operation of CHI91, and to fatigue cracking of the stud, which then developed in a second stud due to increased loading resulting from the initial stud failure. The two studs broke in cruise flight resulting in a sudden loss of oil in the MGB.
   
4. Following the Australian occurrence, Sikorsky and the Federal Aviation Administration (FAA) relied on new maintenance procedures to mitigate the risk of failure of damaged mounting studs on the MGB filter bowl assembly and did not require their immediate replacement.
5. Cougar Helicopters did not effectively implement the mandatory maintenance procedures in Aircraft Maintenance Manual (AMM) Revision 13 and, therefore, damaged studs on the filter bowl assembly were not detected or replaced.
6. Ten minutes after the red MGB OIL PRES warning, the loss of lubricant caused a catastrophic failure of the tail take-off pinion, which resulted in the loss of drive to the tail rotor shafts.
7. The S-92A rotorcraft flight manual (RFM) MGB oil system failure procedure was ambiguous and lacked clearly defined symptoms of either a massive loss of MGB oil or a single MGB oil pump failure. This ambiguity contributed to the flight crew's misdiagnosis that a faulty oil pump or sensor was the source of the problem.
8. The pilots misdiagnosed the emergency due to a lack of understanding of the MGB oil system and an over-reliance on prevalent expectations that a loss of oil would result in an increase in oil temperature. This led the pilots to incorrectly rely on MGB oil temperature as a secondary indication of an impending MGB failure.
9. By the time that the crew of CHI91 had established that MGB oil pressure of less than 5 psi warranted a "land immediately" condition, the captain had dismissed ditching in the absence of other compelling indications such as unusual noises or vibrations.
10. The captain's decision to carry out pilot flying (PF) duties, as well as several pilot not flying (PNF) duties, resulted in excessive workload levels that delayed checklist completion and prevented the captain from recognizing critical cues available to him.
11. The pilots had been taught during initial and recurrent S-92A simulator training that a gearbox failure would be gradual and always preceded by noise and vibration. This likely contributed to the captain's decision to continue towards CYYT.
12. Rather than continuing with the descent and ditching as per the RFM, the helicopter was levelled off at 800 feet asl, using a higher power setting and airspeed than required. This likely accelerated the loss of drive to the tail rotor and significantly reduced the probability of a successful, controlled ditching.
13. The captain's fixation on reaching shore combined with the first officer's non-assertiveness prevented concerns about CHI91's flight profile from being incorporated into the captain's decision-making process. The lack of recent, modern, crew resource management (CRM) training likely contributed to the communication and decision-making breakdowns which led to the selection of an unsafe flight profile.
14. The throttles were shut off prior to lowering the collective, in response to the loss of tail rotor thrust. This caused significant main rotor rpm droop.
15. The pilots experienced difficulties controlling the helicopter following the engine shut-down, placing the helicopter in a downwind autorotative descent with main rotor rpm and airspeed well below prescribed RFM limits. This led to an excessive rate of descent from which the pilots could not recover prior to impact.
16. The severity of the impact likely rendered some passengers unconscious. The other occupants seated in the helicopter likely remained conscious for a short period of time, but became incapacitated due to the impact and cold water shock, and lost their breath hold ability before they could escape the rapidly sinking helicopter.

3.2 Findings as to Risk

1. Certification standards for Category A rotorcraft do not require a capability of continued safe operation for 30 minutes following a failure that leads to loss of MGB lubricant if such failures are considered to be extremely remote, placing passengers and crew at risk.
   
2. In distant offshore operations, including the East Coast of Canada, a 30-minute run dry MGB capability may not be sufficient to optimize eventual landing opportunities.
   
3. Inadequate systems knowledge related to abnormal and emergency conditions increases the risk of pilots relying on previously learned knowledge. This could lead to unintentional errors in interpreting symptoms of a system malfunction.
4. The decision not to identify time critical actions as memory items in the S-92A MGB malfunction procedure could lead to delays in carrying out actions that are vital to the safe continuation of flight.
5. The decision not to automate an emergency system activation, such as the MGB oil bypass system in the S-92A, increases the risk that critical actions will be omitted or delayed unnecessarily.
6. The lack of established standards for landing guidance definitions used in abnormal and emergency procedures leaves the definitions open to misinterpretation.
7. The lack of specific guidance and/or recommendations in the RFM pertaining to optimum airspeed and torque setting could result in the selection of a flight profile that accelerates the catastrophic failure of a gearbox that has lost oil pressure.
8. The combination of abnormal and emergency procedures into a single procedure, which focuses first on the abnormal condition, increases the risk that critical emergency actions will be delayed or omitted.
9. If manufacturers do not clearly identify critical aircraft performance capabilities in flight manuals, such as run dry time, there is increased risk that pilots will make decisions based on incomplete or inaccurate information during abnormal and emergency situations.
10. The omission of caution or warning messages from a quick reference legend could result in delays in locating the appropriate abnormal or emergency response in a pilot checklist.
11. The use of non-current publications such as RFM, standard operating procedures (SOPs) and checklists, increases the risk that critical steps of an approved procedure will be omitted or delayed.
12. Under the current regulations, CAR 703 and 704 operators are not required to provide CRM. As a result, there is an increased risk that crews operating under CAR 703 or 704 will experience breakdowns in CRM.
13. The current CRM regulation and standard for CAR 705 operators have not been updated to reflect the latest generation of CRM training or to include CRM instructor accreditation. As a result, there is a risk that flight crews may not be trained in the latest threat and error management techniques.
14. The current basic survival training (BST) standards in Canada lack clearly defined, realistic training standards and equipment requirements. This could lead to differences in the quality of training and affect occupant survivability.
15. An interval of 3 years between recurrent BST may result in an unacceptable amount of skill decay between recurrent training sessions. This skill decay could reduce the probability of successful egress from a submerged helicopter.
16. Passenger Transportation Suit Systems (PTSS) designed to meet the standard for marine abandonment have high buoyancy and flotation capabilities. While useful in a marine abandonment situation, these features may interfere with a successful egress from a submerged helicopter.
17. There are minimal regulations and standards pertaining to offshore helicopter flight crew suit use and maintenance. This increases the risk that flight crews will be inadequately protected following a ditching or crash at sea.
18. Offshore helicopter flight crew suits that are not a high visibility colour reduce the probability of detection by search and rescue crews following a ditching or crash at sea. This could significantly delay rescue at night or in bad visibility.
19. Without regulations and standards pertaining to personal locator beacons (PLB) for helicopter occupants, inappropriate PLB types may be selected for helicopter transportation, resulting in delays locating a person floating in the ocean.
20. The use of improper passenger transportation suit system (PTSS) fitting techniques may result in unacceptable levels of water ingress and a subsequent rapid loss of body temperature, following a ditching or crash at sea.
21. There is no requirement for occupants of a helicopter to be equipped with EUBAs for prolonged over water flight. As a result, occupants are exposed to an increased risk of drowning following a ditching or crash at sea.
22. The lack of regulation requiring pilots to wear helmets and visors places them at greater risk of incapacitation due to head injuries following a ditching or crash. This type of injury jeopardizes a pilot's ability to assist in the safe evacuation and survival of the passengers.
23. Ditching in adverse weather conditions, and sea states in excess of the capability of the emergency flotation system (EFS), places passengers and crew at risk.
24. If offshore helicopter EFS systems are only designed to withstand the force associated with a ditching, there is a continued risk that these systems will be disabled in survivable impacts contributing to occupant deaths from drowning.
25. Without an immediate signal being transmitted from an emergency locator transmitter (ELT), water attenuation of a useable ELT signal from a submerged aircraft may continue. This increases the risk of an ELT signal not being received and SAR resources not being launched in a timely manner.
26. The use of g-switches for the purpose of stopping a cockpit voice recorder (CVR) or combined CVR/FDR (flight data recorder) will likely continue to result in the loss of potentially valuable CVR or CVR/FDR data. As a result, there is an increased risk that future accident investigations will be impeded.

3.3 Other Findings

1. The survivor likely lived through the accident due to his age, fitness, mental preparation, recent helicopter underwater escape training (HUET), previous cold water acclimatization, and a strong will to survive.
2. It could not be determined why the survivor's body temperature dropped 7.2°C so quickly in the time he was exposed to water temperatures in the 0.2°C range.
3. Both organizations providing BST training in Canada met or exceeded the current BST training standards.
4. The E-452 PTSS met the Canadian General Standards Board (CGSB) standards and was considered adequate for the risks of the operational environment at the time of the occurrence.

4.1 Action Taken

4.1.1 Transportation Safety Board of Canada

4.1.1.1 Aviation Safety Advisory A09A0016-D2-A1

On 30 October 2009, the TSB issued Aviation Safety Advisory A09A0016-D2-A1 (Low Usage of Head Protection by Helicopter Pilots), to Transport Canada and to the Helicopter Association of Canada. The Safety Advisory indicated that these organizations may wish to consider creating an advocacy program designed to substantially increase head protection use amongst helicopter pilots.

Following the issue of A09A0016-D2-A1, Transport Canada reprinted the advisory in its entirety in its Aviation Safety Letter (ASL 2/2010). In the associated article, titled Helicopter Safety Helmets-A Hard S(h)ell they expanded on the issue, stating: "This is one proven but overlooked safety innovation that greatly increases accident survivability and resulting quality of life, and it is fully supported by TC."

4.1.1.2 Aviation Safety Advisory A09A0016-D3-A1 (A2-A3)

On 07 December 2009, the TSB issued Aviation Safety Advisory A09A0016-D3-A1 (Sizing of Passenger Transportation Suit System) to Transport Canada, A09A0016-D3-A2 to the Federal Aviation Administration, and A09A0016-D3-A3 to the European Aviation Safety Agency. The Safety Advisory indicated that the addressees may wish to inform offshore operators about the importance of confirming appropriate PTSS sizes.

TC ensured that Canadian operators who were conducting overwater flights and using helicopter transportation suits, or survival suits, received a copy of the TSB Aviation Safety Advisory. TC also informed national aviation associations such as the Helicopter Association of Canada, the Northern Air Transport Association, the Air Transport Association of Canada, and the Association québécoise du transport aérien of the TSB Aviation Safety Advisory.

A response, dated 23 March 2010 was received from the Head of Products Department in the Certification Directorate of the European Aviation and Safety Agency (EASA) stating that "European immersion suit manufacturers consider the fit of an immersion suit to be critical, both in terms of garment and seals, in exceeding airworthiness compliance with the ETSO (previous UK CAA Specification No. 19)". It advised that "European ETSOA holders for immersion suits had been made aware of Safety Advisory A09A0016-D3-A3 to carefully consider the issue of suit sizing in their present and future design as well for the operation of their suits".

4.1.1.3 Aviation Safety Advisory A09A0016-D1-A1

On 04 January 2010, the TSB issued Aviation Safety Advisory A09A0016-D1-A1 (Sikorsky S-92A Main Gear Box Oil Bypass Switch - Manual Activation) to Sikorsky Aircraft Corporation. The Safety Advisory indicated that Sikorsky Aircraft Corporation, in coordination with the Federal Aviation Administration, may wish to consider the incorporation of a system to automatically activate the main gearbox (MGB) oil bypass switch as part of the Sikorsky S-92A helicopter design.

4.1.1.4 Aviation Safety Advisory A09A0016-D4-A1

On 31 March 2010, the TSB issued Aviation Safety Advisory A09A0016-D4-A1 (Adequacy of Emergency Flotation System Requirements for Helicopters) to Transport Canada. The Safety Advisory indicated that Transport Canada may wish to consult with helicopter operators to ensure that their helicopters are equipped with emergency flotation equipment appropriate for the prevailing sea state conditions over which they operate.

After receiving the TSB Aviation Safety Advisory, Transport Canada Aircraft Certification researched and reviewed the information in the letter and decided to instruct all Helicopter Regional Superintendants to forward a copy of the Safety Advisory to all helicopter operators who might be involved in offshore operations. The purpose of Transport Canada's letter was to remind carriers operating in the offshore environment that they should assess their particular areas of operation and ensure that their helicopters are equipped with emergency flotation equipment appropriate for the prevailing sea state conditions.

4.1.2 Federal Aviation Administration

4.1.2.1 Special Airworthiness Information Bulletin SW-09-19

On 19 March 2009, the Federal Aviation Administration (FAA) issued Special Airworthiness Information Bulletin SW-09-19 reminding operators to follow the approved S-92A RFM and not the procedures in Sikorsky Safety Advisory SSA-S92-08-006 issued on 26 September 2008 that suggested forthcoming FAA RFM changes pertaining to MGB emergency procedures.

4.1.2.2 Emergency Airworthiness Directive 2009-07-53

On 23 March 2009, the FAA issued Emergency Airworthiness Directive (AD) 2009-07-53 for Sikorsky S-92A helicopters, which required, before further flight, removing all titanium studs that attach the MGB filter bowl assembly to the MGB and replacing them with steel studs. This AD was superseded by AD 2009-13-01, dated 16 June 2009, which required the same actions as the existing AD as well as changes to the Rotorcraft Flight Manual (RFM).

4.1.2.3 S-92A Rotorcraft Flight Manual Revisions

On 13 May 2009, the Federal Aviation Administration approved the RFM revisions for normal and emergency crew procedures for MGB malfunctions. On 16 June 2009, the Federal Aviation Administration issued AD 2009-13-01 implementing the RFM revisions effective 01 July 2009. The preamble of the AD was as follows:

This amendment is prompted by an accident, by recent RFM changes made by the manufacturer that were not available when we issued the existing AD, and by our determination that certain MGB Normal and Emergency procedures in the RFM are unclear, may cause confusion, and may mislead the crew regarding MGB malfunctions, in particular the urgency to land immediately after warning indications of loss of MGB oil pressure and oil pressure below 5 pounds per square inch (psi).

The revised RFM included guidance to pilots that a total loss of MGB oil pressure may result in MGB failure in less than 10 minutes.

4.1.2.4 Airworthiness Directive (AD) 2009-25-10

On 25 November 2009, the Federal Aviation Administration issued Airworthiness Directive (AD) 2009-25-10 to mandate a one-time visual inspection of the MGB lube system filter assembly for S-92A serial numbers 920006 through 920109 within seven days. This AD preamble indicated the amendment was prompted by three reports of damaged oil filters or packings resulting from operating with an oversized packing possibly because of incorrect part numbers in the maintenance manual. If damage to either the primary or secondary oil filter was detected then both filters, all packings, and the studs had to be replaced before further flight. The oil filter bowl was also to be replaced within 30 days after replacing a damaged filter and a daily inspection for an oil leak was to be conducted during that 30-day interim period. This inspection to detect damage to the primary and secondary oil filters was implemented to prevent the complete loss of oil from the MGB, failure of the MGB, and subsequent loss of control of the helicopter.

4.1.2.5 Airworthiness Directive (AD) 2010-10-03

On 27 April 2010, the Federal Aviation Administration issued Airworthiness Directive (AD) 2010-10-03 making it mandatory to replace the MGB filter bowl assembly with a two-piece MGB filter bowl assembly and to replace the existing mounting studs. The AD specified that these actions are intended to prevent failure of the MGB filter bowl assembly due to failure of the mounting studs or the filter bowl, loss of oil from the MGB, failure of the MGB, and subsequent loss of control of the helicopter.

4.1.3 European Aviation Safety Agency

On 17 March 2009, the European Aviation Safety Agency issued Safety Information Bulletin (SIB) 2009-05 which advised S-92A operators it supported CCS-92A-AOL-09-0008 but not SSA-S-92A-08-006 which referred to RFM amendments not yet approved by the Federal Aviation Administration. Since EASA believed that operators could interpret the SSA as being mandatory and not just advance notice of proposed changes, EASA instructed its operators to continue following the procedures in the approved RFM.

On 08 October 2009, EASA issued AD 2009-0217-E - Main Rotor Drive - Main Gearbox (MGB) Lubrication System Filter Components - One-Time Inspection. This Emergency AD required "a one-time inspection of the primary and secondary filter elements for damage and, if any damaged filter elements were found, the replacement of the filter bowl studs and the affected filter elements". This AD was cancelled on 21 December 2009 after EASA adopted FAA AD 2009-25-10.

On 26 January 2010, EASA issued AD 2010-0015 - Main Rotor Drive - Main Gearbox (MGB) Filter Bowl Assembly - Replacement. This AD called for the following, unless previously accomplished:

1. Within the next 100 flight hours or 60 days, whichever occurs first after the effective date of this AD, replace the P/N 92351-15802-101 MGB Lubrication System Filter Bowl Assembly with a P/N 92351-15802-106 MGB Lubrication System Filter Bowl Assembly, in accordance with the instructions of Sikorsky Alert Service Bulletin (ASB) 92-63-022A.
2. Modification of a helicopter, prior to the effective date of this AD, in accordance with Sikorsky ASB 92-63-022 dated 10 December 2009, constitutes compliance with the requirements of paragraph (1) of this AD.
3. After the effective date of this AD, do not install a MGB Lubrication System Filter Bowl Assembly P/N 92351-15802-101 on any helicopter.

AD 2010-0015 was cancelled on 21 May 2010 after EASA adopted FAA AD 2010-10-03.

4.1.4 Cougar Helicopters Inc.

4.1.4.1 SMS Enhancement

In June 2009, Cougar Helicopters introduced a more detailed and robust SMS designed to bring all departmental safety practices together. Aviation safety, occupational safety, and maintenance quality assurance were combined into one program called the Cougar Integrated Safety Management System (ISMS). The combined program allows a documented, comprehensive approach throughout company operations leading to better internal communications and more effective safety action.

4.1.4.2 Pilot Helmet Use

Cougar Helicopters Inc. implemented a non-mandatory cost sharing program aimed at increasing the use of helmets. Management agreed to cover a portion of the cost for any pilot wishing to purchase a specific helmet make and model. The model includes a protective visor. This cost sharing program has increased helmet use within Cougar Helicopters to approximately 64%.

4.1.4.3 Lifesaving Equipment Tracking System

Cougar Helicopters implemented a Lifesaving Equipment Tracking System (LETS). The LETS tracks scheduled and completed maintenance for pilot and rescue specialist flotation vests, pilot and rescue specialist suits, helmets and personal locator beacons.

4.1.4.4 Flight Crew Attire

Cougar Helicopters standardized the flight crew attire. All pilots now wear either a specified Nomex suit or a specified immersion suit depending on the operation.

4.1.4.5 New Crew Flotation Vest

Cougar Helicopters introduced a new flotation vest. The HV-35C helicopter crew vest features include reflective edging, a knife, a signalling mirror, a whistle, and a dedicated space for an emergency underwater breathing apparatus (EUBA).

4.1.4.6 Amended S-92A Normal and Emergency Checklists

Cougar Helicopters revised and amended the pilot normal and emergency checklists in consultation with Transport Canada.

4.1.4.7 Descent Profile for a MGB Oil Pressure Loss

Cougar Helicopters developed a descent profile for a MGB Oil Pressure Loss in consultation with Transport Canada that was tested and validated in a simulator.

4.1.4.8 Passenger Swimming Mask Position

Cougar Helicopters moved the swimming masks to be used by the passengers in case of a ditching from under passenger seats to a more accessible location.

4.1.4.9 First Response (SAR) Deployment Time

In response to an interim recommendation from the Offshore Helicopter Safety Inquiry, Cougar Helicopters has reduced the first response (SAR) deployment time required by the offshore operators by adding staff and a helicopter dedicated to the task. There are pilots and rescue specialists dedicated to that service.

4.1.4.10 S-92A MGB Oil Change Task Card

Cougar Helicopters revised the scheduled Task Card (T/C) Work Specification for a S-92A MGB Oil Change to include the following: record the initial breakaway torque of nuts removed; inspect mounting studs IAW S-92AA AMM 63-24-02-001 and measure and record run-on torque for installed nuts.

4.1.4.11 Cougar Helicopters CRM Training Program and Instructor

As part of its on-going effort to establish an effective in-house crew resource management (CRM) training program, Cougar Helicopters has hired a dedicated pilot to develop and oversee a specialized CRM training program that meets the unique needs of the offshore environment. This individual has completed a CRM instructor course that meets the basic training prerequisites for someone seeking accreditation by the United Kingdom Civil Aviation Authority (CAA) as a CRM instructor. A comprehensive program has been proposed, and accepted by Cougar Helicopters.

4.1.4.12 Established CRM Training Requirements

Cougar Helicopters has formally established initial and recurrent CRM training requirements in the Company Operations Manual (COM). Chapter 8 of the COM has been updated to require initial hires to undergo 6 hours of CRM training. In addition to the initial CRM training requirements, the COM has been updated to include a requirement for all Cougar Helicopters' pilots to complete 2 hours of recurrent CRM training each year.

4.1.4.13 Five-bag EFS Kits

In the summer of 2010, Cougar Helicopters installed the five-bag EFS kits on three of its S-92As based in St. John's. A fourth kit is on order with an expected delivery date of January 2011. This fourth kit will be installed on another St. John's based S-92A at the first available opportunity. As a result, 75% of Cougar Helicopters' St. John's based S-92A fleet is now equipped with the five-bag EFS.

4.1.5 Sikorsky Aircraft Corporation

4.1.5.1 Sikorsky CCS-92A-AOL-09-0008

On 14 March 2009, Sikorsky issued CCS-92A-AOL-09-0008 which provided some preliminary information about the accident, specifying that compliance with publications including the Maintenance Manual, Operating Manual, Alert Service Bulletins, and Sikorsky Safety Advisories is essential.

4.1.5.2 Alert Service Bulletin no. 92-63-014A

On 20 March 2009, Sikorsky issued Alert Service Bulletin no. 92-63-014A Revision A which describes procedures for removing titanium studs and replacing them with steel studs.

4.1.5.3 New S-92A Two-piece MGB Filter Bowl

Sikorsky has designed, qualified, and fielded a new two-piece filter bowl, using six replaceable nut and bolt fasteners. The new two-piece filter bowl replacement became mandatory with the issuance of FAA AD 2010-10-03.

4.1.6 Marine Institute

EUBA training was integrated into all offshore helicopter training as of 11 May 2009. In addition, engineering work that will allow the installation of a current generation simulator with four-point harnesses has been completed.

4.1.7 Survival Systems Training Limited

EUBA training has been added to BST courses. Underwater escape skills specific to the S-92A helicopter were developed and tested and resulted in new training protocols. All workers are now required to egress from a fully stroked seat position.

4.1.8 Helly Hansen

4.1.8.1 PTSS Suit Sizing Policy

Beginning 18 May 2009, Helly Hansen assisted Cougar Helicopters personnel in ensuring that all offshore employees were wearing a PTSS of the appropriate size. The resizing was completed by performing a functional assessment of the PTSS that included ensuring adequate seals around the wrists and face as well as appropriate mobility. When the seals or mobility were less than adequate, passengers underwent a full body measurement. The fit checks revealed that approximately 250 of the 1600 regular rotation offshore workers were wearing improperly fitted PTSS.

This issue was corrected, in many cases, by issuing a smaller standard PTSS size or by special modifications to a PTSS such as the substitution of a smaller hood. It was anticipated that less than 1% of the workforce would require fully customized PTSS.

4.1.8.2 Cougar Helicopters Personnel Training on PTSS

Helly Hansen provided training to Cougar Helicopters personnel during the resizing initiative to ensure that they would be able to continue to provide correct PTSS sizes. Helly Hansen transferred the resizing process to Cougar Helicopters.

4.1.8.3 New PTSS

Helly Hansen introduced a modified E-452 PTSS, called the HTS-1, to address some of the sizing issues found in the resizing process. The HTS-1 has an internal adjustable suspension system that adjusts the suit length to allow for a better fit. It has a new hood design with an adjuster that improves the face seal of the hood. The HTS-1 has redesigned wrist cuffs to accommodate a wider range of fit and has options to interchange different wrist cuff, boot, and hood sizes to tailor the fit of a suit to an individual user. Water leakage was reduced; this allowed torso area insulation to been removed, thereby diminishing the bulkiness and heat stress.

4.1.9 East Coast Offshore Operators

On 18 May 2009, the east coast offshore oil rig operators began supplying Survival Egress Air LV2 (SEA LV2) emergency underwater breathing apparatus (EUBA) systems to all passengers following orientation sessions which included offshore briefings and demonstrations, heliport check-in briefings, and mandatory in-water training. The SEA LV2 is a compressed air device and the bottle is affixed to the chest area of the PTSS. The unit provides approximately 21 breaths based on an average breath volume of 1.5 litres at a breath rate of 10.5 breaths per minute, which equates to approximately 2 minutes of air.

4.1.10 Canadian General Standards Board

Preceding a November 2009 meeting of the CGSB committee on immersion suits, committee members submitted comments for discussion to the CGSB working group. The comments suggested improvements such as:

• Updated PTSS testing protocols, survival criteria, formulas, and requirements of the standard to reflect recent findings on leakage testing and thermal protection in wind and wave environmental conditions;
• Determining if a single PTSS should be allowed to meet both standards: (1) Helicopter Passenger Transportation Suit Systems (CAN/CGSB-65.17-99), and (2) Immersion Suit Systems (CAN/CGSB-65.16-2005);
• Maintaining the consideration that user comfort was secondary to safety;
• Changing PTSS sizing guidelines to include more dimensions than height and weight only;
• Testing of PTSS sized to individual users;
• Testing of snag hazards;
• Adding the requirement for personal locator beacons (PLBs) and EUBAs on the PTSS;
• Including design standards for PLBs and EUBAs;
• Considering a reduction to the maximum escape buoyancy to further facilitate egress as well as revising the testing procedure for escape buoyancy; and
• Revising the maximum donning time of a PTSS worn unsealed during flight.

A committee draft was posted for committee input on 19 October 2010 and further work is being conducted on a number of technical issues. A draft revision is currently scheduled to be issued to the Committee at the end of March or early April 2011. The Committee is next scheduled to meet 14 to 17 June 2011, to review the comments received on the revision.

4.1.11 Marine Rescue Technologies Ltd.

The manufacturer has introduced a new personal locator beacon model, AU9-HT, designed to fulfill the requirement of the offshore helicopter transit market. The AU9-HT's antenna fits directly into the PLB casing using a high strength adhesive to seal the connection. The front button recess has been updated to include a flange and lip over which the button sits. The unit has been pressure tested to 75 m depth and is made of fire retardant materials.

4.1.12 C-NLOPB Offshore Helicopter Safety Inquiry (OHSI)

On 08 April 2009, the C-NLOPB established an Inquiry into Matters Respecting Helicopter Passenger Safety for Workers in the Newfoundland and Labrador Offshore Area, "to inquire into, report on, and make recommendations in respect of:

1. safety plan requirements for Operators and the role that Operators play in ensuring that their safety plans, as represented to and approved by the Board are maintained by helicopter operators;
2. search and rescue obligations of helicopter operators by way of contractual undertakings or legislative or regulatory requirements;
3. the role of the C-NLOPB and other regulators in ensuring compliance with legislative requirements in respect of worker safety."

4.1.13 Flight Safety International

Flight Safety International has amended their initial and recurrent ground school and simulator training programs to emphasize that the S-92A main gearbox oil temperature sensors are "wet bulb" systems which require some presence of oil to indicate properly and that MGB oil temperature indications will be unreliable following a complete loss of MGB oil pressure.

4.2 Action Required

4.2.1 Main Gearbox Certification

The last major update of rotorcraft airworthiness standards took place in the 1980s.This update flowed from the phenomenal growth of the rotorcraft industry and the recognition by the U.S. government and industry that existing certification rules had been outdated by rapidly advancing rotorcraft technology. The rules specifically recognized the need for a high level of safety in the design requirements for rotorcraft.

The update of the design requirements for large, multiengine transport rotorcraft (Category A) recognized the need for main gearboxes (MGB) to have a significant capacity to operate following a loss of lubricant in order to optimize eventual landing opportunities. This consideration led directly to the introduction of the 30 minute requirement to operate after a loss of MGB lubricant. However the introduction of the "extremely remote" concept following the comment phase of the rule-making made it possible for a helicopter to be certified without being capable of operating for 30 minutes with only residual lubricant. Category A rotorcraft certified under the "extremely remote" criteria may not be capable of continued operation for 30 minutes with only residual lubrication. These helicopters remain vulnerable to gearbox failures stemming from unforeseen massive losses of MGB lubricant, placing passengers and crew at risk.

Therefore, the Board recommends that:

The 1980s update provided for the optional certification of dual engine helicopters to permit continuous operation in the event of an engine failure to complete the flight with the remaining engine. This rule supplemented the existing optional certification rule which provided 30 minutes of operation following one engine failure. In support of the proposed rule the FAA stated:

Originally, the 30-minute rating was adequate for the relatively short route structure of first generation helicopter air carrier service. Industry needs for the new "continuous OEI [One Engine Inoperative] rating" were generated primarily by the extensive operation of helicopters serving the distant offshore petroleum drilling and services activities. Many, if not most, of these activities involved dispatching helicopters on route structures which precluded a planned landing within 30 minutes in the event of engine failure.

Another change introduced was the 30-minute run dry provision for MGB. This rule was justified on the grounds that Category A helicopters must have a significant continued flight capability after a failure in order to optimize eventual landing opportunities.

Since the last major update of certification rules, there have been continued improvements in technology. At the same time, the helicopter industry has grown with the increased use of large, transport helicopters in the offshore sector. The original 1980s rationale for increasing safety margins remains valid today.

If a helicopter has to ditch in hostile waters such as those off the Canadian east coast, the occupants are at considerable risk. Many of these offshore facilities now have flight times over 2 hours and future development of offshore petroleum resources include plans for facilities even further from land.

Available information indicates that other helicopters are now capable of run dry performances that exceed 30 minutes. It may now be both technically feasible and economically justifiable to produce a helicopter that can operate over 30 minutes following a massive loss of MGB lubricant.

Therefore, the Board recommends that:

4.2.2 Safe Ditching and Successful Evacuation

Overwater helicopter operations transporting passengers to and from offshore oil and gas installations occur with the knowledge that an emergency situation may arise requiring a forced landing or ditching. In such circumstances the first priority must be preservation of life and safety of the passengers and crew.

Most helicopters in use to support the global offshore oil and gas industry, including the S-92A, have an emergency flotation system (EFS) which provides adequate ditching stability in "reasonably probable water conditions" of at least sea state 4 WMO and is intended to keep the helicopter upright while occupants escape to the life rafts.

However, helicopters frequently operate over water where the conditions exceed sea state 4 WMO. For instance, in the waters off Newfoundland, statistics from Environment Canada indicate that sea state 4 is exceeded approximately 50% of the time over the course of the entire year, and 83% of the time between December and February. Sea state 6 WMO, by comparison, is exceeded much less frequently; 3.3% over the year and 8.9% between December and February.

Twin-engine helicopters typically have a high center of gravity because of the weight of the engines and the main rotor gearbox located on the cabin roof. Consequently, there is a strong likelihood that these helicopters will capsize after ditching unless they are equipped with an EFS which is appropriate for the prevailing sea state.

When EFS systems do not operate successfully, twin-engine helicopters invariably turn upside down, leading to complete flooding of the cabin and immersion of all doors and windows. Escape is very difficult because all escape routes are submerged and occupants who do not escape from the cabin within a matter of seconds will drown.

Although some steps have been taken in Newfoundland to ensure EFS capability for sea states beyond sea state 4, helicopter crews and passengers in Canada remain at risk where helicopters are operated over sea states exceeding the capability of the EFS.

Therefore, the Board recommends that

4.2.3 Emergency Underwater Breathing Apparatus

Drowning is the leading cause of death following a helicopter ditching or water impact and was the cause of all 17 fatalities on CHI91. It is likely that several of the occupants remained conscious after water impact, eventually breaking their breath-holds due to cold water shock and drowning before they could egress the sinking helicopter. The occupants who remained seated had no means of extending the breathing time available in which to release their seatbelts and escape.

Research has determined that 29 to 92 seconds are normally required for an occupant to escape from a submerged helicopter. One study has shown that the median breath-holding time of 228 offshore oil workers immersed in warm 25°C water was 37 seconds. By comparison, the water temperatures of the North Atlantic off Newfoundland average between 1°C and 2°C during the winter months and between 12°C and 14°C in the summer. As water temperature decreases, so does the average breath-hold time. Breath-hold decreases rapidly once the water temperature drops below 15°C. In near freezing water, breath-hold drops as low as 5 to 10 seconds. At the time of the occurrence, the water temperature was approximately 0°C-making escape almost impossible, even for a fit person well trained in escaping from a submerged helicopter.

Each year, several thousand individuals are transported multiple times by helicopter over cold water to and from offshore facilities in Canada. Without a supplemental breathing system, occupants have very little time to egress from a submerged or capsized helicopter before breaking their breath-holds. In Newfoundland, these offshore workers are now being provided with an emergency underwater breathing apparatus (EUBA) system. Because the issue was left to offshore oil regulators, however, there is no uniformity in the practice. This means there will continue to be overwater helicopter operations in other regions of Canada that may not provide this system to their passengers.

Helicopter passengers are required by regulation to wear a passenger transportation suit system (PTSS) whenever their flight is an extended one over cold water. Currently, however, there is no comparable requirement for an EUBA for use in an emergency. As a result, occupants are exposed to increased risk of drowning following a ditching or a crash at sea.

Therefore, the Board recommends that:

4.2.4 Rotorcraft Flight Manuals - Inclusion of Run Dry Time

Rotorcraft manufacturers are not required to include information in rotorcraft flight manuals (RFM) identifying a helicopter's demonstrated ability to continue safe operation, using only residual oil, after a flight crew determines that the MGB lubrication system has failed or lost lubricant. This is commonly referred to as a "run dry" time, and is valuable information that can assist pilots during a MGB abnormal or emergency situation.

Since it is not mandatory to include the run dry time in the RFM, some manufacturers do not make that information readily available to pilots, either in the applicable emergency procedure or in RFM aircraft limitation/performance sections. Following this occurrence, the S-92A gearbox malfunctions section was amended to include a statement which advised pilots that a total loss of MGB oil pressure may result in MGB failure in less than 10 minutes.

The availability of run dry limitations in the RFM can serve to emphasize the importance of adopting the preferred flight profile in the event of a loss of lubricant. Further, this information may influence pilot decision making regarding the need to expedite a landing in an inhospitable area rather than attempting to continue flight. This is particularly important in those instances where an aircraft has been certified without demonstrating that it was capable of continued safe operation, using only the system's residual oil, for at least 30 minutes after a flight crew detects the lubrication system failure or loss of lubricant.

Therefore, the Board is concerned that pilots may not have information about a helicopter's run dry capability and that this could adversely affect crew decision making.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 29 December 2010.

Appendix A - List of TSB Laboratory Reports

The following TSB Engineering Branch Laboratory Reports were completed:

• LP 030/2009 – FDR/CVR Analysis
• LP 033/2009 – Gear Box Failure
• LP 035/2009 – Examination of MGB Components
• LP 036/2009 – Instrument Examination
• LP 037/2009 – MPFR Power Interruption
• LP 038/2009 – NVM Recovery
• LP 041/2009 – PLB Examination
• LP 067/2009 – CVR Download & Transcript
• LP 091/2009 – Examination of Oil Filter and Studs
• LP 092/2009 – Determination of Impact Acceleration & Orientation
• LP 098/2009 – Engines & APU Examination
• LP 131/2009 – Examination of Floatation and Fire Extinguisher Systems
• LP 132/2009 – Video Image Capture
• LP 055/2010 – Map of Accident Location

These reports are available from the Transportation Safety Board of Canada upon request.

Appendix B - Last 12 Minutes of Occurrence Flight (FDR Data)

Appendix C - Last 50 Seconds of Occurrence Flight (HUMS Data)

Appendix D - S-92A MGB Malfunction from RFM

Appendix E - Cougar S92A Pilot Checklist Lights and Messages

Appendix F - Glossary

AAIB

Air Accident Investigation Branch

AC

alternating current

ACC

area control centre

ACP

Approved Check Pilot

AD

Airworthiness Directive

ADELT

automatic deployable ELT

am

morning

AMM

Aircraft Maintenance Manual

APU

auxiliary power unit

AQP

Advanced Qualification Program

ASB

Alert Service Bulletin

asl

above sea level

ASL

Aviation Safety Letter

ATC

air traffic control

ATPL

airline transport pilot licence

ATSB

Australian Transport Safety Bureau

AWL

above water level

AWS

automated warning system

BST

basic survival training

BST(R)

recurrent basic survival training

BYP

bypass

CAA

Civil Aviation Authority

CAODC

Canadian Association of Oilwell Drilling Contractors

CAPP

Canadian Association of Petroleum Producers

CAR

Canadian Aviation Regulations

CASB

Canadian Aviation Safety Board

CASO

Company Aviation Safety Officer

CASS

Commercial Air Service Standards

CBAAC

Commercial & Business Aviation Advisory Circular

CDSR

Cabinet Directive on Streamlining Regulations

CESM

cold exposure survival model

CGG

Cool Gas Generator

CGSB

Canadian General Standards Board

CHC

Canadian Helicopters Corporation

CHI91

Cougar Helicopters flight 491 / Cougar 91

CRM

crew resource management

CRMI

CRM Instructors

CRMIE

C-NLOPB

Canada-Newfoundland Labrador Offshore Petroleum Board

C-NSOPB

Canada-Nova Scotia Offshore Petroleum Board

COM

company operations manual

CVR

cockpit voice recorder

DEB

deployable emergency beacon

DND

Department of National Defence

EASA

European Aviation Safety Agency

EICAS

Engine Instrument and Caution Advisory System

EEC

electronic engine control

EFIPS

Emergency Flotation Independent Power Supply

EFS

emergency flotation system

EGPWS

enhanced ground proximity warning system

ELT

emergency locator transmitter

EUBA

emergency underwater breathing aid

FAA

Federal Aviation Administration

FCC

flight control computer

FDR

flight data recorder

FFS

full flight simulator

FMS

flight management system

FO

first officer

fpm

feet per minute

FSI

Flight Safety International

ft

feet

g

grams

g

acceleration due to gravity at the Earth's surface

GPS

global positioning system

HFDM

helicopter flight data monitoring

HPIAM

Human Performance in Aviation Maintenance

HPMA

Human Performance in Military Aviation

hrs

hours

HUET

helicopter underwater escape trainer

HUMS

health and usage monitoring system

ICAO

International Civil Aviation Organization

IFAP

Industrial Foundation for Accident Prevention (Australia)

IFR

instrument flight rules

IGB

intermediate gearbox

ISMS

integrated safety management system

JAR-OPS

Joint Aviation Requirement (commercial air transport operation)

JHWG

Joint Harmonization Working Group

JRCC

joint rescue coordination centre

KIAS

knots indicated airspeed

km

kilometre

kt

knot

L/D

Lift-to-drag (also called lift over drag)

LOFT

line orientated flight training

ME

Medical Examiner

MFD

multifunction display

MGB

main gearbox

MHz

megahertz

MPFR

multi purpose flight recorder

MPL

Multi-crew Pilot Licence

MSC

Meteorological Service of Canada

M/V

motor vessel

N

North

NASA

North American Space Agency

NDB

non directional beacon

NEB

National Energy Board of Canada

Nm

nautical mile

NPRM

notice of proposed rulemaking

Nr

main rotor speed

NTSB

National Transportation Safety Board

NUTEC

Norwegian Underwater Technology Centre

OHSI

Offshore Helicopter Safety Inquiry

OLF

Norwegian Oil Industry Association

PDM

pilot decision making

PF

pilot flying

PIC

pilot in command

PLB

personal locator beacon

PNF

pilot not flying

PPC

pilot proficiency check

psi

pounds per square inch

PTM

pilot training manual

PTSS

passenger transportation suit system

RAM

risk assessment matrix

RCC

rescue coordination centre

RFM

rotorcraft flight manual

RHOSS

Review of Helicopter Offshore Safety and Survival

ROV

remote operated vehicle

SA

safety advisory

SAE

Society of Automotive Engineers

SAIB

Special Airworthiness Information Bulletin

SAR

search and rescue

SATOPS

Safety of Air Taxi Operations Task Force

sm

statute mile

SOP

standard operating procedures

SSA

Sikorsky Safety Advisory

STC

supplemental type certificate

TC

Transport Canada

TCCA

Transport Canada Civil Aviation

TEM

threat and error management

TSB

Transportation Safety Board

UK

United Kingdom

USA

United States of America

UTC

Coordinated Universal Time

VFR

visual flight rules

VMC

visual meteorological conditions

W

West

WIDDCWG

Water Impact, Ditching Design and Crashworthiness Working Group

°C

degrees Celsius

° M

degrees magnetic

°

degrees

"

inches

'

feet

%

percent