When seven ONGC passengers boarded Sikorsky S-76D helicopter VT-PWI from Juhu helibase on a rainy morning in 2022, they had probably never heard of James T Reason or the Swiss Cheese Model of accident causation. Unbeknownst to them, a series of “holes” in defenses meant to prevent an accident had aligned inauspiciously in preceding months. One of the last safeguards — requirement of a pilot experienced on-type — had also been recently compromised at the altar of operational expediency, thus allowing a “trajectory of accident opportunity” to pass through. Another set of defenses meant to save lives in the event of a ditching at sea had already been breached, ashore and afloat, further loading the dice against their survival. Only three pax and two crew would return alive from that sortie.

Accident report released a year later

India’s Aircraft Accident Investigation Board (AAIB) recently released the final investigation report into the Jun 28, 2022 offshore crash of S-76D that killed four offshore workers.

The board concluded “uncontrolled flight during its final approach, because of undesired aggressive nose up maneuver coupled with full lowering of the collective by Pilot Flying, which resulted in steep autorotative descent at near zero speed leading to impact with sea” as the probable cause of the accident.

Pilots’ lack of familiarisation and proficiency with operating the helicopter’s automatic flight control system (AFCS) and failure to monitor flight path at a critical juncture have been cited as contributory factors among a host of active and passive failures at multiple levels in the organisation.

What happened?

The ill-fated helicopter VT-PWI — first of the S-76D to be inducted in Indian offshore — was being operated by Pawan Hans Limited (PHL) as part of a contract with India’s oil major Oil and Natural Gas Commission (ONGC). The helicopter took off with two pilots and seven passengers on a ‘Special VFR’ clearance from Juhu aerodrome at 05:35 UTC (11:05 IST) on Jun 28, 2022, for a crew change sortie to ONGC driller Sagar Kiran, located about 57 nm off Mumbai. After a short flight of about 36 mins, the crew lost control over the helicopter on short finals and crashed into the sea, about 1.5 nm from the rig.

Successful egress but lives lost

Despite impact with water at a descent rate over 2000 feet/min, all aboard managed to successfully egress the helicopter that floated inverted on its emergency floatation gear (EFG). However, four passengers who made it out of the ditched helicopter died of drowning. Five others (2 crew plus 3 pax) were recovered with injuries by offshore support vessel (OSV) Malviya-16 and Sagar Kiran’s lifeboat. The investigation has unearthed glaring shortcomings in the post-crash rescue effort that likely contributed to the loss of lives.

Unstabilised approach in inclement weather

The South West Monsoon was active over Mumbai High during that period, with seasonal rain and low visibility. The flight was uneventful from take-off till commencement of approach, with the pilot-in-command (PIC) on controls as pilot flying (PF) for the outbound leg. Offshore elevated deck approaches are omnidirectional, into wind, with pilot who has the best view of deck and obstructions acting as PF.

Based on this assessment, controls were handed over by the PIC to the first officer about 1.5 nm from the rig in an estimated visibility of about 2 miles & “eyeballed” winds (Kiran anemometer was unserviceable). The first officer assumed duties of PF (approx 1 min 22 sec before water impact) while the PIC reverted to pilot monitoring (PM). At this critical juncture, the rig and deck were perhaps just coming into view.

There is no clear indication from analysed data or CVR transcript when exactly the approach to land was commenced. Rather, it appears as if the first officer (PF) did a ‘step down’ to about 300 feet, followed by deceleration to a very low speed from where an abrupt descent was initiated. During this process, the autopilot was decoupled (upper modes OFF), thus reverting to “hands-on” flying.

Approach profile after AP decoupling

The visual descent point (VDP) in a Category A approach to offshore elevated deck is located about a mile from the deck at a height of 500 ft. In low visibility, coupled modes are generally disengaged at VDP, from where it is a short continuously descending and decelerating approach that requires a clear view of the deck, obstacle environment and ‘go around’ area.

If descent and/or deceleration is not commenced at VDP, the approach would become “overshooting” in no time and a ‘go around’ would be mandated. In the prevailing low visibility and light drizzle, the crew likely crossed VDP, flying almost level. Inexplicably, they did not exercise ‘go around’ option available at the click of a button on the cyclic.

Deck peculiarities — ‘Sagar’ series drillers

A small detail about ONGC’s Sagar series drillers and their helideck is missing in the report. It is an ‘open secret’ known to experienced offshore pilots flying ONGC contracts. The helideck, though technically compliant with CAP 437 requirement of 210 degrees ‘obstacle clear sector’, becomes tricky during monsoon when winds blow south-westerly (225-240 deg) through obstacles and superstructure onto the deck. It is usually a left seat (copilot’s) approach, but an offset has to be maintained to ensure clear getaway; often the “committal point” comes early. Most importantly, it does not brook shortening of VDP or a delayed go around — factors which likely closed VT-PWI’s options in a degraded visual cue environment that day.

Final holes in cheese align…

About a minute after handing over controls to the first officer, the PIC got engaged in putting weather radar to ‘standby’ from the copilot’s cursor control device (CCD) and virtual control panel (VCP). Buttons/switches on each CCD are configured to be operated by ‘own side’. It would be disadvantageous and time consuming to operate it from the opposite seat. This activity by PIC (PM) thus took about 10-14 seconds during which time co-pilot (PF) put the helicopter in a steep nose-up attitude (23 degrees) with low collective setting, likely using the cyclic trim release button. This went unmonitored by the PIC (PM) who was ‘head down’.

The precipitate action on the controls put the helicopter into a steep descent with low power setting from which it could not recover due low height & speed. The PIC’s intervention after EGPWS issued Mode 1 “sink rate” and “pull up” alerts proved too late. The helicopter impacted sea at high descent rate with right bank. It took just about 7 seconds from the first “sink rate” alert to water impact. Mode 1 of EGPWS is inhibited during autorotation to prevent nuisance alerts, but the descent rate was well outside boundaries of a stabilised approach. (EGPWS = Enhanced Ground Proximity Warning System)

Incredibly, all occupants survived the high velocity water impact and made it out of the helicopter. However, discrepancies in the preflight passenger safety video briefing and wrong self-briefing cards placed in the cabin led to confusion and incorrect operation of life preservers by the passengers. This, combined with rough sea and delay in rescue, sealed the fate of ONGCians Mukesh Patel EE(E), Vijay Mandloi EE(M), geologist Satyambad Patra & contract worker Sanju Francis even though they made it out of the stricken helicopter.

Past lessons not heeded

Cautions on using trim release and inappropriate use of automation in instrument meteorological conditions was covered in an earlier blog by this writer. Examples of fatal accidents, including PHL Dhruv VT-BSH (Ranchi, 2011), Dauphin N3 VT-PWF (Bombay High, 2015) and few cases from abroad, where incorrect or inappropriate use of the cyclic trim release contributed to the accident, were discussed therein. A paragraph from that 2019 article is reproduced below for emphasis:

Pressing trim release allows the pilot to make coarse (or large) changes in attitude while the system stands-by in a modified SAS mode – a potentially disorientating move in marginal visibility or night conditions. A momentary distraction can set up unusual attitudes or leave you predisposed to ‘overcontrol’.

Handling of automation also contributed to the fatal crash of VT-PWA on Jan 13, 2018 (LOC-I). In Nov 2015, another Dauphin N3 (VT-PWF) crashed during a night training flight off Bombay High, killing both pilots (LOC-I). Significantly, last three fatal crashes in Mumbai offshore involved LOC-I on PHL helicopters flying for ONGC. In the latest one, crew managed to render ineffective an advanced cockpit and high level of automation with the most rudimentary of mistakes. This is indicative of the trickle-down effect of lip-service by PHL management to safety where claimed best practices and risk management strategies exist in letter but not spirit, finally ending up as ‘shelfware’.

Lapses by PHL

The AAIB found no abnormality with the helicopter or its associated systems that could have contributed to the crash. The S-76D was inducted by PHL to meet ONGC’s air logistics requirement for new helicopters as per their AS4 standards. PHL pilots and engineers were trained in OEM Sikorsky’s approved training organisation and held valid licences. However, a series of systemic delays and internal/external lapses in obtaining airworthiness approvals (16 months for CAP 3400 process!), hiring of experienced expat pilots with valid Foreign Aircrew Temporary Authorisation (FATA), crew combination, etc. led to PHL defaulting on ‘management of change’, SMS and ‘risk mitigation’ goals it had set for itself as defences against ‘severe’ and ‘unacceptable’ risks. Two offshore pilots with low time on type (S-76D) were pushed into service during the inopportune window of Southwest Monsoon, going against the organisation’s own definition of such a crew combination as “unacceptable risk”.

The ditching set off another failure chain, seeds for which were sown in the preflight briefing. Faced with imminent danger after they made their way out of the upside down helicopter, passengers fell back on their preflight Passenger Safety Briefing video that told them: “to inflate the life jacket pull the toggle sharply after jumping into water. This will inflate your lifejacket automatically”. However, there was a fatal error here. The video pointed at the ‘Hammer Toggle’ meant for the emergency rebreathing system (ERBS), while the Inflation toggle meant to inflate the life jacket was nowhere identified in the video.

The investigation team further noted that “the inflated lifejacket shown in the video was also different from the LRS001 lifejacket which was actually available on the helicopter“. The self-briefing card available in the helicopter also did not pertain to LR001. This was duly pointed out by the DGCA FOI during airworthiness inspection, but PHL took the easy route by replacing them with older lifejackets for the ARC proving flight, subsequently resuming revenue flights with newer LRS001 lifejackets!

As a result, only five out of nine occupants could inflate their lifejackets. Three drowned without being able to inflate the lifejacket; two of the deceased even ripped off the ERBS toggle in desperation mistaking it to be the inflation toggle. Even as sea water filled their lungs, they followed the (wrong) briefing to the T, ultimately paying with their lives.

Lapses by ONGC

The report brings out the complete breakdown of ONGC’s emergency response plan (ERP). An OSV is required to be in close proximity of the rig during helicopter operations. All rigs and manned platforms are required to have rescue boats for man overboard and ditching exigencies.

Sagar Kiran did not have a serviceable anemometer while their rescue boat was non-operational for over a year! They lowered their emergency lifeboat instead that beat a hasty retreat after picking up just one survivor, reportedly as the boat crew were “scared”. OSV Malviya-16 took almost 45 mins to cover 5 nm and reach the ditched helicopter! By this time four passengers had drifted away in the heavy swell, possibly drowned. The remaining five had to literally fight for their survival, scrambling onto rescue nets, grappling with lifebuoys and ill-sized rope ladders deployed by Malviya-16 in heavy seas.

It is a matter of shame that for thousands of offshore workers and hundreds taking passage in helicopters flying to/from Mumbai High every day, the execution of ERP should be so abysmal. There is not a single winch-equipped helicopter in entire offshore industry in India. The winch-equipped navy choppers (ALH Mk-3MR) that arrived at the scene after ‘golden hour’ most probably picked up dead bodies.

DGCA and CAP 3400 process

The VT-PWI accident once again brought to fore DGCA’s shenanigans in the airworthiness approval and clearance process for new helicopters. Each time a new helicopter type is introduced in India, civil aviation rules require their flight operations inspectors (FOI) to be type-trained at the applicant’s cost. This is merely bending a “may” (optional) rule of ICAO Doc 8335 to “should” (mandatory) requirement”. Even the FAA makes allowances for utilising services of experienced crew from industry while sounding a caution about conflict of interest. Yet, DGCA wants their FOIs to go the whole hog, including obtaining a type rating endorsement on their licence. This junket burdens operators needlessly besides creating a single-point vulnerability.

As an example, today, despite a few Leonardo AW169s flying in India, should the only AW169 qualified DGCA FOI (trained at the expense of some operator) retire or seek another job, the next applicant importing an AW169 will need to foot the bill to train a new DGCA FOI afresh! The sheer absurdity of this insistence, if not the financial implications, merit a deeper inquiry.

The CAP 3400 process needs to be improved to promote rather than throttle civil aviation in India. PHL is a well-entrenched PSU with deep pockets and government backing. How does 16 months for CAP 3400 approval augur for small operators who seek to invest in the government’s flagship UDAN program under such a climate of mistrust, intimidation, over-regulation, and frivolous expenditure?

DGCA should also look into the convoluted FATA process that drives expat pilots flying in India to the edge of insanity each year. Even small Middle East countries have a simple process of obtaining a local licence or validation based on the foreign licence. Here in India we have a system of hoops where anyone from MEA (Visa), employer, DGCA babus, IAF medical boarding centres, to the constable in neighbouring police station can torpedo the expat pilot’s FATA (& hence employment) at the annual renewal.

Rocky road ahead

It is clear from the VT-PWI accident investigation report that the deadly troika of PHL-ONGC-DGCA continues to haunt helicopter business in India. ONGC holds 49% stake in PHL. With the shelving of PHL privatisation, many deep-rooted cultural aberrations will continue to linger, spilling blood every few years while the industry grapples with rising costs and diminishing margins. It is learnt that ONGC workers unions refused to fly offshore in the newly inducted S-76D fleet after the accident, thus reverting their dependency on PHL’s legacy Dauphin fleet which the S-76D was meant to replace. The only experienced S-76D expat pilot who managed to get his FATA never flew a single revenue sortie for PHL, eventually returning home. The bitter irony of these events should not be lost on anyone.

Meanwhile, other operators have inducted and operationalised AW139, AW169, H145, etc. Private operators switched to new helicopters in Mumbai High leaning on the vast experience of resident / expat pilots who over time gradually handed the baton across the cockpit. Induction of AW139/169 in Mumbai offshore in particular is a case study ONGC-PHL could examine. But the cultural divide across Juhu’s Runway 08-26 between PHL and private operators is perhaps a bridge too far.

There is blood on many hands, as evident from the accident report. Successive accidents have highlighted that privatisation of PHL and fleet replacement cannot be successful without addressing the elephant in the room — the poor safety culture of PHL, fostered by a disjointed, disinterested management. The latest crash is a grim reminder that we do not have forever to fix this.

---

(An edited version of this article was first published by Vertical Magazine as a news report. You can access it here)

************

©KP Sanjeev Kumar, 2023. All rights reserved. I can be reached at realkaypius@gmail.com or on my X (formerly Twitter) handle @realkaypius.