2009 Newfoundland S-92A C-GZCH Accident: A Failure of Design and Certification
12th March marks the anniversary of the 2009 loss of a Sikorsky S-92A off Newfoundland, Canada after two (of three) mounting studs, holding the Main Gear Box (MGB) oil filter failed, allowing a massive MGB oil loss.
While 17 people died in that preventable accident, fortuitously one passenger, Robert Decker, survived (video of his eyewitness account).
Controversially, following a failure during Sikorsky certification testing in 2002, the US Federal Aviation Administration (FAA) had allowed the certification of the type with a uniquely lax interpretation of the certification requirements for loss of lubrication testing.
“Truth in politics is optional – Truth in engineering is mandatory.” Igor Sikorsky (1889-1972)
Despite misleading social media statements by the then Sikorsky S-92A Project Director (albeit countered by others as mentioned by the TSB) that the MGB had been tested for 3 hours, with a genuine loss of lubricant the MGB disintegrated in just 11 minutes.
A Preventable Accident
The Canadian Transportation Safety Board (TSB) reported in 2011 on the accident to Cougar S-92A C-GZCH Flight 491. The TSB said the:
…mounting studs had fractured by overstress extension of fatigue cracks. Fretting and rub patterns observed on the filter housing and packing indicated that the fatigue cracking developed in the forward stud, causing it to fail, which increased the load on the aft stud leading to its failure.
Such failures of MGB filter mounting studs (or bolts) is not unheard of (in these cases on Australian operated WHL Sea King Mk 50s):
Source: SURVEY OF SERIOUS AIRCRAFT ACCIDENTS INVOLVING FATIGUE FRACTURE VOL. 2 ROTARY-WING AIRCRAFT by Glen S. Campbell, R.T.C. Lahey National Aeronautical Establishment (Canada, 1983).
On 06 August 2002, Sikorsky carried out its initial certification loss of lubricant test by draining the MGB and using only the remaining residual oil (approximately 1.3 gallons) then continuing operation in accordance with the requirements of AC 29-2C.
The purpose of this test, outlined in the test documentation, was to demonstrate that the S-92A transmission could provide, “continued safe operation for a minimum of 30 minutes following a complete loss of lubricating oil in accordance with the requirements of FAR 29.927(c)(1).”
… Sikorsky and the FAA expected that, based on the similarities between the S-92A’s MGB and the Sikorsky S-60 [sic: H-60 / S-70] Black Hawk‘s MGB, the S-92A’s MGB would successfully operate for 30 minutes after draining the lubricating oil. The FAA indicated that the initial test was thought to be a low risk test, and Sikorsky scheduled it very late in the overall S-92A certification program.
This original S-92A test matched the way other manufacturers conducted such a loss of lubrication test. TSB explain that:
EASA indicated that applicants in its jurisdiction normally complied with Part 29.927(c)(1) by draining the MGB and continuing operation with only residual oil. Prior to the S-92A certification validation it had already tested and certified at least four helicopters using this criterion.
Aerossurance is aware that Canadian manufacturers also followed the same interpretation as the European manufacturers. Unfortunately with just 1.3 gallons of oil the S-92A MGB:
…suffered a catastrophic failure about 11 minutes after the test was started.
TSB go on:
Following the loss of lubricant test resulting in catastrophic failure, instead of taking steps to redesign the transmission to provide a 30 minute run dry capability [sic: this term is not used in regulation] for the MGB, Sikorsky re-visited the requirements of Part 29.927(c)(1). Relying on guidance from AC 29-2C and the FAA Rotorcraft Directorate, Sikorsky and the FAA concluded that, except for a potential failure of the oil cooler and its exterior plumbing, all other MGB failures leading to a total loss of oil were extremely remote.
…the MGB lubrication system was redesigned to incorporate a bypass valve. The loss of lubricant test was repeated on 16 November 2002 with the bypass system installed.
This test was carried out by draining oil from a leak in the oil cooler system. The leak was isolated and further oil loss was prevented when the bypass valve was activated. About 4.3 gallons or 40% of the maximum oil quantity remained in the MGB.
The S-92 was certified by the FAA on 17 December 2002, one month after the second test and in time to be awarded the prestigious Collier Trophy for “the greatest achievement in aeronautics or astronautics in America” of 2002.
Just one day before that certification, another Sikorsky product, an S-61N C-FHHD, was involved in an accident, also in Canada, after a loss of main gear box oil, which should have helped demolished the fallacy that oil loss from any where other than the oil cooler was remote and allowed time for a rethink before the type entered service in 2004.
The European Joint Aviation Authorities (JAA) team however were not able to recommend certification until June 2004, by which time that recommendation went to EASA rather than individual national authorities in Europe. TSB report that the JAA had:
…required Sikorsky and the FAA to substantiate that all other possible failures of the MGB that could result in a rapid loss of oil were extremely remote.
Despite FAA and Sikorsky expectation that the disastrous original test was low risk because of Black Hawk experience, the justification made to JAA was also:
…based on relevant Black Hawk airworthiness data, the inclusion of the bearing monitoring system in the S-92A basic design configuration, and the assumption that service experience on the S-92A would prove to be similar to, or better than, that of the Black Hawk.
The fatal failure in Canada and a prior serious incident in Australia on 2 July 2008 to CHC S-92A VH-LOH (initially erroneously misdiagnosed as maintenance related by Sikorsky), demonstrated that the claim of ‘extremely remote’ failures and Black Hawk experience was a fallacy as the component that failed, the oil filter, was configured very differently to the smaller military Black Hawk. Consequently the bypass system had no benefit in the and in the Canadian S-92A accident drive to the tail rotor was lost approximately 10.5 minutes after the oil pressure warning, fairly consistent with the time to failure in the original, failed, August 2002 test.
In response to the Canadian accident EASA, the FAA and Transport Canada formed a Joint Cooperation Team (JCT) on the Review of Helicopter Main Gearbox Certification Requirements.
Subsequently EASA issued a draft Certification Memo to clarify EASA interpretation of this requirement in March 2012 for public consultation and prepared a Special Condition to use in the interim. Sixteen of the 19 comments submitted in the consultation came from Sikorsky, just two from AgustaWestland and one, of ‘no comment’, from the UK CAA. The Certification Memo, with only minor revisions, was formally issued in November 2013.
The first meeting was held last week of a new European Aviation Safety Agency (EASA) Rule Making Team (RMT.0608) on helicopter gearbox lubrication. The Terms of Reference (ToR) and Group Composition (GC) are here.
According to EASA, when this new rule making task is complete, expected in early 2016, a harmonised US/Canadian/European rule will require that:
…all CS-29 Category A rotorcraft undergoing a new type certification, or a significant change under Part 21.101, should comply with a loss of oil test and ‘extremely remote’ should be removed from the requirement.
See also: Helicopter MGB oil system failure analysis using inﬂuence diagrams and random failure probabilities
Emergency Procedures & SAR
The death toll is likely to have been reduced if an Immediate Landing had been initiated when one of a list of secondary indications was noticed. However the TSB note that:
The S-92A [Rotorcraft Flight Manual] RFM MGB oil system failure procedure was ambiguous and lacked clearly defined symptoms of a complete loss of MGB oil and of a single MGB oil pump failure. This ambiguity contributed to the flight crew’s misdiagnosis that a faulty oil pump or sensor was the source of the problem and their conclusion that ditching could be delayed.
Continued concerns with the S-92A RFM have been expressed as recently as November 2015 by the Norwegian Accident Investigation Board (AIBN) after a 2013 incident in Norway: S-92A Emergency Landing: MGB Oil Checklist Recommendation.
The introduction of Flight Crew Operating Manual (FCOM) for the S-92A should help resolve such issues.
One factor that may have prayed on the crews mind as they flew over the Atlantic is that this S-92A had been delivered with the basic Sea State 4 floats not the Sea State 6 floats developed for European customers.
However, this accident does demonstrate the value of oil and gas industry contracted Search and Rescue (SAR) support. A Cougar operated S-92A equipped for SAR and arrived overhead 59 minutes after the ditching and 63 minutes before a Royal Canadian Air Force SAR helicopter. This is likely to have been crucial for saving Robert Dekker’s life considering the cold Atlantic water. The Hon Robert Wells QC’s Offshore Helicopter Safety Inquiry (OSHSI) considered matters beyond the air accident investigation by the TSB, including SAR and survivability.
UPDATE 3 July 2016: We also look at the investigation into another transmission accident with a large helicopter type: EC225 LN-OJF Accident Investigation Timeline
UPDATE 6 December 2016: Aerossurance’s Andy Evans presented on rotor and transmission safety at the EASA 10th Rotorcraft Symposium in Cologne.
UPDATE 11 January 2017: Sikorsky S-92A Loss of Tail Rotor Control Events
UPDATE 2 April 2017: A case where accident investigators demanded action to meet the original certification standards NTSB Recommendations on JT15D Failure to Meet Certification Bird Strike Requirements
UPDATE 31 May 2017: NPA 2017-07 Rotorcraft gearbox loss of lubrication is issued for consultation (until 31 July 2017).
…this NPA proposes to amend CS 29.917(a) to include rotor drive system gearbox lubrication systems in the definition of the rotor drive system. This means that these lubrication systems will be considered to be within the scope of the design assessment of 29.917(b).
As the design assessment CS currently addresses the risk of single hazardous and catastrophic failures, additional material has been added to complement the Federal Aviation Administration (FAA) Advisory Circular (AC) 29-2C, supporting 29.917(b), specifically in the domain of lubrication systems. CS 29.927(c) on ‘loss of lubrication’ has been completely revised and replaced by a more objective-based CS that requires substantiation of the gearbox ability to continue safe operation (for at least 30 minutes) after a loss of lubrication to be followed by a safe landing. This is supported by substantial changes to the associated acceptable means of compliance (AMC).
Finally, CS 29.1521 has also been amended to include an additional power plant limitation that describes how the RFM emergency procedures should reflect the test evidence relating to a loss of lubrication.
UPDATE 6 August 2018: In-Flight Flying Control Failure: Indonesian Sikorsky S-76C+ PK-FUP
UPDATE 8 March 2019: Sikorsky has delivered more than 300 S-92A helicopters since entry into service in 2004. Sikorsky say that:
In 2018, the fleet flew 175,000 hours, a record for the fleet, contributing to a total of nearly 1.5 million hours flown.
Sikorsky launched the planned S-92A+ retro-fit upgrade and the new-production S-92B at the show. Both will feature Phase One of new MATRIX automation technology. This will include Rig Approach 2.0 which will be capable of flying the aircraft to roughly 500m from an offshore installation say Sikorsky. It also introduces, the SuperSearch mode to fly optimised search patterns. The interior will be readily adaptable to SAR and offshore operations.
They will also feature the ‘Phase IV’ main gearbox. This is constructed of aluminum rather than magnesium and a different lubrication system.
A GE CT7-8A6 engines, as used in the VH-92A Presidential helicopter, are an option, for improved hot-and-high performance.
The S-92B variant, to be available in 2022, also will offer a revised cabin entry door, larger cabin windows and titanium side frames.
UPDATE 10 March 2019: New book honours victims of Cougar crash 10 years after tragedy: Rod Etheridge’s 18 Souls: The Loss and Legacy of Cougar Flight 491
UPDATE 27 April 2020: Sikorsky Signs Cougar for S-92A+ Helicopter Upgrades, with an order for four upgrade kits which Sikosrky The company anticipate will be delivered in: 2023
The kit features the new Phase IV main gearbox that uses a supplemental oil pump and additional oil lines to reuse main gearbox oil that is accumulated in a lower sump in the event of primary lubrication failure on the helicopter twin.
In their A+ brochure Sikosrky say the “Phase IV Main Gear Box – Eliminates Lubrication “Land Immediately” Hazards”.
…the new gearbox fits into the existing space for the legacy component and provides for increased time between overhaul interval of up to 25 percent. Though the new gearbox is heavier than then the original one, it is offset with weight savings elsewhere on the aircraft.
The upgrade can be fitted to existing helicopters as part of the current 1,500-hour inspection and is just one of several menu items that can be selected for the A+ twin. Other options include an increased gross weight kit to 27,700 pounds and uprated engines, GE Aviation CT7-8A6s, that offer better payload capability and hot-and-high performance. The new engine, which was certified in June 2019, allows customers to operate with both full seats and full fuel under most conditions.
UPDATE 29 September 2020: The Norwegian Safety Investigation Authority (NSIA) announce the start of an investigation into a serious incident to Bristow S-92A LN-ONQ SW of Stavanger Airport on 25 September 2020.
During descent from 7 000 ft. towards 1 000 ft….the crew received a caution that the oil pressure on the main gearbox had dropped below 45 psi. Shortly afterwards, the caution “INPUT / ACC # 1 HOT” came on. According to the emergency checklist, the crew pulled the left engine back to idle. When the oil pressure dropped further to below 35 psi, the oil cooler was automatically switched off. During the further flight towards Sola, the oil temperature rose and the caution “INPUT / ACC # 2 HOT” came on. The highest recorded oil temperature before landing was 214 degrees C. The crew declared mayday, and continued the descent to a height of 200 ft. They were preparing to land on the sea if the oil pressure were to disappear completely. The landing at Sola was undramatic…
Among their early observations were that:
There was some oil spill on the left engine and the left side of the main gearbox. Oil was observed on the outside of the helicopter, especially on the left side of the fuselage. The oil appeared to come from the left engine input to the main gearbox area. There were no signs of leakage in the oil cooler or its hose connections. Approximately 4 liters..of oil was lacking from main gearbox. The indicator that warns of a high pressure difference across the oil filter had come out.