UK investigators have determined that certification and testing loopholes contributed to the fatal crash of a Leonardo Helicopters AW169 after its tail rotor failed shortly after take-off, an accident in which Vichai Srivaddhanaprabha, the then-owner of Leicester City Football Club, was killed.
In its final report into the 27 October 2018 crash, the Air Accidents Investigation Branch (AAIB) says the Starspeed-operated AW169 (G-VSKP) came down after a loss of tail rotor authority triggered by the seizure of a duplex bearing in the tail rotor control system.
The probe identified a series of regulatory flaws which, when combined, created the circumstances for the crash.
These included Leonardo Helicopters’ failure to share flight-test load data with the bearing manufacturer, which would have allowed a specialist to better assess the suitability of the bearing for the application and the loads it would encounter.
The airframer also did not carry out routine inspection analysis of bearings removed from service.
However, neither action was required by European Union Aviation Safety Agency (EASA) regulations or guidance, says the report.
In addition, the AAIB says there were no design or test requirements for CS-29-category rotorcraft “which explicitly addressed rolling contact fatigue in bearings identified as critical parts”, such as in the tail rotor control system.
Although certification testing of the part was sufficient to meet EASA’s means of compliance, “it was not sufficiently representative of operational demands to identify the failure mode”.
EASA’s regulatory guidance said there was no requirement to consider failure sequences or possible risk reduction and mitigation measures in the wider tail rotor control system as part of the certification process, despite failure of the duplex bearing being “classified as catastrophic in the certification failure analysis”.
While a failure analysis was carried out by the tail rotor actuator manufacturer, it “only considered the potential failure of the component parts of the actuator itself” – the bearing was part of a separate system – and it was “not informed” about the potential effects of failures of connected components.
The AAIB says the seized bearing initiated a “sequence of failures” in the tail rotor pitch-control mechanism, culminating in the “unrecoverable loss of control” of the tail rotor blade pitch angle, and the blades moving to their physical limit of travel.
Shortly after passing through a height of around 300ft, following a rearward departure from the pitch of Leicester City’s King Power stadium at 19:37 local time, and following a right-turn, an increasing right yaw rapidly developed, despite the immediate application of corrective control inputs from the pilot.
Full deflection of the left pedal was reached after around 1s as the pilot attempted to counter the right yaw movement, says the report.
The helicopter continued to climb for another 5s until reaching around 430ft, when the collective was reduced, before descending with a “high rotation rate” – peaking at 209°/s – and striking the ground on a stepped concrete area outside at the stadium, coming to rest on its left side. The stabilised descent rate was 4,000ft/min.
Unopposed main rotor torque couple, combined with the negative pitch angle of the tail rotor blades, resulted in an “increasing rate of rotation” of the helicopter in yaw. This induced pitch and roll deviations and made effective control of the helicopter’s flightpath “impossible”, says the AAIB.
Analysis of flight-data recorder information showed a change in pitch of more than 43° and a change in roll of more than 25°, both experienced in around 0.5s.
Simulator recreations of the crash indicated that regaining positive control of the helicopter’s trajectory in the time and height available was “not possible” for the pilot, the inquiry adds.
Despite the pilot’s attempting to cushion the impact through raising the collective, it “likely exceeded the helicopter’s design requirements” and caused damage to the lower fuselage, parts of which were driven into the fuel tanks, resulting in a “significant fuel leak”, says the AAIB. This ignited shortly after the helicopter came to rest and an “intense” post-impact fire “rapidly engulfed” the fuselage.
All four passengers aboard the AW169 and its single pilot were killed. Analysis of the AW169’s seats suggested that passengers were subjected to vertical deceleration forces greater than 30g at impact.
The AAIB found the helicopter was compliant with all applicable airworthiness requirements, had been correctly maintained and was appropriately certified for release to service prior to the accident flight.
However, following post-crash inspection, the duplex bearing was removed and “the inner races of the bearing could only be rotated a few degrees in either direction by hand”.
A subsequent CT scan of the bearing showed fractures to the bearing cages and significant damage to the surface of the inner bearing races. The damage was worse on the inboard inner bearing race where there was evidence of sub-surface damage.
Laboratory analysis determined that the inner and outer bearing races had become damaged through rolling contact fatigue (RCF).
While all bearings, even those run in optimum conditions, will ultimately fail through RCF, the rate of degradation is accelerated by the operating loads exerted on the bearing. Other issues such as contamination or lack of lubrication can also contribute to premature bearing failure.
The AW169’s duplex bearings were supposed to be replaced after 2,400h, but, the AAIB says, rig test data showed that “high contact pressures within the bearing were sufficient to initiate a damage cycle” that could cause the bearing to seize before that point was reached.
It says the tail rotor duplex bearing in the accident aircraft probably experienced a combination of dynamic axial and bending moment loads, generating internal contact pressures sufficient to result in lubrication breakdown and the balls sliding across the race surface.
“This caused premature, surface-initiated rolling contact fatigue damage to accumulate until the bearing seized,” says the AAIB.
At that point, the high torque from the tail rotor drive system was transmitted to the tail rotor actuator control shaft, causing it to rotate at high speed. This, in turn, disconnected it from the actuator lever mechanism, which would typically limit the movement of the control shaft in line with the pedal inputs.
Absent that feedback, the shaft continued to move, driving the tail rotor blades past the now-ineffective yaw control stops, to their maximum limit.
In the wake of the accident, Leonardo Helicopters issued 16 safety bulletins and EASA nine airworthiness directives related to the tail rotor and the duplex bearings on both the AW169 and AW189. Several of the bearings removed as part of that process showed similar wear to that of the accident helicopter, the AAIB notes.
Leonardo Helicopters has also changed the design of the duplex bearing – switching to steel rather than ceramic balls – and that of the tail rotor control actuator.
Inspection periods for the bearing have been reduced; time-expired bearings are also to be returned to the manufacturer for analysis.
The AAIB has issued eight safety recommendations to EASA calling on the agency to address “weaknesses or omissions identified in the regulations for the certification of large [CS-29] helicopters”.
These include the requirement that suppliers validate design data post-test, the introduction of rules specifically designed to address premature RCF in bearings used in safety critical applications, and a tighter definition of the airworthiness status of life-limited parts used in non-structural critical applications.
EASA should also mandate the introduction of a “comprehensive post-removal from service assessment for critical parts” by manufacturers to validate the reliability and life-assumptions used for certification.
Additionally, where “potentially catastrophic failure modes are identified”, EASA should ensure that “practical mitigation options” – such as a warning system – are considered across the wider system, “rather than rely solely on statistical analysis to address the risk”.
