Cogs in a system

We can’t say for sure if a truck swerving to avoid a kangaroo on an outback road led to the deaths of 13 people in a helicopter crash in Norway. But this disturbing story is a reminder of how inspection, maintenance and certification are vital for safety.

It matters not how strait the gate,
How charged with punishments the scroll,
I am the master of my fate:
I am the captain of my soul.

William Ernest Henley, 1849–1903

We pilots like to be in control. We express as much every time we fly with other pilots, ‘I have control’. We push forward and the nose goes down, we pull back and the nose comes up; we push left and right and the aircraft turns. No surprises as we operate those things called controls and are reminded we are the master of our fate, the captain of our soul and in control. 

But are we? A far different reality was demonstrated by an EC225 Super Puma and its rotor-less impact onto a small island near Turøy in Norway, with the death of everyone on board. The subsequent investigation showed just how profoundly consequential other people’s actions are on our own destiny and that while we might be the master of our aircraft, we are not the master of our fate.

It was nearing midday on Friday 29 April 2016 and the EC225 (registered LN-OJF) was returning from the Gullfaks B oil production platform in the North Sea. On board were 2 pilots and 11 passengers intending to land at the Bergen-Flesland Airport. The copilot asked for and received a clearance to track for the ILS and the aircraft descended to 2,000 feet. A minute later the controllers issued a new QNH to OJF which the captain confirmed with a readback. 

That was the last transmission from the aircraft. Everything to this point was normal. Everything was routine. Everything was in control. Except it wasn’t. Unbeknown to the crew, a small gear wheel, slightly bigger than a person’s fist and deep within the main gearbox, was about to – literally – tear away the pilot’s control. 

Here’s the thing about helicopters: the very design that allows them to achieve the near miracle of a hover is the same thing that spells the helicopter’s demise when things go wrong. In an aeroplane, unlike a helicopter, the energy of the engine is easily transferred to rearward thrust, or to a prop, along the same line and as a part of the engine itself. But, for obvious reasons, in a helicopter the rotor system has to be displaced away from and above the engines and a bewildering, almost magical, feat of aeronautical engineering is then achieved to transfer and reduce tens of thousands of RPM to the hundreds required by the rotor. 

Additionally, the rotational energy in a conventional helicopter also has to make its way to a tail rotor displaced many metres to the back of the machine. Thus, an array of shafts, gears and couplings, integrated with oil, hydraulic and electrical systems, somehow manages to orchestrate order out of chaos in a dance of metal, energy and air, atop a literal tornado. It is indeed a near miracle but when a critical component breaks, chaos quickly dominates the finely balanced order. 

In OJF’s gearbox that day, at 2,000 ft above the Norwegian coast, the aircraft’s epicyclic and planetary gears were faithfully transferring and reducing 22,962 RPM from the 2 turbine engines to 265 at the main rotor. However, without any noticeable vibrations or any other sign to the crew, one of those 8 planetary gears, literally just a small cog in a big machine, was producing undetected spalling and the breakaway of metallic fragments – known colloquially as ‘making metal’. 

The dynamics of spalling can be technically complex with terms such as Hertzian stress, carburisation and fractography, but you don’t need to be a metallurgist to understand that if metal fragments collude with the speeds and surface-on-surface pressure of a helicopter gearbox, the results are most likely to be catastrophic. In fact, it’s to avoid just such a catastrophe that modern helicopters have comprehensive maintenance programs backed up by numerous onboard vibration analysis and chip detection systems. Inexplicably though, and still unexplained by the investigation, OJF’s spalling had produced the undetected conditions for 30 square mm of breakaway debris and, in turn, what investigators would later call (in an understated way) a ‘through crack’. 

Ironically enough, until the through crack, the passengers couldn’t have asked for more in terms of ‘safety’. Up the front there were 17,000 hours of piloting experience, supported by the training and checking program of one of the biggest helicopter companies in the world. This was backed by comprehensive maintenance and safety systems and decades of global experience in what is arguably, at least in the rotary wing industry, the most exacting of industries – oil and gas production. 

Additionally, OJF was manufactured by one of the largest aircraft companies and the regulatory system it flew within was, apparently, near exhaustive. But somehow, in the multitude of safety, certification and maintenance controls, one small broken cog was about to show how a modern airworthiness system can control a lot of things without controlling the essential things.  

Three minutes after OJF’s last radio call, the through crack broke the planetary gear into 2 sections that immediately began fragmenting and jamming other gears and bearings. The combined torque of the 2 Turbomeca Makila engines, once allies of the aircraft, became enemies as the torque tried to drive a now seized gearbox. With nowhere else to go (and because Newton’s third law is absolutely true), 4,000-shaft horsepower chaotically unleashed itself onto the mounting plate bolts, lift housing, suspension bars and control actuators – that is, onto everything that keeps the fuselage connected to the rotor system.

A couple with their child were on an early morning walk across the Turøy Bridge and not too interested in looking up to see yet another North Sea helicopter flying overhead. But they could do nothing else when they heard what they would later describe as an extremely loud metallic clanging and rattling – as though someone was clashing giant gears in a giant car. A sound like thunder followed, then, from the top of the helicopter, yellowish red flames and then the entire rotor broke away in a metallic cloud of what was once the upper pylon of the aircraft. 

The entire rotor broke away in a metallic cloud of what was once the upper pylon of the aircraft.

The fuselage, now severed from any and all aerodynamic lift, pitched down, twisted and yawed to the right and fell ballistically to the rock and heather of the small island of Storeskitholmen. Meanwhile, the rotor system – still airborne and spinning like an oversized frisbee – headed directly towards the family on the bridge. Amidst the sounds of EC225 debris hitting sea and rock all around them, the family ran for their lives. Thankfully, before it could hit the bridge, the rotor system inexplicably changed direction and impacted the separate island of Storskora, 500 metres from the main impact site. 

When the rotor broke away, there was no possibility of the pilots carrying out bold-face actions or pulling out the checklist or conducting a clever Sully-like recovery. It was without warning and completely out of their control, which the investigation makes very clear: ‘The causal factors of the LN-OJF accident are related to airworthiness and not to operational factors. The crew was not aware of any anomalies until the main rotor detached from the helicopter.’ In the 12 safety recommendations from the accident, there is something relatively unique from other investigations – there is not a single recommendation for pilots. Instead, the recommendations highlight the control of many others within the complex airworthiness systems that allowed OJF to fly that day. 

There’s the control of those within the European Aviation Safety Agency and the recommendation to ‘research crack development in high-loaded case-hardened bearings in aircraft applications’. This was because, despite a similar accident with the same aircraft type in 2009, the dynamics of how a crack could develop so quickly and so catastrophically were still not fully understood and still not, as OJF obviously showed, controlled. 

Then there’s the control of various people who maintain aircraft components – often bought, leased and transferred from aircraft to aircraft and from company to company. The second recommendation highlights this when it referred to an ‘unusual event’.

This event occurred 12 months previously in Western Australia when the truck transporting the gearbox that would eventually end up in Norway in OJF, swerved to avoid kangaroos and rolled – the gearbox was thrown out of the truck’s open tray. With damage to the gearbox obviously evident, it was returned to Airbus Helicopters, whereupon, after inspection and repair, it was released for use. The investigation, mainly due to a lack of data, was never able to draw a direct link from the rollover to the Norwegian accident; however, it noted the gearbox was ‘repaired and released … without detailed analysis of the potential effects of these forces on the critical characteristics of the component’.

Finally, there’s the control over aircraft certification. This has been well evidenced beyond OJF by recent events with the Boeing 737 Max and shows the various ways in which other people’s design decisions, and design acceptance criteria, have profound implications for pilots and passengers, often removed from these decisions by years and even decades. The investigation for OJF recommended ‘that Airbus Helicopters revise the type design to improve the robustness, reliability and safety of the main gearbox’ and regulators ‘introduce a design requirement that no failure of internal main gearbox components should lead to a catastrophic failure’. 

The truck transporting the gearbox that would eventually end up in Norway in OJF, swerved to avoid kangaroos, rolled and threw the gearbox out its open tray

The entire investigation shows that while ‘captain of my soul’ and ‘master of my fate’ might be good poetry, it’s a bad reflection of life. It isn’t true now and it wasn’t true in the late 19th century when Henley penned these words from, ironically, his hospital bed, stricken with tuberculosis and completely in the control of his medical staff (in what scholars call the ‘hospital poems’). The reality is all of us exist within complex networks of relationships, cultures and values that impose direct and indirect causalities upon our perceived ‘control’. All of us rely on the control of others and all of us have a controlling impact, through our decisions and actions, on everyone else. That’s the reality of life and that’s the reality of aviation.

The first stanza in Henley’s poem says, ‘I thank whatever gods may be for my unconquerable soul.’ I don’t. I know all too well just how conquerable my soul really is without the help of others. Instead, when I consider all the years of my own ‘control’ at the controls, I thank all the people who have faithfully designed, certified and maintained, on my behalf, all the things over which I have no control. And for me, this gives a whole new meaning to the other phrase we express every time we fly with another pilot, ‘You have control … ’.