Fatal Offshore S-76C++ LOC-I & Water Impact Brazil 2022: CENIPA Investigation

Fatal Offshore S-76C++ LOC-I & Water Impact Brazil 2022: CENIPA Investigation (Lider PR-LCT)

On 16 March 2022 Sikorsky S-76C++ PR-LCT of Líder Táxi Aéreo struck the sea on approach to a Petrobras Normally Unattended Installation (NUI), Manati 1 (9PMM), after a Loss of Control In-flight (LOC-I).  The aircraft capsized but was kept afloat by its Emergency Flotation System (EFS).  The Aircraft Commander died but the other 12 occupants were rescued with only minor injuries.

The Brazilian accident investigation agency CENPIA published their safety investigation report, on 5 August 2024.

The Accident Flight & Crew Background

The helicopter departed Salvador Bahia for a c 22 mins flight to the offshore installation. Four of the the 11 passengers had not completed Helicopter Underwater Escape Training (HUET).

Survivors reported that it was common practice for crews to ask the passengers whether they had received the HUET training [before departure], but, specifically in the case of the accident the question was not made.

This indicates that an absence of passenger HUET qualification was common.  It also meant there was nothing to stop two untrained passengers on this flight being sat next to push out windows they had not gained familiarity with using through practical training.  CENIPA describe the safety briefing given to passengers.  It does not appear to have included the brace position. The passengers were equipped with life jackets but no Personal Locator Beacon (PLB) or Emergency Breathing System (EBS). The pilots had life jackets and PLBs but no EBS.

Both pilots were starting a two week period on-duty.  For this flight the Co-pilot was Pilot Flying (PF) and the Aircraft Commander was Pilot Monitoring (PM).

The Aircraft Commander had 8670 hours flying experience, 7393 on type.  He had been an S-76 instructor since 2012.

The Co-pilot (5800 hours, 1382 on type) had flown for CHC from 2008-2016 (and been an Aircraft Commander 2010-2016).  However in 2016 he had been made redundant at a time of contraction in offshore operations (the offshore fleet in Brazil declined from 100 helicopters in 2014 to 70 in 2016, with a number of contracts terminated in 2015).  In 2020 Petrobras is reported to have used a reverse auction process to drive down prices after COVID hit.

The Co-pilot did not resume offshore flying until December 2020 upon recruitment by Lider.  The Co-pilot underwent 36 hours of initial simulator training 22-30 January 2021, needing 8 hours more than the standard course to gain an “acceptable” grade (the middle of 5 grades), with the comment “minimally qualified to perform his duties on board…”

The SIC reported that, on that occasion, during the initial training sessions on the flight
simulator, he had some trouble due to the automation of the S-76C++ helicopter.

The SIC started flying operationally in February 2021 and over the next two months with an instructor accumulated 104:20 flying hours.  However, he then spent 10 months on a medevac stand-by roster logging just 36:40 flying hours and 22 offshore landings (most of which appear to have been as PM).

Despite this, on the day of the accident the Co-pilot was commencing “operational-experience training” in preparation for promotion to be an Aircraft Commander with Lider.  In early 2022 the oil price was spiking as Russia invaded the Ukraine.

The Co-pilot (or SIC) was therefore seated in the right hand seat for the first time since being recruited and the Aircraft Commander (or PIC) was in the right hand seat.

CENIPA observe that (surprisingly)…

…the PIC did not conduct a specific briefing addressing relevant aspects of the operational conditions en route, physical characteristics of the helideck, type of approach, and emergency procedures, as outlined in the company’s PTO [Operational Training Program (sic)].

En route the Co-pilot noted isolated rain.  CCTV on the NUI “showed that the horizon around the platform was not well defined due to the existing cloudiness”:

The helicopter passed the installation and commenced a circuit.

Due to the wind direction it was decided the Co-pilot would remain as PF for the landing.  However, the SIC had only made two offshore landings in the last year and neither were in the last 90 days.  CENIPA do state that these two pilots had periodic training in a flight simulator, four months earlier, but don’t give further details.

The operator had no requirements specifying a minimum number of offshore takeoffs and landings in a given period.  There was no Brazilian regulatory requirement on this matter, though there are requirements in the Flight Safety Foundation (FSF) BARSOHO Standard, guidelines in the now obsolescent IOGP Report 590 and the subsequent recommended practices in Report 690.

The traffic circuit was flown uneventfully until the aircraft joined the final approach segment. The SOP prescribed that the final approach should start at a height of 500 ft, speed of 60 kt., and descent rate of less than 600 ft/min.

At the end of the base turn, with the aircraft aligning with the final approach of the traffic circuit on a magnetic heading of 250º, the flight director was uncoupled at a distance of approximately 0.93 NM from the helideck, and the descent was started manually.

CENIPA explain that:

Five seconds after uncoupling the flight director, the PIC informed the SIC that he (the PIC) was waiting for the final checklist request.

According to the SOP, the final checklist complemented the before-landing checklist with the aircraft configured for offshore landings, being normally worked during periods of high workload and, therefore, could be accomplished from memory.  The final checklist was to be requested by the PF with the aircraft stabilized on the final approach at a speed compatible with the use of floats.

The SIC said, “okay”, but did not request the final checklist from the PIC.

That said, the Pilot Monitoring (the PIC, in this case) was supposed to run the final checklist using the scan-flow method in silence, and then question the Pilot Flying by means of calls in English, aiming to obtain positive confirmation of the actions performed.

In this case however….

… the PIC used Portuguese to make the calls prescribed for the final checklist, informing the SIC about the 9PMM code, and that the life rafts were “okay”.

The SIC, in turn, did not confirm the actions performed by the PIC.

The investigators comment that:

Such fact may indicate that the SIC did not fulfill the calls prescribed for the final checklist because his attention was distracted by other stimuli, such as maintaining visual references with the horizon while trying to keep the platform in sight.

They also postulate that…

…the inappropriate use of calls may have compromised the management of tasks assigned to the pilots and, consequently, their situational awareness…

…and this could relate to…

…the application of incorrect CRM techniques, including inefficient cross-check and ineffective coordination between crew members.

CENIPA go on to detail that:

14 seconds after uncoupling the FD, the SIC informed the PIC that he (the SIC) would perform a go-around in the air if he felt any discomfort in relation to the height and position of the helicopter on the final approach segment.

Simultaneously…

…the SIC maintained the helicopter’s torque close to zero and…continuously actuated on the cyclic control in order to pitch up the aircraft, to the point of reaching a positive angle of 13º.  The PIC warned the SIC that the rate of descent was “a little high”.

At one point the pitch-up angle value was close to 16º.

It is possible that, with such excessively steep attitudes, the pilot momentarily lost visual contact with the platform… leading him to develop a selective perception or “tunnel vision”, as he was exclusively concentrated on the platform, without noticing the significant changes in other crucial variables, such as speed, rate of descent, height, and the torque applied.

CENIPA observe that:

According to the SOP, the call to be used by the PIC to alert the SIC about the excessive rate of descent should have been “descent rate”.  The SIC should have replied “check, correcting” to the PIC, if he was going to reduce the descent rate to adapt to operational standards, or “intentional”, if the excessive descent rate was necessary to maintain flight safety.

They opine that:

The complacent attitude of the PIC, combined with the SIC’s personality profile, which was more prone to following orders and performing tasks during periods of higher tension, compromised the interaction between the pilots, hindering the implementation of the necessary corrective measures to execute a go-around following an unstable approach.

The rate of decent peaked at 3,920 ft/min as the helicopter passed through 264 ft.

The EGPWS issued the “two hundred” altitude alert, as the aircraft passed 200 ft AGL.

Twenty-two seconds after the uncoupling of the FD, the PIC alerted the SIC that the helicopter was losing speed, and the SIC replied that he was high, when the aircraft was passing 132 ft AGL, at a speed of 29 kt (IAS) and a VSI of -1,964 ft/min.

The investigators comment that…

[A]lthough with little assertiveness, the PIC did alert the SIC about the excessive rate of descent and the speed…[t]he SIC’s lack of immediate reaction to adjust the aircraft’s speed, demonstrated that communication between the pilots was not adequate.

Shortly thereafter, the EGPWS issued the “one hundred” altitude alert.  The aircraft had a descent rate of 1,839 ft/min at that point.

It appears that the EGPWS gave no other alerts and therefore provided no assistance to the crew beyond a traditional AVAD.

From then on, there was effective actuation on the cyclic control, changing the aircraft’s longitudinal attitude from the 16.0º nose-up to 0.0º in 1 second. At that moment, the inputs on the collective control contributed to exceeding the aircraft’s transient torque limit.  However, it was not possible to determine whether the action on the flight controls was performed by the SIC or if there was intervention by the PIC.

Then, the PIC warned the SIC of the low speed for the last time, and the aircraft collided with the sea.

Post-Impact Survival & Rescue

The helicopter was equipped with an EFS activated either by an Automatic Float Deployment System (AFDS) or manually from the cockpit.  CENIPA quote the Sikorsky RFM as stating that the EFS was designed only for “emergency landing on water”.  This can be assumed to be a controlled ditching rather than an uncontrolled water impact.  However, the RFM also states that:

With sufficient power available to fully control the helicopter descent rate, sideward drift and forward speed to near zero values, successful ditching may be accomplished in sea states up to and including Sea State 4 (wave height 6.5 feet, wavelength to height ratio – 10 to 1) depending on wind conditions.

CENIPA do not give details of the sea state, though the installation’s CCTV footage (see above) suggests the sea state was relatively low.  The rate of descent was however high at c 1,635 ft/min.

The S-76’s AFDS successfully activated the EFS (unlike the S-92A system in a recent accident in Norway).  The EFS deployed successfully but did not however prevent the aircraft rolling to the right and capsizing.

The SIC recalled the “almost immediate flooding” of the cockpit and that ” he had little time to fill his lungs with air”.  He then found himself inverted “with limited visibility due to the dark color of the sea water”.

He…kept one hand on the seat belt release buckle, without opening it… He then attempted to jettison or open the helicopter door with his free hand, but was unable find either the jettison lever or the door-opening handle.

He subsequently released his seat belt, an action that caused his body to revolve 180º. This movement allowed him to see a light coming from the acrylic bubble located behind the pedal flight controls, close to the handle of right-hand front door.

The SIC recalled that he then managed to open the handle of the right-hand front door
and escape from the aircraft. He also added that upon reaching the water surface, he inflated his own life jacket, as well as the ones of other passengers who were floating around.

Passengers reported having difficulty opening the emergency exits and jettisoning
doors and windows, possibly due to the counter pressure of the water, which required a
longer period of time underwater than the one observed by those who had taken the HUET training.

They also reported that an “air pocket” formed inside the cabin, which allowed at least one of the passengers to take breath again and escape from the aircraft.

The SIC and one of the passengers recalled that the [external] life raft located on the right-hand side of the helicopter was then deployed manually, and all the survivors boarded it.

…after boarding the life raft, the survivors realized that the PIC had not abandoned the aircraft.

The SIC said that he took off his inflated life jacket, and dived to rescue the PIC. He removed the PIC from the submerged cockpit through the left front door of the aircraft. He had found the PIC unconscious, floating inside the control cabin, with his seat belt and
harness loosened.

After the rescue, they placed the unconscious PIC in the life raft, and started the resuscitation procedures began, with the use of “mouth to mouth” breathing and cardiac
massage.

Petrobra’s contracted support vessel Lumar XX, sailing near the 9PMM Platform, did not see the helicopter crash.  CENIPA do not elaborate on its duties during helicopter operations but do note it lacked a suitable rescue craft.

The helicopter’s Caledonian Airborne CPT900 Automatically Deployable Emergency Locator Transmitter (ADELT), providing homing (121.5 MHz and 243 MHz) and 403 MHz COSPAS-SARSAT satellite location, deployed and transmitted.

The signals were received at the Aeronautical Rescue Coordination Centre (ARCC) in Recife at 10:35 UTC, who after several attempts got through to the operator at UTC 10:50.  Also:

The survivors, by means of a cell phone, made contact with the aircraft operating company, transmitting the necessary information so that the support vessel [Lumar XX, contacted by the helicopter operator at c11:00 UTC] approached the life raft.

At 11:04 UTC, the crew and passengers of the helicopter were rescued by the Lumar XX [and] the PIC’s resuscitation continued. At 11:10 UTC, the vessel requested to proceed to the port of Valença, Bahia, located at a distance of approximately 10 km from the site of the occurrence.

During the journey ashore the PIC’s vital signs weakened and the PIC was declared dead on arrival.

CENIPA Safety Investigation

The helicopter sank at 21:35 UTC.  It was salvaged from a depth of 50 m of 5 April 2022.

Tests performed on the PR-LCT’s [Safran Arriel 2S2] engines enabled one to affirm that both of them were functioning normally and developing power at the time of the crash.

CENPIA ruled out the phenomena of Vortex Ring State (VRS).

It was not possible to determine to what extent the prevailing meteorological conditions influenced the crew’s performance during the final approach to the helideck.

CENPIA comment

It is possible that the efficient use of an emergency compressed-air breathing system by the PIC would have increased the likelihood of his escaping the submerged aircraft.

In relation to the presence of passengers  without HUET:

It was not possible to confirm whether the evacuation of passengers from the aircraft was compromised due to this fact. However, it is known that the optimization of the escape actions, among other aspects, is also conditioned on faithful compliance with the procedures established in the HUET.

CENIPA identify the following causal factors as contributory:

• Crew Resource Management: “The inadequate use of standard call-outs compromised the management of tasks  assigned to the pilots. Furthermore, the loss of control of the aircraft was associated with the application of incorrect CRM techniques, including inefficient crosschecking and ineffective coordination”.
• Handling of flight Controls: “Exceedance of the rate of descent to values above 600 feet/min on the final approach for the intended landing on the 9PMM Manati Platform, being rate of descent one of the parameters defined in the aircraft operator’s SOP for a stabilized VFR approach with SK76 helicopters, evidenced an inappropriate handling of the aircraft’s flight controls.”
• Management Planning: “The organizational processes adopted within the scope of the operator’s SMS were not enough for identifying the dangers posed by the circumstances of that flight. Such dangers were, namely, the fact that it was the first flight of the fortnight working-period for both pilots; the fact that it was the first enroute flight of the SIC being evaluated by a flight instructor; and, the fact that it was first time the SIC was occupying the right-hand seat after being hired by the aircraft operator.”

Our Observations

The Offshore Industry, Geopolitics, Pilot Recency & Line Training

We have previously summarised a highly critical peer reviewed paper:  “The impact of human factors on pilots’ safety behavior in offshore aviation – Brazil”.  Unusually his accident maps closely to three geopolitical events:

• The 2014 oil price crash, when the SIC was made redundant as a PIC at CHC
• COVID-19 and the SIC’s employment for a low utilisation medevac roster
• The Russian invasion of Ukraine, an oil price surge and the SIC being selected for a command course

Consequently the Co-pilot had a long period with no or very limited offshore flying experience and this was his first flight of a command course. He had however flown for c 6 years offshore as an S-76 Aircraft Commander for another Brazilian operator.  Although CENIPA do not comment on this, one might hypothesise that the value of his previous command experience was overrated in determining his readiness for command training.

The Aircraft Commander appears to have been a type rating instructor on the S-76.  Its not clear what training or experience he had in line training, which is subtly different.   In a December 2022 report, HeliOffshore comment:

Line Training can cover a broad range of missions and environments, and as a result, aviation regulations rarely call out specific requirements for Line Training programmes [and so] leave it to individual operators to define the programme and the associated assurance.

Equally IOGP 690-2/11C.2.5 Version 1.3 simply recommends “There is a process for the selection, training, and designation of LTC [Line Training Captains]”.

Consequently, there is considerable variation in Line Training standards across the industry, exposing certain regions, operations and operators to unnecessary risk.

A year later they issued their Line Training System Recommended Practice.  The key recommendations are:

Naturally CENPIA comment on the SIC’s low recency level.  They state that an unnamed foreign oil company would have required “that least 50 hours in the 90 days preceding the flight, 10 hours of which in the same type of aircraft, including 3 offshore landings and takeoffs” (actually still less than recommended by IOGP 690-2/40).  CENIPA do not explain why IOGP member Petrobras was seemingly not following IOGP recommended practices.

Automation

CENIPA do not comment on the decision to conduct a manual approach and what the operator’s policy and pilot’s normal practice were.  The Co-pilot’s previous difficultly in the simulator with automation may have resulted in an unwise choice.  Flight Path Management and  Automation have been topics of much discussion in the offshore helicopter industry in the last 10 years (Aerossurance co-sponsored a Royal Aeronautical Society (RAeS) conference on the topic of automation in 2016).

Making EGPWS (TAWS) Effective for Offshore Helicopters

Again EGPWS as currently implemented proved ineffective as it is optimised for fixed wing operations.  We understand that based on the flight data presented in the CENIPA report, with the new offshore envelopes developed by UK CAA research (CAP1519: Offshore Helicopter TAWS Alert Envelopes), c 10 seconds warning would have been given by Mode 1.  The report lacks torque data but Mode 7 potentially may have warned earlier.

SMS & Risk Management

CENPIA suggest the operator’s safety management system (SMS) failed to identify the risk in this flight.  Apart from stating the SMS was approved by the regulator, ANAC, and had been ANAC audited in 2021 there is very little detail in the report on the SMS or to substantiate a specific failure of the SMS.  It is unreasonable to have expected SMS processes to be applied to every selection for a command course or to the scheduling of individual training.  However, we would expect those to be considered within the flight ops and flight training functions of the organisation.  We would have expected the SMS, for example, to have risk assessed, for example, the expansion after a period of sustained industry contraction, and whether changes to flight ops and training policies and procedures were needed.

Survivability

Although this was a fatal accident, that 12 people survived this accident is as much to good fortune as proactive risk reduction.  CENIPA comment that not all the passengers had a HUET qualification and some of the untrained passengers were seated next to push out windows they lacked practical training to release.  They also comment on the the lack of any form of EBS.  This accident illustrates the slow progress adopting CA-EBS in the offshore sector, a concept with a long history of use by the military., with trials in the 1970s.  In Canada in 2009, after an S-92A accident, previously delayed CA-EBS (aka HUEBA) implementation was accelerated.  In the UK, publication of CAP1145 in 2014 after a 2013 AS332L2 accident, triggered the mandatory introduction of CA-EBS (after the development of specific design standards).  One previous illustration of the value of CA-EBS came, ironically, from the Aircraft Commander of a SAR S-76C that crashed off Sweden 18 September 2004 where it was reported that:

The captain, who was seated in the right-hand pilot’s seat, was unable to open the pilot’s door as he could not find either the normal handle or the emergency handle. When he tried to leave the helicopter through the leftside pilot’s door, he became caught up on something. He only managed to free himself after several attempts and was then able to get out through the door and up to the water surface. He has said that he would probably not have managed this without the portable breathing equipment [HEED III] which he emptied completely.

Several military survival successes had already been recorded in the 1990s.

Another aspect of UK & European legislation for a hostile environment ONLY (see AMC1 SPA.HOFO.165(h)) and the BARSOHO standard from 2015 for BOTH hostile & non-hostile environments is on acceptable window sizes.  Where these are applied the S-76C++ would be limited to no more than 8 passengers due to small window sizes.  In contrast while IOGP 690 references both AMC1 SPA.HOFO.165(h) from V1 October 2020 and BARSOHO from V1.2 August 2022 in passing as as ‘guidance documents’ to its recommended practices on push-out windows it does not mention the sizes specified in these other documents.  For certification basis reasons IOGP Report 690 has recommended against the S-76 since October 2020,.  HeliOffshore data shows 158 were still in-service in the offshore industry as of January 2024.

The good fortune that all 11 passengers were able to egress in this case is no guarantee of future success, especially in worse weather, with bigger passengers and potentially at night.

Safety Resources

The European Safety Promotion Network Rotorcraft (ESPN-R) has a helicopter safety discussion group on LinkedIn.  You may also find these Aerossurance articles of interest:

• Review of “The impact of human factors on pilots’ safety behavior in offshore aviation – Brazil”
• CHC S-92A Offshore Landing Obstacle Strike: CENIPA Report
• Urgent Exit Required: A Helideck Incident (Omni Sikorsky S-76C+ PR-SEC)
• Helideck Heave Ho!
• Loss of Control, Twice, by Offshore Helicopter off Nova Scotia
• Strictly Scheduled: S-92A Start-Up Incident
• Offshore Night Near Miss: Marine Pilot Transfer Unintended Descent
• BFU Investigate S-76B Descending to 20ft at 40 kts En Route in Poor Visibility
• 2009 Newfoundland S-92A C-GZCH Accident: A Failure of Design and Certification
• Technology Friend or Foe – Automation in Offshore Helicopter Operations
• AAIB Report on 2013 Sumburgh Helicopter Accident
• ADA AW139 A6-AWN Ditching off UAE, 29 April 2017: Final Report
• Night Offshore Windfarm HEMS Winch Training CFIT
• NTSB Report on Bizarre 2012 US S-76B Ditching
• Sikorsky S-92A Loss of Tail Rotor Control Events
• S-92A Emergency Landing: MGB Oil Checklist Recommendation
• SAR Helicopter Loss of Control at Night: ATSB Report
• NTSB Investigation into AW139 Bahamas Night Take Off Accident
• Night Offshore Training AS365N3 Accident in India 2015
• Loss of Bell 412 off Brazil Remains Unexplained
• CAP1145 Helicopter Water Impact Survivability Statistics – A Critique
• Hong Kong Harbour AW139 Ditching – HKCAD Report Issued
• Dramatic Malaysian S-76C 2013 Ditching Video
• In-Flight Flying Control Failure: Indonesian Sikorsky S-76C+ PK-FUP
• Safety Lessons from a Fatal Helicopter Bird Strike: Sikorsky S-76C++ N748P, 4 January 2009
• S-92A Collision with Obstacle while Taxying
• Offshore Helicopter Emergency Response
• North Sea Helicopter Struck Sea After Loss of Control on Approach During Night Shuttling (S-76A G-BHYB 1983)

---

Aerossurance has extensive air safety, offshore helicopter flight operations, survivability, SAR, airworthiness, human factors, helidecks, aviation regulation and safety analysis experience.  For practical aviation advice you can trust, contact us at: enquiries@aerossurance.com

Follow us on LinkedIn, Blue Sky @aerossurance.bsky.social and Twitter @Aerossurance for our latest updates.