2014 FAI 5

UNDER THE FATAL ACCIDENTS AND SUDDEN DEATHS INQUIRY (SCOTLAND) ACT 1976

IN THE SHERIFFDOM OF GRAMPIAN, HIGHLAND AND ISLANDS AT ABERDEEN

FATAL ACCIDENT INQUIRY

INTO THE DEATHS OF JOHN BRIAN HUGH BARKLEY, PAUL STEPHEN BURNHAM, JAMES ANTAL REAMONN STEPHEN COSTELLO, ALEXANDER GORDON DALLAS, RAYMOND STEELE DOYLE, JAMES JOHN EDWARDS, VERNON JOHN ELRICK, NAIRN JAMES FERRIER, NOLAN CARL GOBLE, GARETH WYN HUGHES, RICHARD ANTHONY MENZIES, WARREN GEORGE MITCHELL, DAVID JOHN RAE, LESLIE STANLEY TAYLOR, STUART LEE WOOD AND MIHAILS ZURAVSKIS

DETERMINATION

by

SHERIFF PRINCIPAL DEREK C W PYLE

Introduction

[1] During the early afternoon of Wednesday 1 April 2009, a Super Puma helicopter, registration G-REDL, owned by Bond Offshore Helicopters Limited, was flying over the North Sea, en route from the Miller Oil Platform to Aberdeen. It was a routine flight, one which is done on numerous occasions each day to ferry workers to and from the North Sea oil fields. The weather was clear and sunny and the sea was calm. On board was the pilot, Paul Burnham. He was 31 years of age. He was assisted by his co-pilot, Richard Menzies. He was 24. They were responsible for the 14 passengers on board. They all worked on the platform. The youngest, James Costello, was 24; the oldest, David Rae, was 63. All, bar three, lived in Aberdeen or elsewhere in Scotland. Two, James Edwards and Nolan Goble, lived in England. One, Mihails Zuravskis, came from Riga in Latvia.

[2] At 1.54 pm, Mr Menzies contacted Air Traffic Control at Aberdeen Airport to advise that they expected to arrive there in 20 minutes. Six seconds later, a warning appeared on the helicopter's flight deck indicating low oil pressure in the main gearbox. This was immediately followed by a grinding noise which lasted for four seconds. It was accompanied by a sudden increase in airspeed from 140 to 170 knots and a sudden increase in pressure altitude. Six seconds later, Mr Burnham issued a mayday call, which was followed by a further one five seconds later by Mr Menzies.

[3] The grinding noise which the pilots had heard was the beginning of the break-up of the main gearbox which was attached to the main rotor. Twenty seconds after the appearance of the oil warning light the main rotor broke away and then severed the tail boom in a series of strikes. The fuselage began a rapid descent into the sea.

[4] At that time, Lidvar Hildre, a ship's mechanic on a platform supply ship, the Normand Aurora, was painting a cargo rail. As he looked out on the starboard side he suddenly saw about two nautical miles away a helicopter falling into the sea. There was a large splash followed by a bang and white smoke. He then saw four rotor blades all attached together falling out of the sky and hitting the sea close to where the helicopter was. Captain Arne Lystad immediately gave the order to launch the fast rescue boat, as the ship itself turned to go full speed to the crash site. By this time, Her Majesty's Coastguard had launched a major search and rescue operation which involved five aircraft, including helicopters and an RAF Nimrod. Ten vessels responded to a request to assist in the search.

[5] No survivors were found.

[6] By 6 April, all the bodies and the remains of the helicopter had been recovered and taken to Aberdeen.

Preliminary Matters

[7] Before considering the extensive evidence led in this inquiry, I will make some general observations which will explain my approach in reaching my determination.

1. It is important to explain the purposes of a fatal accident inquiry. They are set out in the Fatal Accidents and Sudden Deaths Inquiry (Scotland) Act 1976. The application for such an inquiry is made to the sheriff by the Lord Advocate who decides whether the inquiry should be held. In doing so, he is acting in the public interest.[1] That is what happened in this case. My responsibility as Sheriff Principal is to make a determination at the conclusion of the evidence setting out the following circumstances of the deaths so far as they have been established to my satisfaction:

(1) where and when the accident resulting in the deaths took place;

(2) the cause or causes of the accident;

(3) the reasonable precautions, if any, whereby the accident might have been avoided;

(4) the defects, if any, in any system of working which contributed to the accident; and

(5) any other facts which are relevant in the circumstances of the deaths.[2]

2. It is often said (and was said by me on more than one occasion during the inquiry) that it is not the purpose of a fatal accident inquiry to establish fault. The reasons for that approach in its historical context are helpfully set out in the definitive textbook, Carmichael, Sudden Deaths and Fatal Accident Inquiries[3]. But it does not represent the whole picture. In the same text[4], the following observation is made:

"Be it noted that, although the findings required of a sheriff under the 1976 Act are depersonalised in respect that he has no power to name a person or persons, if any, to whose fault and negligence the accident is attributable, this does not mean that the evidence led at an inquiry may not disclose fault. In that event, a finding implying or imputing fault is competent. In addition, where the evidence is sufficiently compelling, the responsibility of exposing and finding fault should be accepted. The whole object of impartial public inquiry is to get at the truth, to expose fault where fault is proven to exist, and in all cases to see to it so far as humanly possible that the same mistake, whether it arise through fault or any other reason, is not made in the future. The public interest, in whose names inquiries are held, requires and deserves no less."

Thus my approach has been that it is not my role to search for fault; but in the event that I find it I should not hesitate to express it.

3. There are two primary purposes of a fatal accident inquiry, apart from the formal one of where and when a death took place:

First, it is an opportunity for the whole circumstances of an accident to be aired in public. Witnesses are examined and cross-examined under oath and documents are considered and scrutinised. Any party interested in the circumstances is free to come to his or her own conclusions on the evidence.

Secondly, it is an opportunity for an independent judge to come to his or her own conclusions on the evidence and to present them in the form of findings in a determination. But the determination is not the same as a judgment delivered at the end of a civil proof or a criminal trial. It has no consequences. A judgment at the end of a proof might result in an order for the payment of damages by one party to another, in the form of a decree which the law will enforce. A criminal trial might result in a finding of guilt which in turn will lead to the court imposing a penalty which, again, the law will enforce. In contrast, a determination at the end of a fatal accident inquiry has no legal effect. If the court decides upon the cause of the death, any party can ignore it and continue to maintain that the death was caused by something else. If the court makes a recommendation for future action, the party burdened with implementing it is free to disagree and do nothing. After a civil proof it is customary for the court to deal with all the facts and circumstances, decide what facts are proved, apply the law to those facts and then reach a final decision. The judgment will be a comprehensive document. But that is not necessarily the correct approach in a fatal accident inquiry. Given that one of its purposes is to allow interested parties to hear the evidence, there will be occasions when there is no purpose in the court reaching any formal conclusions upon all of it. That is the approach which I have adopted. In particular, I have not followed the usual practice (and one which I have always followed on previous occasions when presiding in fatal accident inquiries) of setting out my conclusions on the evidence by way of findings in fact. I have not done so for three reasons:

1. The speciality of accidents in the air is that a full investigation is always carried out by the Air Accident Investigation Branch ("AAIB") of the Department of Transport. That is what happened in this case. The AAIB report was published in October 2011. It is an impressive document which extends to 114 pages and ten appendices. It may well be that the fact that the investigation took some 30 months is testimony to its thoroughness. No party questioned the technical data. The report describes most of the relevant facts which might otherwise be set out by me as findings in fact. It has been seen and doubtless read by all the parties with an interest. Any attempt by me to reduce it to findings in fact would do a discourtesy to the careful work of the inspectors who are plainly experts in their respective fields and, more importantly, it runs the risk of a lawyer's use of language inaccurately describing what is already correctly and comprehensively set out by skilled engineers. More prosaically, to reduce all of the evidence to findings in fact would mean that they would be in the hundreds, if not the thousands. I do not think that would assist understanding.

2. Equally importantly - perhaps more so - this inquiry was established in the public interest. The public is not made up exclusively of aeronautical engineers. My determination, so far as is possible in the face of evidence which was both complex and very technical, should try to inform the public as a whole about the circumstances of the accident. Neither is the public made up exclusively of lawyers. There is a danger that findings in fact, the idea of which is readily familiar to litigation lawyers and judges, would obscure, rather than assist, a proper understanding of the facts and the conclusions to be drawn from those facts.

3. But there is also a human aspect to this matter. I have set out in the introduction how the accident occurred. In doing so, I have avoided technical language. I have also attempted, I hope sensitively, to express in a narrative style how this accident is likely to be remembered by the victims' families and others close to them. As in any tragedy, the world has a habit of moving on. But that is not an option for those left to cope with the sudden loss of loved ones. No-one could not be moved by the courage of many members of the victims' families who sat through every day of the inquiry. Indeed, there was a poignant moment when a witness was being taken through the graph in the AAIB report which set out the timeline of the accident that I, if not others present, understood for the first time the true horror of what took place. It is important for us all that this sense is not lost in the technical language in which of necessity the evidence must be expressed. In avoiding formal findings in fact, I have endeavoured to express the technical evidence, insofar as it is discussed, in language which while still technically accurate will nevertheless inform the members of the public who are neither engineers nor lawyers about what happened and the lessons to be learned. In doing so, I hope, however inadequately, to pay proper respect to the honour of the victims and those who are most closely affected by their loss.

But there is a further consequence caused by the nature of fatal accident inquiries. I do not intend to deal with every aspect of the evidence; nor do I intend to discuss in detail every point made in the parties' submissions, particularly those made by Mr Marshall for the families. For some of the points, I simply do not accept that there has been sufficient evidence led at the inquiry. For others, I consider that they would detract from the principal issues which ought properly be discussed and determined upon. That is not meant as a discourtesy; instead it is out of a desire to address what Mr Marshall identified as the principal questions which the families, and probably others, want answered. These are, first, why did the accident happen and, secondly, what has been done and, if appropriate, what more can be done to avoid such an accident happening again. Thus, this determination does not seek to be a comprehensive - and probably unwieldy - document setting out the whole facts and circumstances, the arguments for and against the propositions put and my decision on each of them. Any party interested in the accident should therefore look at the AAIB report, the other productions and, where appropriate, the transcript of the evidence. This determination will, I hope, answer the main questions, but the answers to any others will likely be found in the whole inquiry papers.

[8] Before turning to the discrete matters which I am required to address, I wish to comment briefly upon two further matters:

The first is the scope of the particular evidence allowed in the inquiry. Mr Marshall is a hugely experienced solicitor. It was obvious to me that he had prepared his case with his customary diligence. His mastery of technical detail was outstanding. During the course of his cross-examination of each witness, he probed with great skill to ensure that I was fully informed of all and any relevant facts and circumstances. On occasion, others represented at the inquiry unsuccessfully sought to restrict his questions. But there were occasions when they were successful. I will not go over again what I said when such objections were made, but it might be helpful to Mr Marshall's clients if I explain my broad approach on this matter. I have already set out the statutory scope of the inquiry; it can include matters such as the overall performance of the company charged with the proper maintenance of its fleet of helicopters. But that has to be based initially upon facts and circumstances which are disclosed in the evidence which it is anticipated to be led. The same applies to the performance of the statutory body charged with the regulatory supervision of that company. The expression "fishing diligence" was used on a number of occasions. To the layman that might sound as dismissive of genuine concerns of parties to the inquiry. It is not intended to be so; rather, it is a technical term used by lawyers to describe attempts to widen the scope of an inquiry to matters which are either peripheral or are based on no known facts or averments of fact. A fatal accident inquiry has to be kept within reasonable bounds; it must hear evidence relevant to its statutory scope; but its ambit should not be widened to include speculative cross-examination or recovery of evidence about matters the relevance of which is not even hinted at. Thus, there was an insufficient evidential basis for cross-examination intended to identify the possibility of failures by the Civil Aviation Authority in its discharge of its regulatory functions over Bond Offshore Helicopters Limited. Nor was there a sufficient evidential basis to support the recovery of documents relating to the maintenance of the other helicopters within the Bond fleet. Nor was there a proper basis to allow cross-examination in relation to an earlier accident of a Bond helicopter. Indeed, to do so would almost inevitably have resulted in a full inquiry into the circumstances of that accident - a result clearly outwith the scope of this one. Probing witnesses who are giving technical evidence is the proper role of a lawyer, but any alternative technical version of the evidence or the conclusions to be drawn from it should invariably be founded upon other expert evidence. Mr Marshall was not in a position to lead such evidence. In any event, I am confident that if there had been any indication that such matters required investigation the Lord Advocate, acting in the public interest, would have sought to include them within the scope of the inquiry.

The second matter is the standard of proof about which there was some discussion during the course of the evidence. The law recognises two standards: beyond reasonable doubt and on the balance of probabilities. Beyond reasonable doubt is the standard of proof which applies in criminal trials; the burden of proof is always upon the Crown. Balance of probabilities means what it says: what version is more probable and, as I said to more than one witness, it can usefully be expressed as 51%:49%. That is the standard of proof which I must apply in determining facts in this case. On one critical issue I have also commented upon the higher standard. It is not my role to criticise or approve decisions by the Lord Advocate not to embark upon a prosecution. But I am aware that his decision has caused distress to some, if not all, of the victims' families. By giving my opinion on whether an issue is proved to the standard of proof beyond reasonable doubt, I hope that it will at least shed some light upon what might have been the reasons for no prosecution taking place. I do that in the special circumstances of this case, but it is important to emphasise that I am not suggesting that it is appropriate for the Lord Advocate to explain his reasons for the decision he made. That he is independent and not accountable to any interest group or any party affected by his decisions is an important constitutional principle under our law - and indeed is a fundamental strength of it.

[9] I now turn to the discrete matters which I am bound to consider.

The cause or causes of the accident

[10] It is not difficult to imagine that this is the matter of most concern to the families of the deceased - and indeed others. As will be described, shortly before the accident Bond maintenance employees were responsible for a number of admitted failures correctly to perform maintenance on G-REDL helicopter. The starting point in considering the cause or causes of the subsequent accident might be that it would be an extraordinary coincidence if the failure properly to carry out inspection and maintenance of the helicopter's gearbox was not causative of a catastrophic failure of the same within a matter of days. But, as the evidence made clear, such a coincidence was indeed a possibility.

[11] The AAIB inspectors reached the following conclusions:

1. There was a catastrophic failure of the helicopter's main gearbox ("MGB");

2. The failure of the MGB initiated in one of the eight second stage planet gears in the epicyclic module which itself is part of the MGB;

3. The planet gear had fractured as a result of a fatigue crack;

4. The precise origin of that crack could not be determined, although it is likely to have occurred in the loaded area of the planet gear bearing outer race.

5. A metallic particle had been discovered on the epicyclic chip detector during maintenance on 25 March 2009, some 36 flying hours prior to the accident.

6. This was the only indication of the impending failure of the second stage planet gear;

7. The lack of damage on the recovered areas of the bearing outer race indicated that the initiation was not entirely consistent with the understood characteristics of spalling;

8. The possibility of a material defect in the planet gear or damage due to the presence of foreign object debris could not be discounted.[5]

[12] The significance of numbers 7 and 8 is that if the damage was not caused by spalling, there would be no possibility of a causal link to the failures in inspection and maintenance a few days before the accident.

[13] Spalling is described in the AAIB report[6], as a "phenomenon which can be found in rolling element bearings". It is one of the most common reasons for bearing failure.[7] It is otherwise known as "rolling contact fatigue", which in layman terms is where two metal surfaces are designed to come into contact with each other. Eventually this can result in the formation of small subsurface fatigue cracks which in turn can result in the release of microscopic particles from highly loaded areas of the surface of one of the metal surfaces, namely the race or rolling elements. The release of these particles leaves craters in the surface which act further to concentrate local stresses. Over time there is an increase in the number and size of the particles released. If not checked, these particles can cause damage to parts of the gearbox which can result in its failure. Spalling comes in two forms. The first form is known as subsurface spalling which was historically the more common form and, put simply, was because of defects in the metal of the relative component. Due to improvements in steel production methods in the 1970's, this type of spalling is now rare. The second form is surface initiated spalling which is known to initiate from surface breaking inclusions.

[14] The significance of the difference in types of spalling in this case is that if the cause of the failure of the gearbox was because of defects in the metal it matters not what failures there were in the maintenance regime. On the other hand, if the cause was some form of surface breaking inclusion then the issue of any failures in maintenance comes sharply into focus.

[15] The conclusion of the AAIB inspectors was that while there was evidence of spalling in the second sense, the possibility of a material defect in the metal could not be discounted. During the course of his evidence, Mark Jarvis, a senior engineering inspector with the AAIB, explained under reference to the report that the evidence of damage to the gears caused by spalling was inconsistent with what one would expect to see in a classic case of spalling[8]. He gave examples of other accidents where spalling was identified as the likely cause. The damage which one would expect was not present in the case of G-REDL. At one point, I invited him to say which of the three possible explanations - spalling, material defect or foreign object debris - was more probable. He insisted that he could not answer that, given the lack of complete evidence, including in particular the unrecovered part of the failed second planet gear of the epicyclic module[9] being the means by which the reduction of the speed of the output from the main module of the gearbox is achieved in order to produce the torque to turn the rotor blades.[10]

[16] This conclusion was disputed by Dr Emmanuel Mermoz who is Eurocopter's head of its Dynamic System Architect Department and described himself as its senior expert in the transmission field. In his opinion, spalling, rather than material defect, was the more probable cause of the gearbox failure.[11] As I understood his evidence, he reached that conclusion for the following reasons:

1. If there had been a material defect it would have become known at a much earlier stage in the lifetime of the epicylic module. In particular, such a defect would have been generated during the manufacture phase and so would have weakened the planet gear from the beginning and would have become apparent during the first 200 flight hours. The G-REDL planet gear had done 3,600 flight hours. Moreover, once a certain number of loads had been applied and the part had not broken it follows that the application of the same load in the future will not break it.[12]

2. The size and shape of the particle found on the epicyclic chip detector on 25 March 2009 were consistent with an advanced stage of classic spalling[13], as indeed was the evidence that its previous location was at the highest loaded area of the outer race[14] and that it was dented by one or two smaller 'horseshoe' particles before being released from the outer race.[15]

3. The dents on both the inner and outer races were consistent with classic spalling.[16]

4. The start of the zone I crack[17] corresponded to a sub-surface position below the outer race surface.[18]

[17] On the other hand, he accepted that the science of the development of the signs of cracking caused by spalling was not well developed due to the fact that the focus had always been on identification of spalling at an early stage through maintenance.[19]

[18] Both Mr Jarvis and Dr Mermoz were impressive witnesses. Their qualifications to give expert evidence are not in doubt. Mr Jarvis has investigated 300 incidents, 30 involving helicopters, during his time with the AAIB. Dr Mermoz has a formidable academic record, including a PhD in gearbox vibration monitoring. He is an assistant professor at Aix-Marseilles University. Mr Jarvis is of course wholly independent, while Dr Mermoz is employed by Eurocopter which, as the manufacturer of the helicopter, has an interest not to have the cause of the accident identified as a material defect. But I found both the manner and substance of Dr Mermoz's evidence to be such that if he genuinely thought that this was the cause of the accident he would not have hesitated to say so.

[19] At the end of the day both witnesses broadly agreed on the factors which required to be taken into account. The difference between them was about what emphasis should be placed on each factor. Counsel for Eurocopter described Mr Jarvis' approach as cautious. I agree with that. But it does not follow that Dr Mermoz was being incautious. On the contrary, I found his evidence to be measured and carefully expressed with no hint of exaggeration. As both witnesses acknowledged, the difficulty in this case was that the small piece of the helicopter which would have proved the matter beyond any doubt had not been recovered from the seabed and they therefore had no choice but to draw conclusions as best as they could from the imperfect evidence before them.

[20] In my opinion, on the balance of probabilities the conclusion reached by Dr Mermoz ought to be preferred. It was agreed by them both that spalling is the most common cause of damage to helicopter gearboxes. In contrast, material defect is rare. As Mr Jarvis recognised, there was no evidence which directly pointed to material defect as the cause. He acknowledged that the planet gear had completed a great many cycles[20] and was one of the hardest working components in the helicopter[21]. He also agreed that the examination of the production records and the sampling of test specimens showed that there were no apparent defects in the planet gear.[22] But, for me, the most compelling factor in favour of Dr Mermoz's conclusion came in three passages from Mr Jarvis' evidence.

[21] In a discussion with me about the role of the European Aviation Safety Agency ("EASA"), Mr Jarvis said this:

"The EASA go through their processes and have concluded that the gear meets the certification requirements. The AAIB's perspective is that there is the potential, however low [my italics], for a defect to exist within the body of the gear and the EASA recognise that the potential exists."[23]

[22] During cross-examination, there was the following exchange:

"Q. We have covered spalling. Can we then go on to consider the material defect and, as I have noted... , you have described the prospect of a material defect being "potential, however low that is". You remember saying that?

A. I do.

Q. Is it low because if you have a material defect it would have been generated in the manufacturing phase and would have weakened the planet gear from the outset?

A. The probability is low [my italics] because you would expect - the normal behaviour is you would get the vast majority of failures due to material defect relatively early in the component's life. As the component goes through its life, the probability of failure decreases but never reaches zero.

Q. Is that because one reaches what might be termed the asymptote?

A. That's correct, yes.

Q. Does that mean in layman's terms essentially it's a fatigue limit beyond which failure is unlikely to occur because the part essentially will go on ad infinitum, as it were? That's in laymen's terms; please correct me if I'm wrong.

A. I would say that it means that the probability of failure becomes very low [my italics] for whatever reason but never reaches zero."[24]

[23] In a further passage, there was another exchange:

"Q. In short, Mr Jarvis, I suggest to you that it is extremely unlikely that there would have been a material defect in this part [the planet gear]?

A. As I've said previously, however unlikely [my italics], the possibility remains that material defect was present and may have contributed to this accident."[25]

[24] It seems to me that these passages sit uneasily with Mr Jarvis' conclusion that even on the balance of probabilities he cannot accept that spalling was the cause. On the contrary, they are a clear indication that he ought to have readily concluded that material defect was improbable.

[25] Accordingly, for the reasons I have given I hold on the balance of probabilities that the cause of the accident was spalling and not material defect. But if the standard of proof has been beyond reasonable doubt, I would be bound to have concluded that (a) in the absence of the crucial part of the planet gear, (b) the acceptance by both experts that material defect cannot be completely ruled out and (c) in the face of the conclusion reached by Mr Jarvis, a reasonable doubt would remain.

[26] As I have earlier described, Mr Jarvis proposed three possibilities as the cause, namely spalling , material defect and foreign object debris. Dr Mermoz preferred to identify the choice as either material defect or spalling, but that the latter could also arise through foreign object debris. I prefer Dr Mermoz's evidence on this point. Further, I hold that foreign object debris can be ruled out, again on the balance of probabilities, not least because of Mr Jarvis' evidence that Bond "had taken... every conceivable step to minimise the opportunity for FOD to enter the gearbox."[26]

The role of Bond Offshore Helicopters Limited in the cause or causes of the accident

[27] It was not disputed by any witness at the inquiry that the primary means of ensuring that spalling does not result in gearbox failure is through regular maintenance. The maintenance carried out by Bond from 25 March 2009 until the date of the accident is set out fully in the AAIB report. I do not intend to rehearse it in comprehensive detail. Nor was there any dispute, particularly by Bond, that they had failed to carry out maintenance of the helicopter's gearbox in accordance with the recognised procedures. The relevant circumstances of Bond's maintenance can be summarised as follows:

1. The primary method for locating and capturing metal particles, otherwise known as chips, caused by spalling is by means of magnetic chip detectors. The main gear box is fitted with two such detectors. One is located in the sump area below the main module and the other is adjacent to the epicyclic gearbox module. A third detector is located in the conical housing. The main module chip detector provides the flight crew with a visual warning of the detection of a magnetic chip. It is also recorded on the Health and Usage Monitoring System ("HUMS"). The epicyclic chip detector was a relatively recent innovation and was introduced to collect most of the chips generated by the epicyclic module, thereby preventing them from contaminating the main module.[27]

2. The approved maintenance programme included a requirement to carry out a periodic visual inspection of each magnetic plug for contamination in accordance with Eurocopter's Aircraft Maintenance Manual, in terms of Task No. 60-00-00-212 entitled "Checking a Magnetic Element". For the epicyclic module, the manual directed that the engineer extracts the magnetic plug and then checks it for collected particles. If particles are found, the engineer should remove the epicyclic module, remove all the particles, analyse them and in the event that they fall outwith the limits of the acceptable criteria have the module sent to Eurocopter for survey.

3. HUMS was mandatory on helicopters such as G-REDL but in the industry was regarded as a maintenance advisory tool and not as the primary method for detecting gearbox degradation. Before and during a flight, data is collected on the HUMS data card, the information on which is downloaded to the operator's ground station where it can be scrutinised. The recorded data includes chip detection.

4. On 25 March 2009, after completion of turnaround maintenance procedure and after G-REDL had set off on its second series of flights for the day, a Bond engineer noted on the downloaded HUMS data that an epicyclic module chip warning had been recorded. On the helicopter's return a physical inspection of all the MGB magnetic chip detectors was carried out, but no particles were found on any of them. The helicopter was removed from service to allow further investigation. Later, an engineer checked the epicyclic chip detector and discovered a small metallic particle which was removed.

5. In the meantime, Bond's HUMS specialist engineer was inspecting the downloaded data and observed an abnormal vibration trend on the main module bevel gear. He contacted the HUMS specialist at Eurocopter. He did so by telephone. During the course of telephone conversations the engineer who had found the particle told the Bond HUMS specialist of that fact and he passed it on to the Eurocopter HUMS specialist. It is at this point that the evidence of the Bond witnesses and the Eurocopter witnesses no longer coincides. I have not been able to decide which version to believe. But at the very least it can be said that there developed a misunderstanding about the nature and location of the particle. The Eurocopter HUMS specialist thought that metallic particles had been found in the main module. Even more critically, he and his colleagues were under the misapprehension that the Bond engineers had already performed certain tasks set out in the maintenance manual, including task no. 60-00-00-212. Instead of advising Bond to carry out that task, Eurocopter advised them to follow another work card. This required, amongst other things, an inspection of the particle to discover whether it was of such a size or form which would prevent the helicopter being returned to service. The Bond engineer misidentified the particle, with the result that the gearbox was declared as serviceable. Despite this conclusion the Bond engineers still decided to take a further precautionary step - to cover the possibility of the gearbox producing more metallic particles after the helicopter's return to operation. This involved the inspection of the epicyclic and main module chip detectors every shut down for the next 25 flying hours. That was duly done (indeed it was done for a total of 36 flying hours). No additional particles were detected. In addition, Bond had inspected the epicyclic module oil filter, drained the oil through filtered paper and refilled with new oil.

6. It transpired that the concern about the abnormal vibration trend on the main module bevel gear proved to be groundless.

7. The proper means of communication between an operator and the manufacturer about a possible fault was by means of one or other of two written forms (known as 'EDR' or 'DR'), neither of which was used on this occasion.

[28] Predictably, during the course of the inquiry there was much discussion about the circumstances which led Bond not to follow the clear terms of the maintenance manual by performing task no. 60-00-00-212. Bond readily acknowledged that they ought to have done so. They had little choice in making that admission given the clear terms of the manual. Counsel for Bond correctly submitted that the existence of the epicyclic module detectors "did not have a high profile". He also correctly pointed out that Mr Jarvis agreed that there was a joint responsibility on both the manufacturer and the operator to ensure that recognised procedures were followed, a point which Eurocopter readily acknowledged. But in my opinion none of that matters; nor does it mitigate the responsibility of Bond to follow the manual. On many occasions during the inquiry it was acknowledged that the primary rule throughout the industry is that everything must be done by the book - that is to say, in accordance with the maintenance manual. There can therefore be no excuse for not doing so.

[29] The issue of the misidentification of the particle is of secondary importance, given that it was a consequence only of Bond's failure to perform the correct task. Its relevance in identifying causes of the accident is in my opinion peripheral, although, it has resulted in a change in the instructions given by Eurocopter when the task is being performed. Mr Marshall invited me to conclude that I should not believe the engineer's evidence that he thought the chip was silver or cadmium but magnetic. If he meant that the engineer was being untruthful, I do not agree. All that it indicates to me is that the engineer was confused. At the end of the day, it does not matter: the identification was wrong.

[30] In these circumstances, where it is acknowledged by Bond that they failed to follow the maintenance procedures, the next question is whether the admitted failure was one of the causes of the accident. What would have happened if task no. 60-00-00-212 had been performed? Counsel for Bond submitted that it is simply not known what, if anything, would have been found if the epicyclic module had been removed. Mr Main for the Crown took the same view. He submitted that the fact that no chips had been detected prior to 24 March 2009 and none was found during the period of close monitoring between 26 and 31 March might tend to suggest that no more particles would have been found on the magnets, or at least in sufficient quantities to result in the removal of the gearbox. That view is primarily based upon the evidence of Mr Jarvis, but it is instructive to quote his opinion in full:

"Had the gearbox - the epicyclic module been lifted and other material been found on the magnets enough to reject the gearbox, then that unit would have been sent for overhaul and the defective pieces would have been taken out of service. What we can't say, my Lord, is had Bond opened the gearbox and carried out that inspection, we can't say that they would have found enough material to reject the gearbox because we believe the failure mode doesn't follow the normal pattern of a spalling failure."

It is therefore clear that his opinion on this matter is coloured by his concern about spalling, rather than material defect or FOD, being the probable cause.

[31] There is not a great deal of evidence to support the view that if Bond had removed the epicyclic module they would have found sufficient evidence of particles on the magnets to warrant removing the gearbox from service. As Dr Mermoz said, the reason the matter is in doubt is because Bond failed to follow the correct procedure.[28] In the AAIB report, data is shown of all previously recorded cases where particles had been found on the MGB detectors.[29] This was put to Dr Mermoz.[30] As I understood his evidence, he pointed out that on two occasions, one in 2001 and the other in 2005, only a small quantity of particles was found on the epicyclic magnetic plugs but a lot were found on the magnets in the standard gearbox. On another occasion in 2005 no detection of particles was reported on the epicyclic magnetic plugs but there must have been the discovery of a particle to result in the operator taking the steps it did. Again, there proved to be the presence of particles on the magnets in the standard gearbox. Finally, in 2009 particles were found but their number is not described (apart from being less than 100mm2 and under reference to a photograph which was not produced in evidence), although lots of particles were again found in the standard gearbox magnets.

[32] In my opinion, these examples are inconclusive, except that they do indicate that where particles are found on the epicyclic magnets there will be more, perhaps many more, in other parts of the gearbox. That is, I think, consistent with Dr Mermoz's evidence.[31]

[33] In this case we know that one chip was detected on 25 March 2009 and scrutiny of it confirmed that there had been other smaller particles. We also know that no more chips were detected during the 25 flying hour monitoring period. Dr Mermoz was himself inconclusive:

"... the normal way to deal with spalling is that when you have got one particle and, especially in the gearbox, with the magnet, was to open to collect the particle. All the history that we've got, how it is quite early detection of spalling. Now the period that you are describing is a period on which this opportunity to stop the spalling has been missed and then you're asking to me what is the perception of what will be the rate of the generation, the rate of particle generation during that period? So what I can say which it's a continuous process to make spalling, so it should have generated particles, but as the magnets were installed in the gearbox the chip detector was only collecting a part of the particles. So it could be that particle has been generated (inaudible) but had been kept on the magnet."

Dr Mermoz earned my admiration for the manner in which he gave such technical evidence in a foreign tongue, even with an interpreter being present if he required her. But this is one passage which is not easy to interpret. It seems to me, however, that he is saying that the instant case is probably one of detection of spalling in its early stages, but that particles would have been found on the gearbox detectors. But that still leaves unanswered whether the amount and nature of the chips which would have been discovered would have been sufficient to warrant the gearbox being removed.

[34] I therefore hold that while it is certainly possible that if Bond had followed task no. 60-00-00-212 they would have removed the gearbox, on the evidence that fact has not been proved on the balance of probabilities.

HUMS

[35] I have already mentioned the employment of the HUMS machine. There was a good deal of evidence about its use during the course of the inquiry. Mr Marshall submitted that the evidence disclosed that the Bond engineering staff was insufficiently trained and experienced to employ it effectively. It is certainly true that at the time of the accident there appeared to be a lack of understanding of the possibility that the data card could either be removed too early by the pilots upon landing or that the information on it could reach the point where it was overloaded. But it was still understood that the information on it was available for inspection, albeit without the benefit of warning lights which would help to focus attention on possible problems. And, in any event, the HUMS machine was intended primarily as a diagnostic tool which would record trends over a period of time. As has been said, the principal means of ensuring the proper maintenance of the helicopter was by rigorous application of the maintenance manual. In this case the spalling, whether at an early stage or not, might have been detected if that had been done. The effectiveness of HUMS is therefore of secondary importance.

The overall performance of Bond Offshore Helicopters Limited

[36] Mr Marshall invited me to draw a number of adverse conclusions about Bond's performance as operators of helicopters. These were,

1. That record keeping by Bond's engineering staff was very poor, leading to doubts about what maintenance had actually been performed and what had not;

2. That Bond's engineering staff displayed a tick-box mentality which resulted in failure to recognise errors by colleagues;

3. That Bond's engineering management was incompetent, being unable to confirm that procedures were being followed or to challenge staff to establish procedures were being followed, and having insufficient knowledge and understanding of the maintenance procedures themselves to be aware whether work was being done properly;

4. That the training of Bond's engineering staff, including the management, was inadequate; and

5. That Bond's engineering staff was under pressure to carry out planned maintenance. Deciding not to perform unplanned maintenance accordingly created more time for planned maintenance.

[37] Mr Marshall set out in his submissions the parts of the evidence which supported these conclusions. I have studied them with care. But I am not prepared to agree with him.

[38] Like Mr Marshall, I had the benefit of considering the demeanour of all of the Bond witnesses, as well as hearing their evidence as recorded in the transcript. My overall impression was that all of the witnesses were genuinely trying to recall what occurred. I did not consider that any of them was being untruthful; nor did they attempt to put a gloss over any failings. On the contrary, I considered that they all had tried to carry out their jobs as diligently as they could. All of them impressed me as engineers who well understood the vital importance of their role in ensuring the safety of the pilots and passengers who used the company's aircraft. Nor did I detect that there was a culture within the company of not taking training seriously or that the staff had insufficient resources to perform their functions properly. That was the view of the AAIB and the Civil Aviation Authority inspectors. It is certainly true that there was a laxity in following the correct procedures in dealings with Eurocopter - and undoubtedly that should not have happened. But I am not prepared to conclude from that failure that there were systemic defects in the remainder of the maintenance procedures and their implementation. Again, there were failures in record keeping, but as the CAA witnesses confirmed such failures, while not condoned, are to be expected. Indeed, Mr Jarvis said,

"Although discrepancies in the aircraft records were identified it is the opinion of the AAIB that these did not contribute to the accident. Additionally it should be stated that it is, in the AAIB's experience, not unusual to find discrepancies in aircraft technical records."[32]

That is not to suggest that record keeping is unimportant; on the contrary, it is vital. But the evidence was that failures, invariably minor, will almost inevitably occur.

[39] The essential fact is that everyone in the company well knew that maintenance must be done by the book. On one occasion, that fundamental rule was broken. It resulted in the failure to detect a significant fault in the helicopter's gearbox, which possibly - but only possibly - resulted in the crash.

The role of the AAIB

[40] Mr Marshall had a series of criticisms of the AAIB. He had three complaints:

1. Early on in its investigation the AAIB focussed upon the precise cause of the failure of the second stage planet gear and thereby had only a limited scrutiny of Bond's management, maintenance staff, maintenance procedures and record keeping;

2. The AAIB did not recover the HUMS defect log, flight reports, usage reports or health reports for the helicopter;

3. The AAIB's investigations are flawed in that there is no direct communication among its inspectors carrying out simultaneous investigations of the same operator relating to separate incidents, resulting in systemic organisational and management failures of an operator less likely to be observed.

[41] In his submissions, Mr Marshall cites a number of passages in the evidence, as well as Mr Jarvis' answers to supplementary questions after his evidence had been completed. It is obvious that the extent, if at all, that this evidence supports the contentions made is principally to do with HUMS. I have already said that Bond and others accepted that the possibility of losing data, at least in its user friendly form, was not fully understood at the time of the accident. And while it is acknowledged that the CAA has for a number of years regarded the use of HUMS to be compulsory for helicopters working within hostile environments, its significance should not be overstated. It is primarily a diagnostic tool, its principal benefit is to provide trends over time, not immediate alarms indicating risks of potentially catastrophic events, and it is accordingly no substitute for planned maintenance and inspection. Certain steps have been taken to improve its effectiveness, but there is a danger in focussing too much upon its use and thereby diverting attention from the vital importance of maintenance. There is no suggestion in the evidence that better use of it prior to the accident would have prevented it.

[42] Mr Marshall's proposition that there was a failure to liaise with the other AAIB inspectors involved in an accident of another Bond helicopter is based on nothing other than assertion. Mr Jarvis expressly denied it:

"In the event that common issues are developed within investigations, however current or closed they may be, they will be brought together and examined as a whole on those issues."[33]

Lessons learned since the accident

[43] The crash of G-REDL was a tragedy. Coupled with the other helicopter accidents in Scotland over the recent past, it has raised fundamental questions about the safety of helicopters, not least in the oil and gas industry of the North Sea. It cost the lives of 16 men. It has caused considerable public interest. It is therefore particularly important that whatever lessons can be learned from it are properly identified and acted upon.

[44] The AAIB report[34] sets out in considerable detail what recommendations were made and the manner in which various parties acted upon them. I do not intend to repeat them all here. But I shall mention some of them, particularly those which are contested.

[45] The AAIB report[35] explains steps taken by a number of regulatory authorities to study the fatigue tolerance of the structure of helicopters, including the main rotor drive system. A joint working group was formed in 2000 among EASA, the Federal Aviation Administration, the rotocraft industry and the Technical Oversight Group for Ageing Aircraft. It recommended changes to fatigue evaluation requirements and resulted in the publication by EASA of a notice of proposed amendment to introduce improvements in the ability to avoid catastrophic failures of primary structure, including rotor transmission components. In that context and as a result of the accident, the AAIB recommended that EASA re-evaluate the certification of the gearbox to take account of this proposed amendment. Mr Jarvis[36] advised the inquiry that EASA has not yet concluded its work in the light of that recommendation. His understanding was that EASA expected to complete the work within 18 months to two years from the date of the AAIB report, which would mean that it ought to have been completed by no later than October last year. I heard no evidence from EASA or any other party about the reasons for the delay - there may be completely understandable ones. But given the uncertainty raised because of recent helicopter accidents, it seems to me that EASA should complete their work as quickly as possible, not least to maintain public confidence in the type of helicopter involved in this accident.

[46] AAIB also recommended to Eurocopter that it should introduce further means of identifying in-service gearbox component degradation, such as debris analysis of the main gearbox oil.[37] As Mr Jarvis explained,[38] this recommendation was made primarily because of his concern that this was not a classic spalling case. The traditional method of debris analysis is by means of a spectrographic oil analysis programme ("SOAP"). That was done on the Puma and Super Puma fleet until 1986 and is still done by the Royal Air Force. Mr Jarvis also advised that there are some newer systems available which analyse the oil on a real time basis which are particularly useful because they are more scientific in nature and rely less on the expert interpretation of the maintenance engineer.[39]

[47] Eurocopter has not accepted this recommendation. It gave a number of reasons[40], but the primary one was that detection by magnetic plugs and chip detectors was the best method, given that SOAP was outdated because of the improvements in design of the Super Puma gearbox. In his evidence, Dr Mermoz set out in detail why he considered that SOAP analysis should not be introduced, particularly for spalling.[41]

[48] I am unable to reach a concluded view on these competing arguments. I can say, however, that it was unfortunate that the other potential methods for oil analysis, as mentioned by Mr Jarvis, were not discussed. I will question later whether it should always be that regarding regular maintenance as the principal means of ensuring the safety of helicopters is correct, but in the present context I consider that steps should be taken by Eurocopter in discussion with the CAA and EASA to consider whether the other methods of oil analysis should be applied to Super Puma helicopters. For aught yet seen, a problem with such methods might be the risk of false readings, which is an issue with SOAP. That can result in economic consequences. But the helicopter industry as a whole must also be reminded that its primary responsibility is the safety of its passengers and crews. Indeed, to compromise on that responsibility can potentially be self-defeating in purely economic terms as well.

[49] The AAIB also made a recommendation that there be installed a cockpit warning light in the event of an epicyclic chip detection.[42] As another AAIB senior inspector, Timothy Atkinson, explained[43], the rationale behind that was that this accident had shown that perhaps there had been a very short period of time between the first indication of a problem with the gearbox and its failure. But he readily accepted that it was unlikely that such a warning light would have prevented the accident.[44] He also accepted that there was a danger of a false reading which, depending upon what instructions were available to the pilot, might result in an unnecessary ditching of the aircraft into the sea with the dangers which that might cause.[45] On the other hand, he argued that the advantage of a warning light coming on before take-off would mean that the helicopter would immediately be taken out of service and inspected.[46]

[50] Eurocopter do not consider that such a warning light should be fitted, although it does now offer it as an option to customers. It is fitted as standard to the Eurocopter EC225 LP model helicopter. The reasons for Eurocopter's view are as set out in its response to the AAIB recommendation.[47]

[51] I do not consider it appropriate for me to make a recommendation that the warning light be a compulsory part of the Super Puma fleet. The possibility of a false reading is plainly a very real one - and could result in an additional hazard for passengers and crew. In any event, its availability on G-REDL would not have avoided the accident. It is therefore a peripheral issue to the causes of the accident. There was no hint that its unavailability was because of any desire of Eurocopter to save money. As in most issues of safety, this is a case of weighing up the advantages and disadvantages. The evidence against Eurocopter's position was not compelling enough for me to consider that its approach was plainly wrong.

Delay in the Fatal Accident Inquiry

[52] Mr Marshall criticised the time which it has taken since the accident both in the publication of the AAIB report and the start of this inquiry. I consider he was well justified in doing so. It is instructive to note that the Lockerbie fatal accident inquiry occurred in less than three years from the date of the crash - in contrast to this inquiry which was nearly five years. The Crown produced with its submissions a timeline showing what steps were taken. The period of the AAIB investigation was not explored in any detail in the evidence. I, myself, am aware of the difficulties which occurred in finding suitable dates and venue. I could easily explain all the steps taken by me and the Scottish Court Service. But I do not think that a detailed investigation of every action taken by every public body, whether investigatory, supervisory or judicial, over every month would add much. What can, I think, very properly be said is that nearly five years is on any view far too long and that we all have a responsibility for that. And that everyone concerned in future fatal accidents involving aircraft of whatever kind should do much better.

[53] Mr Marshall was also critical of the problems caused by the delay in providing him with reports and productions in order to prepare properly for the inquiry. I also have some sympathy with that. It was, for example, difficult to understand why the CAA report and the identification of its witnesses were unavailable until after the inquiry started. Nevertheless, what I can say is that in the result I do not consider that my investigation was hampered by any such delay. I am reasonably satisfied that the fundamental issues have been properly aired and I can detect nothing obvious to me that was missed from proper inquiry. Having said that, I hope that the Crown will in the future be mindful of the need to give full disclosure of material as far in advance of an inquiry as is possible - and that other agencies upon whom the Crown has to rely are careful to remember that all parties to an inquiry need proper time to carry out their own preparations.

General safety concerns about helicopters

[54] There has been considerable media interest in this fatal accident inquiry. It took place in the context of a number of major accidents involving helicopters in the North Sea and elsewhere. Quite properly, the other accidents, some fatal, were not discussed in the evidence. But it is impossible not to be aware of the overall context within which this inquiry took place. It would be quite improper for me to discuss these other accidents, not least because, as this inquiry has shown, the reality is that the causes of any accident, particularly one involving a technically sophisticated machine such as an aircraft, will be identified only after exhaustive inquiry of complex and very technical evidence. I am aware from Press reports that a parliamentary inquiry is proceeding into the overall issue of helicopter safety and that even since the evidence closed the CAA has issued further instructions in relation to the employment of helicopters in the North Sea. All that I can say is that I hope that this determination illustrates how complex the causes of an accident can be and that there is a danger in drawing general conclusions without due and proper investigation of the facts in each case.

[55] But having said that, I should add this:

During the course of his evidence, I asked Mr Jarvis if he thought there was something inherently more dangerous in helicopters compared to other aircraft. He replied as follows[48]:

"It's a function of the design of helicopters, my Lord, in that rotory wing aircraft, helicopters, essentially have a critical load path through the gearbox to the rotor. Fixed wing aircraft can have - fixed wing aircraft fly by means of structure which can be made inherently fail-safe. Helicopters fly by means of a mechanism which is a mechanical unit and is thereby potentially more prone to failure and that really is the issue between fixed wing and rotary wing aircraft, my Lord. One flies by means of a mechanism; the other flies by means of its structure and that gives you different levels of achievability in terms of safety and redundancy."

[56] A recurring theme during the course of the inquiry was that the key to ensuring safety of helicopters and preventing catastrophic mechanical failure was rigorous maintenance procedures. In this particular case, it was primarily about how to detect spalling in a gearbox. There was evidence about how the materials used to manufacture a helicopter gearbox have greatly improved over the last 40 years or so. But there still is a general acceptance that spalling is inevitable. The evidence did not however rule out the possibility of a material defect in the metal itself. Nor was there any discussion about what, if any, alternative metals or other materials might exist which would be less likely to have a material defect or, perhaps more relevantly, would prevent spalling altogether. I mention this because it is clear that no matter the rigorous nature of maintenance procedures it is almost inevitable that human error will occur from time to time. Given the heightened risk of failure of rotory wing aircraft as described by Mr Jarvis, perhaps it should be the ambition of manufacturers to focus their future research on finding a means by which helicopters can be manufactured so as to diminish the critical importance of regular maintenance and to improve the inherent integrity of the materials from which they are built.

Findings

Fatal Accidents and Sudden Deaths Inquiry (Scotland) Act 1976:

Section 6(1)(a) - Where and when the deaths and the accident resulting in the deaths took place:

John Brian Hugh Barkley, date of birth 12 February 1979, 39 Heathryfold Circle, Aberdeen

Paul Stephen Burnham, date of birth 27 June 1977, Millburn Cottage, Monteach Road, Methlick, Ellon

James Antal Reamonn Stephen Costello, date of birth 13 May 1984, 64 Union Grove, Aberdeen

Alexander Gordon Dallas, date of birth 17 June 1946, 36 Isla Place, Mastrick, Aberdeen

Raymond Steele Doyle, date of birth 13 October 1951, 67 Etvie Court, Condorrat, Cumbernauld

James John Edwards, date of birth 14 June 1975, 14 Lydia Walk, Liverpool

Vernon John Elrick, date of birth 8 January 1968, 5 Langdykes Drive, Cove Bay, Aberdeen

Nairn James Ferrier, date of birth 3 March 1969, 10 Navarre Street, Broughty Ferry, Dundee

Nolan Carl Goble, date of birth 17 March 1975, 1 Hartbee Road, Norwich

Gareth Wyn Hughes, date of birth 17 November 1955, Legastone Farm House, by Friockheim, Angus

Richard Anthony Menzies, date of birth 21 March 1985, 7 Scotsmill Drive, Blackburn, Aberdeen

Warren George Mitchell, date of birth 14 December 1970, 3 Balcairn Avenue, Oldmeldrum, Aberdeenshire

David John Rae, date of birth 22 March 1946, Christlebank, Castle Douglas Road, Dumfries

Leslie Stanley Taylor, date of birth 19 September 1967, 48 Castleview Avenue, Kintore, Aberdeenshire

Stuart Lee Wood, date of birth 6 August 1981, 46 Corrennie Circle, Dyce, Aberdeen

Mihails Zuravskis, date of birth 16 June 1969, 51-7 Ziemel Blazmas, Riga, Latvia

died at about 1355 hours on 1 April 2009 on board the Mark 2 Super Puma AS332 L2 helicopter, registered number G-REDL, owned and operated by Bond Offshore Helicopters Limited ("Bond"), then travelling between the Miller Platform, Miller Oil and Gas Field, 145 nautical miles north east of Aberdeen and the Bond offshore helicopter base at Aberdeen Airport, at a location approximately 11 nautical miles north east of Peterhead.

Section 6(1)(b) - The causes of such deaths and the accident resulting in the deaths:

(1) In respect of each of said John Brian Hugh Barkley, Raymond Steele Doyle, James John Edwards, Vernon John Elrick, Nairn James Ferrier, Warren George Mitchell, Stuart Lee Wood and Mihails Zuravskis, the cause of death was multiple injuries sustained as a passenger involved in the crash of the said helicopter at sea. The indications were that the death was as a result of sudden deceleration and blunt force impact and there was nothing to suggest survival with subsequent drowning.

(2) In respect of each of said Paul Stephen Burnham, James Antal Reamonn Stephen Costello, Alexander Gordon Dallas, Nolan Carl Goble, Gareth Wyn Hughes, Richard Anthony Menzies, David John Rae and Leslie Stanley Taylor, the cause of death was multiple injuries sustained during the said crash. The pattern of injury was entirely consistent with the circumstances and death would have been instantaneous.

(3) The cause of the accident which resulted in said deaths was the catastrophic failure of the main rotor gearbox of the said helicopter on the said date, which was as a result of a fatigue fracture of a second stage planet gear in the epicyclic module and which caused the helicopter to descend into the sea.

(4) The fatigue fracture of the second stage planet gear in the epicyclic module was caused by spalling.

Section 6(1)(c) - The reasonable precautions, if any, whereby the deaths and the accident resulting in the deaths might have been avoided

It is possible that if the following failures by Bond had not occurred the accident might have been avoided:

(a) Bond failed to perform task no. 60.00.00.212 of the aircraft maintenance manual on 25 March 2009 after a metal particle had been discovered on the said helicopter's epicyclic chip detector, which would have resulted in the removal of the epicyclic module and an examination of the magnets on the separator plates;

(b) Bond failed to ensure that communications with the manufacturer of the said helicopter, Eurocopter, on 25 March 2009 were done in accordance with the recognised procedures, with the result that misunderstandings arose between the parties, which contributed to the failure by Bond to perform task no. 60.00.00.212;

(c) Bond failed to identify the nature of the substance of the said metal particle when on 25 March 2009 performing task no. 20.08.01.601 of the aircraft maintenance manual and in doing so might have lost the opportunity to avoid the consequences of its failure to perform task no. 60.00.00.212.

Section 6(1)(d) - The defects, if any, in any system of working which contributed to the deaths or the accident resulting in the deaths

On the evidence, no such defects exist.

Section 6(1)(e) - Any other facts which are relevant to the circumstances of the deaths

(a) The joint working group of the European Aviation Safety Agency ("EASA"), the Federal Aviation Administration, the rotocraft industry and the Technical Oversight Group for Ageing Aircraft has considered a proposal by EASA to introduce improvements in the ability to avoid catastrophic failures of primary structures, including rotor transmission components, of helicopters. EASA intends to incorporate this amendment into its certification standard 29.517. It should do so as soon as possible.

(b) Eurocopter, the Civil Aviation Authority and EASA have not together considered methods of oil analysis of Super Puma helicopters, other than by means of a spectrographic oil analysis programme. They should do so.

(c) The traditional means by which helicopter safety is ensured is by way of rigorous maintenance procedures. Helicopter manufacturers should consider whether future research and development should focus upon whether alternative metals or other materials can be developed to reduce, or eliminate, the risk of spalling in helicopter gearboxes and thereby lessen the dependence upon maintenance procedures as the primary method of ensuring safety.

Sheriff Principal Derek C W Pyle

Aberdeen, 13 March 2014

---