AO-2015-007 Airbus Helicopters AS350BA, ZK-HKU, collision with terrain, Fox Glacier, 21 November 2015

1. On Saturday 21 November 2015, an Airbus Helicopters AS350 (‘Squirrel’) helicopter was conducting flights out of the operator’s base near Fox Glacier town. The weather conditions that morning had caused the cancellation and postponement of several flights.
2. The pilot decided that the weather had improved enough to conduct a scenic flight with passengers to the head of the Fox Glacier valley. At 0945 the helicopter departed with the pilot and six passengers on board for an expected 20-minute flight. The weather was cloudy and changeable as the flight departed. Weather permitting, the flight was to include a snow landing on Chancellor Shelf above the glacier. The pilot spoke with the pilot of another helicopter flying in the neighbouring Franz Josef Glacier valley. That was the last radio contact with the helicopter.
3. The helicopter was reported overdue at 1015. The subsequent search located the wreckage of the helicopter. It had crashed onto the glacier just below Chancellor Shelf. There were no survivors and the helicopter was destroyed.
4. Images obtained from some passengers’ cameras helped to trace the approximate track of the helicopter. The helicopter had landed on Chancellor Shelf and the passengers had got out to walk in the snow. It was snowing at the time and cloud was coming and going in the general area. There was no recorded evidence of the helicopter’s flight path after it departed Chancellor Shelf.
5. The Transport Accident Investigation Commission (Commission) found it unlikely that a mechanical failure with the helicopter was a factor in the accident. Although not all of the wreckage was recovered, an examination of the recovered components (including all the dynamic assemblies) revealed no pre-existing failure.
6. The Commission also found that the weather conditions on the day were unstable and unsuitable for conducting a scenic flight. The localised weather conditions in the area were very likely to have been frequently below the minimum criteria required by the Civil Aviation Rules.
7. It is very likely that when the helicopter took off from Chancellor Shelf and descended down the valley, the pilot’s perception of the helicopter’s height above the terrain was affected by one or more of the following conditions:

• cloud
• precipitation
• flat light conditions
• condensation on the helicopter’s front windscreen

1. The Commission found that the pilot had not been properly trained and did not have the appropriate level of experience expected under the operator’s categorisation scheme for a senior pilot in this type of operation. The operator’s system for training its pilots was ill-defined and did not comply fully with the Civil Aviation Rules.
2. The operator’s training system did not have sufficient oversight by the designated senior persons, and this was a factor that allowed the pilot to be assigned roles and responsibilities without the proper training and experience.
3. The Commission found that the Civil Aviation Authority had identified significant non-compliance issues with the operator’s training system and managerial oversight that had warranted intervention long before this accident occurred.
4. The Commission identified two safety issues:

• the operator’s system for training its pilots did not comply fully with the requirements of the Civil Aviation Rules or the operator’s approved operations specifications, and did not adequately prepare the pilot for the role and responsibilities required for flight operations that day
• the operator had been allowed to continue providing helicopter air operations with little or no intervention from the Civil Aviation Authority, in spite of the Authority having identified significant non-compliances with the operator’s training system and managerial oversight.

1. In 2014 the Commission had made a recommendation to the Director of Civil Aviation that stricter requirements be placed upon holders of air operator certificates to correct identified deficiencies, and that when serious safety issues were found, they always resulted in audit findings.
2. The Commission is concerned that other operators in the civil aviation system during the same period could be operating with non-compliances that have either not been identified by the Civil Aviation Authority’s surveillance system or not been resolved. Therefore, the Commission has made a new recommendation to the Director of Civil Aviation that they initiate an independent review of past Civil Aviation Authority surveillance activities.
3. The key lessons arising from this inquiry include:

• aircraft operators’ senior management have a regulatory duty to maintain proper and effective oversight of their operations. Doing otherwise will compromise the safety of the operations and increase the risk of repeat accidents
• proper training of pilots is critical to the safety of air operations. Any training and competency system must ensure that pilots are trained and experienced to levels appropriate for their roles and responsibilities
• every operator must provide adequate supervision of its pilots, appropriate to the pilots’ experience and training and the nature of the operations
• aircraft manufacturers set ‘never exceed’ limitations for good reasons. Pilots should not, under any circumstances, load or operate their aircraft outside the limitations
• with knowledge comes responsibility. If a senior person working for an air operator or an inspector working for the regulator identifies a serious safety issue with an operation, the issue should be formally raised and action taken to address it.

1. On Saturday 21 November 2015 the Civil Aviation Authority of New Zealand (CAA) notified the Transport Accident Investigation Commission (the Commission) of the helicopter crash. The Commission subsequently opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
2. Two Commission investigators, an investigation support staff member and a contracted aircraft engineer familiar with the helicopter type travelled to Fox Glacier town on 21 November 2015. A third Commission investigator travelled to Fox Glacier town four days later.
3. The CAA notified the State of aircraft manufacture (France) and the State of engine manufacture (United States) of the accident, in accordance with the provisions of Annex 13 to the Convention on International Civil Aviation. France appointed an investigator from the Bureau d’Enquêtes et d’Analyses (BEA – the independent air accident investigation authority of France) as its Accredited Representative, and the United States appointed an investigator from the National Transportation Safety Board as its representative. Both appointed technical advisers from the respective manufacturers to assist them. The Commission held teleconferences with the BEA and Airbus Helicopters (the helicopter manufacturer) at various times during the inquiry.
4. The Commission also notified the independent accident investigation authorities of Australia and the United Kingdom that citizens of their countries were among the victims.
5. The site investigation began on 22 November 2015, but progress was slowed by inclement weather and hazardous site conditions. On 24 November 2015, prior to any wreckage removal, a remotely piloted aircraft was used to photograph and map the site.
6. The Commission took control of the site from New Zealand Police on 26 November 2015. Accessible wreckage was removed from the site later that day and sent to the Commission’s facility near Wellington. The investigation team completed their initial activities in the area on 27 November 2015.
7. On 4 December 2015 an ice fall covered the forward part of the fuselage that had been left at the site because it was wedged across a crevasse. On 8 December 2015 the Commission decided that it could not recover safely the remaining fuselage and smaller items of interest.
8. Investigators interviewed staff from the helicopter operator (Fox and Franz Heli Services), glacier guides who had flown with the pilot on the day of the accident, and other witnesses. Maintenance documents and operational records relating to the helicopter were obtained from the operator, along with the pilot’s training file and logbook.
9. The pilot’s personal and aviation medical histories were reviewed. Investigators obtained evidence from an instructor and three flight examiners who had trained or flown with the pilot, and two former employers.
10. On 21 December 2015 the engine was inspected with assistance from the manufacturer’s representative in New Zealand. Between 25 February 2016 and 1 March 2016 the investigator in charge supervised fuller examinations of the engine and its accessories at the premises of the respective manufacturers in the United States.
11. Between 27 January 2016 and 29 January 2016 the wreckage was examined at the Commission’s Wellington facility by the Commission’s investigation team, the Accredited Representative of France, two other investigators from the BEA and an investigator from Airbus Helicopters. 
12. The engine-aircraft adapter shaft was examined by Airbus Helicopters under the supervision of the BEA on behalf of the Commission, and a report was prepared for the Commission.
13. On 31 March 2016 the investigator in charge and a team of glacier guides recovered items of wreckage that had been exposed by summer melting of the ice. The forward fuselage and cabin remained buried under an ice fall.
14. Cameras and mobile phones that had been recovered from the accident site were forensically examined and relevant photos, videos and location data were reviewed.
15. In July 2016 senior persons of the operator were interviewed again, as well as other witnesses.
16. In October 2016 the hydraulic flight control servos from the helicopter were taken to Australia for functional testing and inspection, under the supervision of the investigator in charge.
17. MetService New Zealand (MetService is New Zealand’s national weather authority and the only organisation in New Zealand certificated by the CAA to provide aviation weather forecasting services) analysed the weather conditions at, and prior to, the time of the accident and provided a report to the Commission.
18. The CAA files relating to the pilot, the operator and the helicopter were reviewed. Commission investigators interviewed CAA staff who had conducted audits of the operator and guided the operator in regard to compliance with the Civil Aviation Rules. The CAA managers responsible for regulatory oversight of the helicopter sector were also interviewed. The Commission reviewed CAA documents relating to the suspension in May 2016 of the operator’s air operator certificate and the subsequent prosecution of some individuals.
19. In September 2017 the original investigator in charge resigned from the Commission and a new investigator in charge was appointed to complete the draft report.
20. On 21 November 2018 the Commission approved a draft report for circulation to interested persons for their comment. The response time for submissions was extended following a request from an interested person.
21. The Commission received eight submissions. The Commission considered the submissions, and changes as a result of these have been included in the final report.
22. On 21 February 2019 the Commission approved the final report for publication.

Narrative

1. The operator offered scenic flights in the Southern Alps from its main bases at Franz Josef and Fox Glacier towns and from three other South Island locations. The flights were conducted outside controlled airspace and under visual flight rules (visual flight rules include requirements for the flight visibility and clearance from cloud to be above specified minima).
2. There was one pilot (the pilot) on flying duty at the Fox Glacier base on Saturday 21 November 2015. At about 0700 ground staff called the pilot to discuss the weather and scheduled flying for that day. Three scenic flights had already been cancelled because of unsuitable weather, and two other flights to take professional glacier guides to the lower Fox Glacier had been postponed.
3. At about 0815 the pilot decided to fly the glacier guides to the lower glacier landing site. Ground staff told the pilot that six people were waiting for a scenic flight if conditions were suitable. The pilot told the ground staff that during the flights to take in the guides, they would be able to see if the weather conditions around the upper glacier were suitable for a scenic flight.
4. At about 0900 the pilot carried out a pre-flight inspection of an Airbus Helicopters AS350 ‘Squirrel’ helicopter, registered ZK-HKU (the helicopter). At 0920 the first of two flights with glacier guides departed the operator’s Fox Glacier base. During one of the flights the pilot radioed the ground staff to say that the weather was suitable for a scenic flight. After the second flight the ground staff refuelled the helicopter to 40% of its fuel capacity.
5. The passengers had purchased a 30-minute flight over the Fox and Franz Josef Glaciers, including a snow landing. The ground staff said that the passengers had been informed that the flight would likely be shortened and might not include a snow landing because of the inclement weather.
6. A frequently used location for snow landings was Chancellor Shelf, at 5,600 feet (ft) (1,720 metres [m]) altitude. The shelf offered a suitable landing area that could be approached from almost any direction and dropped away steeply into the glacial valley (see Figure 1).
7. The helicopter departed on the scenic flight at 0945. Once airborne the pilot radioed the ground staff and asked them to telephone the operator’s Franz Josef office and ask about the weather there. The Franz Josef office did not answer the call, so the ground staff suggested to the pilot that the flight be shortened. The pilot then contacted another, more senior, company pilot who was flying near Franz Josef, 16 kilometres north of Fox Glacier town. The other pilot said conditions were unsuitable over Franz Josef Glacier, which ruled out the flight extending to both glaciers.
8. At about 0950 two pilots for another operator were flying in to the lower Fox Glacier landing site and heard the pilot report on the local radio frequency that the helicopter was overhead the terminal face of Fox Glacier at 3,200 ft (975 m), heading east. One of these pilots later saw the helicopter climbing towards Chancellor Shelf. That was the last sighting of the helicopter.
9. The helicopter was expected back at the Fox Glacier base at 1005. When it did not return the ground staff radioed the pilot several times, but got no response. The ground staff made various telephone and radio calls to try to contact the helicopter, then declared it overdue at 1015. The pilot at Franz Josef was asked to conduct a search. That pilot could not fly directly from Franz Josef Glacier to the upper Fox Glacier because of low cloud, so flew over Fox Glacier town then followed the operator’s scenic flight route up Fox Glacier.
10. During the search, fresh helicopter landing skid tracks were seen in the snow on Chancellor Shelf. After searching for approximately 10 more minutes the search pilot found the wreckage of the helicopter. It had crashed near the right edge (when looking downhill in the direction that the glacier flows) of the upper Fox Glacier, about 600 m south of and 800 ft (244 m) below Chancellor Shelf (see Figures 1, 2 and 3).

Site information

1. A remotely piloted aircraft was used to make the initial record of the accident site before the recovery teams began work. See Appendix 1 for a summary of the recovered wreckage.
2. The glacier was heavily crevassed where the helicopter crashed. There was no sign of the helicopter having struck the terrain or any object between Chancellor Shelf and where it crashed.
3. The initial impact was approximately 40 m from the right edge of the glacier. The wreckage was spread in a south-west direction over an area approximately 40 m long by 20 m wide (see Figure 4). The first items in the trail were pieces of the landing gear skids and the lower fuselage ‘belly’ panel, the lower vertical stabiliser and the tail cone. The lower vertical stabiliser was sheared off in a rearward direction. The attached tail rotor guard was undamaged.
4. The rest of the wreckage was mainly in two areas. The first included the tail boom with tail rotor assembly still attached. The upper vertical stabiliser and both horizontal stabilisers also remained attached to the tail boom. The underside of the tail boom had no obvious impact damage. An empty steel ski basket, which had been attached to the left side of the landing gear, was lying on top of the tail boom. The underside of the ski basket had a large, concave impression.

5. The other substantial wreckage area included most of the fuselage, the engine and the main rotor assembly. This was approximately 35 m away, wedged over a crevasse at the base of a 15 m high ice wall. The fuselage was lying on its left side. The engine had detached from the engine deck.

6. The four transmission suspension bars that attached the main transmission assembly to the fuselage had sheared, causing the assembly to detach from the fuselage. The rotor shaft and the rotor head with attached blades were still attached to the main transmission. One of the three main rotor blades was broken about 2 m from the hub, but the other two had little damage on their leading edges and were lying either side of an ice mound.
7. Smaller items of wreckage were scattered within a 30-degree arc centred on a line joining the tail boom to the fuselage. These items included the dual front passenger seat, the cabin doors and the pilot’s instrument panel. The fuel tank had ruptured and contaminated the site with fuel, but there was no fire.
8. During the recovery of the wreckage the cabin structure forward of the cabin bulkhead broke away. It could not be inspected or recovered and was subsequently buried by a collapsing ice wall.

Aircraft information

1. The AS350 is a single turbine engine-powered light utility helicopter manufactured in France by Eurocopter (now Airbus Helicopters). The main structural components are shown in Figure 5.

1. The helicopter had been manufactured in 1979 as an AS350BA variant with an Arriel turboshaft engine, and imported into New Zealand in 1995. The engine had been replaced with a Lycoming (now Honeywell) LTS101-600A-3A engine in 2007.
2. The helicopter had been rebuilt in 2014 after a main rotor strike incident while with another operator. It had joined the operator’s fleet on 2 October 2014, but was not listed in the operator’s current ‘operations specifications’ (see paragraph 3.6.7.
3. During the 2014 rebuild the following additional components had been replaced with new items:

• the tail rotor drive shaft and bearings
• the tail rotor bell crank
• the left and right main rotor servos
• the hydraulic pump bearing and drive belt, and large and small accumulators.

4. Since October 2014 the following components had been replaced with new items:

• the hydraulic filter
• the main rotor blade spherical thrust bearing bolts
• the tail rotor assembly
• the starter-generator.

1. The maintenance records showed that the helicopter had been maintained in accordance with the approved maintenance manual. At the time of the accident the helicopter had a non-terminating airworthiness certificate and a current maintenance ‘Release to service’. The most recent maintenance had been completed on 12 November 2015 and included a combination 100/150/600-hour inspection of the airframe. The main rotor blades had been replaced at that time with a part-life set.
2. The helicopter was not equipped for flight in instrument meteorological conditions (in effect, flight without visual reference to terrain).

Engine

1. The engine had operated for 7,492 hours before it was installed in the helicopter on 27 September 2014. The previous engine maintenance had been a 150/300/600-hour inspection completed on 12 November 2015. The engine had accrued 8,109 hours as at 19 November 2015.
2. The flight manual supplements for the installed Honeywell LTS101-600A-3A engine and the air inlet barrier filter contained no restriction against flight in falling snow.

Flight controls

1. The main rotor flight controls comprised a traditional cyclic stick and a collective lever for the pilot seated in the right seat only.
2. The flight controls were hydraulically assisted, with three servos for the main rotor and one for the tail rotor pitch control. A hydraulic pump driven off the engine-to-transmission drive shaft provided hydraulic pressure to these servos and stored pressure in accumulators. In the event of hydraulic pressure failure the accumulator pressure would be available, but when that pressure diminished the servos would lock hydraulically. A pilot could control the helicopter without hydraulic assistance, but greater control forces were required.
3. The tail rotor hydraulic servo was due for overhaul at 13,741 airframe hours. On 24 April 2015 the contracted maintenance organisation had extended the servo replacement to 13,921 hours, as allowed by the Civil Aviation Rules (Civil Aviation Rule 91.603(d) refers. Generally, the maximum allowable extension is 10% of the time between overhauls for the component) and the approved maintenance programme. The servo had remained in service for 38 hours beyond this maximum limit.
4. The helicopter had accrued 13,959 flight hours as at 19 November 2015.

Weight and balance

1. The helicopter had last been weighed on 19 September 2014. The empty weight was 1,320.5 kilograms (kg).
2. The operator’s exposition (an exposition is documentation provided to the CAA that defines an organisation, identifies the approved senior persons and details the means of compliance with the Civil Aviation Rules applicable to the operator. See the glossary for a full definition) permitted the use of a standard passenger weight of 77 kg and standard loading plans for managing the weight and balance of its flights. The passengers were not weighed before the flight and no load sheet was prepared, which was permitted at the time (but see paragraph 4.3.18). The ground staff allocated two passengers of lighter stature to sit in the dual front seat, which had a 154 kg weight limit at that time.
3. The helicopter departed the operator’s base with 170 kg (or 40%) (the fuel quantity gauge showed the fuel load as a percentage of the total capacity of 540 litres) of fuel on board. The all-up weight was estimated to have been 2,165 kg. The maximum permissible all-up weight was 2,100 kg.
4. Allowing six minutes to fly the 13 km up to Chancellor Shelf and a few minutes parked with the engine running, there would have been about 151 kg of fuel on board when the helicopter departed for the return flight. The estimated all-up weight at the start of the return flight was 2,147 kg. The longitudinal centre of gravity was 3.197 m aft of the datum, which was within the allowable range for an all-up weight of 2,100 kg (see Appendix 2).

Tests and research

The helicopter engine

1. The initial examination of the engine was performed in New Zealand with assistance from the engine manufacturer’s New Zealand representative. The engine had external damage that was related to the impact only. The compressor section could not be turned because of a dent on the top of the casing. The power turbine (which drove the accessory gearbox and the rotors) turned freely and quietly.
2. The engine was sent to the manufacturer’s facility in the United States, then disassembled and inspected under the supervision of the Commission’s investigator in charge. The investigators from the BEA and Airbus Helicopters were present. The manufacturer’s inspection report concluded “that the type and degree of damage was indicative of rotation and operation at the time of impact with the terrain. No pre-existing condition was identified that would have interfered with the operation of the engine”.
3. Honeywell provided a report on its inspections and testing of the engine fuel governor, power turbine governor and other engine accessories. Honeywell concluded that all components were accounted for and all of the items had been functional.
4. There was insufficient fuel in the wreckage to be tested. The fuel had been obtained from the operator’s facility at Fox Glacier. None of the operator’s other helicopters had experienced a fuel problem.

The splined coupling

1. The engine-to-main-gearbox splined coupling transmitted engine torque from the accessories gearbox to the main transmission. The teeth on the coupling splines at the main gearbox end were smeared and showed signs of bluing. The coupling was sent to Airbus Helicopters for examination and an assessment of the torque required to produce the observed damage.

2. The examination by Airbus Helicopters concluded that:

   whatever the approach used to assess the torque (power) needed to generate such damage on the splines, the result indicates that this torque is significant and only possible if the engine was producing power when this phenomenon occurred (Airbus Helicopters Technical Note EAI 109/2016).

3. The BEA agreed with the conclusions of the Airbus Helicopters report and added that the wear on the coupling teeth was a consequence of misalignment that had been caused during the impact when the engine was delivering torque.

The hydraulic servos

1. The three main rotor hydraulic servos and the tail rotor servo were taken to an authorised overhaul centre in Australia and functionally tested, disassembled and inspected under the supervision of Commission investigators.
2. The servos were assessed against the acceptance checks for newly overhauled servos. None of the servos passed all test points, and most failed two or three points (many mechanical components, if tested part-way through their service lives, would be very unlikely to meet stringent post-overhaul acceptance checks). All had high internal leak rates. The overhaul centre commented that the tail rotor servo performance and its condition were to be expected given that it was overdue for an overhaul.
3. The BEA noted that it was difficult to draw a conclusion from such results because the checks were for new or overhauled parts, not parts that were used or had been in an accident.

Meteorological information

1. Civil Aviation Rule 91.301 prescribed the general meteorological requirements for flights under visual flight rules. For flights conducted less than 1,000 ft (305 m) above the terrain in the uncontrolled airspace of the Fox Glacier valley, the rule could be summarised as:

• there must be a minimum visibility of 5,000 m, except a helicopter may be operated with a visibility of less than 5,000 m if it is manoeuvred at a speed that gives adequate opportunity to observe other traffic or any obstructions in order to avoid collisions
• an aircraft must remain clear of cloud and be in sight of the surface.

1. Civil Aviation Rule 135.155(c) stated the absolute minima for helicopter operations:

   (c) A pilot-in-command of a helicopter performing a VFR [visual flight rules] air transport operation outside controlled airspace must fly in meteorological conditions—

   (1) of not less than a ceiling of 600 feet [183 m] [above ground level] and flight visibility of not less than 1500 metres…

2. MetService New Zealand produces forecasts and reports for aviation purposes. It receives hourly weather reports from the Franz Josef town, but not from the Fox Glacier town. This information is used to produce a general forecast for the West Coast area, including these glaciers (the ‘Windward’ forecast area covers the coastal strip from Westport to south of Haast, bordered to the east by the Southern Alps). The operator said its usual practice was to print the forecasts every day, but it is not known whether the pilot viewed the forecast for 21 November 2015. MetService provided a post-accident analysis of the weather on the day of the accident (see Appendix 3)
3. Witnesses recalled heavy rain at the Fox Glacier town early in the morning, easing from about 0800. However, the ground staff said a squall came through just after the helicopter departed from the Fox Glacier base.
4. A number of webcams were located near the Fox Glacier town and looked towards the Fox Glacier valley. They did not provide live feeds, but were updated every 15 minutes. The images from some of the cameras could be viewed at the glacier guides’ office located in the same building as the operator’s office.
5. Images from a camera near the operator’s base showed rain and low cloud in the Fox River valley at about the time the pilot decided to postpone the early flights, and that visual meteorological conditions likely prevailed when the scenic flight departed (see Figure 6).
6. The local aviation operators were members of a user group (the group’s code of practice standardised local operational procedures for safety and to observe environmental restrictions) that conformed to a Department of Conservation requirement for aircraft to not fly below 3,000 ft (914 m) at the Fox Glacier terminal (Mount Cook and Westland User Group, Operators’ Handbook, version 6, March 2013). The requirement was for noise abatement, but this effectively meant that 3,000 ft was the minimum cloud ceiling for entering the valley for a scenic flight.
7. Two other local operators had delayed their flights with glacier guides until about 0930 and had cancelled early scenic flights (other operators later conducted flights in support of glacier hiking, but after the accident all tourist flying ceased). A number of pilots and guides on the glacier had noted that the height of the cloud ceiling fluctuated and was sometimes, from their point of view, around Chancellor Hut, which is below Chancellor Shelf. Some recalled seeing bright patches through the cloud, but also that “flat light” conditions were present. According to the glacier guides, the wind in the lower valley was insignificant for most of the morning.
8. Photographs recovered from some passengers’ cameras showed that on leaving the operator’s base there was light rain and the sky was overcast with patches of low cloud at the sides of the valley. The visibility and cloud conditions at that time appeared to be better than the minimum requirements for flight under visual flight rules (see Figure 7).
9. The photographs showed heavier rain was encountered higher up the valley. Approaching Chancellor Shelf there was low cloud just above with some cloud spilling down the mountain. The photographs showed that the helicopter was landed facing west (see Figure 8). This was confirmed later by the search pilot.

1. The passengers’ photographs showed snow falling while the helicopter was parked on Chancellor Shelf. Initially the edge of the shelf was discernible, but other photographs showed that within a few minutes there was no obvious distinction between the snow surface and the cloud.

1. No photographs were found that had been taken after the passengers boarded the helicopter for the return flight.
2. The operator’s pilot who was flying at Franz Josef encountered falling snow in the upper Franz Josef Glacier valley (16 km to the north) at about the same time that the helicopter was at Chancellor Shelf. After returning to Franz Josef town the sun came out, so that pilot decided to make a second flight to pick up other climbers. On the return flight the wind increased from the west and southwest and it started to snow again. Shortly after that the ground staff requested the pilot to search for the overdue helicopter.
3. During the search the cloud at the Fox Glacier terminal was above the locally agreed minimum for scenic flights. There were cloud patches at about 3,000-3,500 ft (914-1,000 m) in front of the glacier, but the ceiling was above 6,000 ft (1,800 m), as it had been at Franz Josef. After passing the lower cloud, the search pilot could see that the usual landing area on the western side of Chancellor Shelf was at the edge of a thick patch of cloud about 1,000 ft (305 m) in depth. The search pilot considered that the weather that morning was too changeable to have landed and allowed passengers to walk about, but conditions improved 10-15 minutes later.

The operator

1. The operator had been established as a private company in 1986. The company operated without an appointed board. A more detailed description of the company structure is provided below.
2. The operator had later been issued with a general aviation air operator certificate under Civil Aviation Rules Part 119, Air Operator – Certification. The CAA had most recently re-issued the certificate with effect from 1 December 2012, following a full ‘recertification’ audit. The operating requirements were given in Civil Aviation Rules Part 135, Air Operations – Helicopters and Small Aeroplanes.
3. The operator’s main business was scenic flights around the mountains and glaciers of the Westland Tai Poutini and Aoraki/Mount Cook National Parks, and charter flights for people engaged in climbing, hunting and fishing. The main base was at Franz Josef, with bases at Fox Glacier and three other locations.
4. In November 2015 the operator had a fleet of 13 helicopters and employed nine full-time pilots, four part-time pilots and 24 ground staff.
5. The company was noted for employing low-experience pilots as ground staff for a year or more before they would begin training for turbine helicopter operations in the mountainous environment. The rationale was to enable new pilots to understand the nature of the business and local weather patterns before acting as pilots-in-command. Pilots spoken to who had been through this system considered it to have been effective and valuable. When seasonal demand was high, the company employed additional, experienced pilots on short-term contracts.
6. The owner was the chief executive and the holder of the air operator certificate. The chief executive had been issued with a commercial pilot licence (helicopter) in 1976 and primarily flew a Hughes H369 helicopter from his home base in support of climbers and hunters.
7. ‘Operations specifications’ were the conditions imposed by the Director of Civil Aviation on the air operator certificate, and included any authorisations, limitations and procedures that formed part of the certificate. Among other items, the operations specifications identified each aircraft that the operator was permitted to use. It also listed the ‘senior persons’ who were approved by the Director of Civil Aviation, and any pilot training approvals. The chief executive was the senior person responsible for all flight operations and supporting ground operations, a role identified in the operations specifications as the ‘operations manager’.
8. The operations specifications that were current on 21 November 2015 had been issued on 25 March 2015.

Operational supervision

1. The chief executive authorised flying tasks. Day-to-day activities were managed by the Franz Josef office manager and a senior pilot who had been appointed the ‘training supervisor’. Operations at each base were also supervised by the ‘lead pilot’ at that base on the day.
2. The operator had a pilot categorisation scheme that defined the scope of a pilot’s authorisation to conduct flights for which they had been trained and approved (the scheme was part of the operator’s exposition and applied to this operator and its pilots only. It should not be confused with a flight instructor rating (Categories A to E), which is a qualification issued by the CAA and attached to a pilot’s licence). Under the scheme, a newly hired pilot would usually have a C-category and fly under the direct supervision of a higher-category pilot. The new pilot would typically fly for another season before being considered for promotion to B-category. B-category pilots operated under the indirect supervision of a more senior pilot. A-category pilots were senior pilots who could operate unsupervised to any landing site and act as lead pilots.
3. The operator’s training manual did not list any criteria for promotion to a higher category. The chief executive said that a pilot could reach the A-category after “four to five years and 3,000 to 4,000 hours’ experience” (the training supervisor estimated the same time for a pilot initially hired as ground staff). The chief executive approved changes to pilots’ categorisations based on advice from the training supervisor and other senior pilots.
4. The chief executive said that pilot meetings were held every two or three months to discuss incidents, complaints, operational changes and the like. The minutes of the meetings held since 2012 showed that they had been held, on average, once every four months. In September 2013, after a comment by pilots, it had been decided to hold meetings every six weeks, but eight months had passed before the next meeting.
5. An internal quality report had been submitted in June 2014 about an inexperienced pilot performing a high-level snow landing when conditions were not suitable. The report had been discussed at the November 2014 pilot meeting, where a call was made to reintroduce “past protocols”. One past protocol was that, before each day’s operations, junior pilots would talk to a senior pilot about flying conditions and where they should or should not land.
6. Senior pilots provided guidance at pilot meetings on seasonal flying hazards. The pilot had attended the most recent meeting on 8 November 2015, less than two weeks before the accident, at which there was a discussion on the changeable spring weather, the hazards of bright light, flat light and blowing snow, and the need to be vigilant for cloud forming.
7. The chief executive and the training supervisor had attended most pilot meetings since 2012.

Pilot training programme

8. The operator’s administration manual included a statement that the chief executive would “ensure that all staff are trained in and understand the Part 119/135 manual suite relevant to their duties for their role”.
9. The goal of the operator’s training programme was “to ensure that each of its crew members [was] trained and competent to perform their assigned duties” (operator’s training manual, repeating Civil Aviation Rule 135.553). However, as the operations specifications did not include an approval for the operator to conduct internal training or flight crew competency assessments, these requirements were met by contracting two approved external training organisations.
10. The Civil Aviation Rules required a pilot who had not qualified and served on an aircraft operated under the authority of the operator’s certificate, to complete initial training that was conducted in a structured manner and in accordance with an appropriate syllabus (Civil Aviation Rule 135.565 refers). The content of the initial training could be varied for an individual pilot if the extent of and reasons for the variation were recorded and certified in the pilot’s record of training.

11. The CAA-approved senior person who was responsible for the operator’s crew training and competency assessments was identified in the company manuals and the operations specifications as the training manager (this is a different role and a different person from the previously mentioned training supervisor). The operator’s administration manual included the following duties of the training manager:

    1.Responsible for the management of all aspects regarding company’s training in accordance with procedures specified in the Training section of this exposition.

    2.The TM [training manager] is to liaise with the approved organisation carrying out the Flight Tests as to ensure that activities pertinent to [company] operations are included in the checks.

    3.To carry out Competency Assessment on company pilots whenever the need required.

    4.To monitor operational standards, supervise training and checking of flight crew.

    5.Responsible for liaising with company CEO and relevant Flight Examiners in regard to ensuring all necessary assessments of company aircrew are performed when required.

12. The scope of the training manager’s responsibilities was further shown by the following clauses taken from the training manual:

    The TM will provide each personnel with the skills and knowledge to achieve a high level of overall competency as required for regular flight crew competency assessments.

    Areas of weakness or lack of currency will be identified during supervision of pilots by the TM.

    Training on company procedures and operations specifications will be undertaken by the TM using this manual.

    Type conversions onto new aircraft types will be undertaken by a company appointed and appropriately qualified flight instructor from the Part 141 organisation or the TM or an approved Flight Instructor.

    The TM and pilot to sign the [pilot categorisation] form.

    Annually, approximately half way between competency assessments, or when considered appropriate, each pilot will be observed working by the TM. This check is and need not necessarily be from within the aircraft.

    After each assessment carried out by the TM the pilot’s assessment details to be updated on the pilot’s checklist.

    Following assessment, should the TM consider the pilot under review requires additional training, arrangements shall be made.

13. The incumbent training manager had begun training for the operator in 2004 and had been the training manager since 2008. The training manager described the operator’s training programme as being an informal plan for the training of pilots who were new to the company or inexperienced.
14. The training manager’s primary employment had been with an overseas helicopter company on a month-on, month-off roster (an employment mode often called ‘touring’). During the month off the training manager would usually return to New Zealand and might conduct training or check flights for the operator or for other operators. In April 2009 the training manager had taken a full-time job with another New Zealand company and had later become training manager for that company also. The training manager described having been uncomfortable being a senior person for two companies, and having had little contact with the operator after 2012.
15. The training manager said that the chief executive had always made training resources available, and that when the training manager had been actively involved with the operator, there had been no training issues raised by the CAA. The training manager had last provided training for the operator in January 2012 and had not attended any pilot meeting since that year. In October 2012, during the operator’s recertification process, the training manager had signed an application to remain the senior person responsible for crew training and competency assessments. The training manager had not been informed promptly at the time of the operator’s accidents in November 2012 and June 2015 (see paragraph 3.6.35).
16. A CAA audit report in March 2011 had noted that the training manager might have to be replaced should another employment offer be taken up (Audit 11/ROUG/102). According to the audit report, the chief executive had acknowledged that need. The audit team had also discussed the possibility of someone other than the chief executive being operations manager, because the size and scope of the operation had increased. The chief executive had said that the operations manager position would be reviewed before the recertification due in 2012. The new certificate had been issued without any changes to the senior persons.

17. The flight crew training requirements were detailed in Civil Aviation Rule 135.553, which stated in part:

    (a) Each holder of an air operator certificate shall establish a training programme to ensure that each of its crew members are trained and competent to perform their assigned duties.

    (b) Each holder of an air operator certificate shall ensure that each crew member is trained in accordance with the training programme contained in the certificate holder’s exposition.

    (c) The holder of an air operator certificate shall ensure that its training programme is controlled by the certificate holder.

18. In an advisory circular (CAA Advisory Circular AC119-3, revision 6, 12 August 2011) dated 12 August 2011, the CAA had set out a means of meeting the minimum rule requirements. It stated that operators flying in mountainous areas should include in their training programmes approved mountain flying training elements and provide each of their pilots with training according to their needs. The CAA advisory circular had noted that:

    Helicopter basic mountain flying training completed as part of [the commercial pilot licence] training is only intended to introduce the pilot to the basic techniques and principles of operating a helicopter through or within mountainous terrain and is normally only conducted in benign weather conditions. Therefore, it is not necessarily sufficient to prepare a helicopter pilot to conduct all commercial operations in a mountainous environment.

    It is incumbent on the operator to conduct appropriate structured theory and practical training and to provide additional experience as necessary to ensure the pilot has the level of knowledge, skill and experience required to safely conduct the type of mountain operations covered in the operator’s exposition.

19. The operator did not have a specific mountain flying training programme. The chief executive said that their understanding was that the usual external flight examiner conducted mountain training in conjunction with check flights. However, the usual flight examiner’s organisation also had no approved mountain flying training programme at the time. The CAA submitted that when the operator had been recertificated in 2012, there had been no approved provider of a mountain flying training course. The operator had therefore been unable to achieve the expectation that it would provide its pilots with a level of mountain flying training suited to its operating environment.

20. The minutes of the pilot meeting on 2 July 2015, which the chief executive and the training supervisor had attended, noted (without any elaboration) that the operator needed a more structured training programme and an updated training checklist.

21. The operator’s pilots had been reminded at pilot meetings in 2011 and 2012 of the requirement for five hours of supervised consolidation flights after obtaining new type ratings (a type rating is an authorisation associated with a pilot’s licence that states the pilot is qualified to fly a specific model of aircraft), and that each logbook entry for a supervised flight had to be certified by the supervising pilot (minutes of operator’s pilot meetings). The reminders followed a finding by the CAA at an audit in 2011.

Training supervisor

1. Although the operations specifications did not approve internal pilot training, the operator had for some years allowed the training supervisor to conduct training.
2. The training supervisor had begun flying helicopters in 2003 and been hired by the operator as ground staff from about that time. He had been a commercial pilot on the West Coast since 2006, obtaining an AS350 rating in October 2009.
3. The training supervisor had been encouraged since late 2012 to obtain a Category D flight instructor rating in order to assist with training. The training supervisor had been issued with the rating in April 2013, at which time they had had approximately 2,250 hours of total flying time, including 850 hours in the AS350.

4. The chief executive had informed the pilot meeting held in February 2013 of the appointment of the training supervisor. However, minutes of management review meetings suggested that the appointment was not confirmed until 13 May 2014. The training supervisor’s role was stated to be the oversight of junior pilots under the overall supervision of the training manager, but the role and duties were not shown in the operator’s exposition until a revision prepared in November 2015 (this revision was not approved by the CAA). The draft revision included the following duties for the training supervisor:

   Responsible for the supervision of all aspects regarding company’s training in accordance with procedures specified in the Training section of this exposition.

   To monitor operational standards, and liaise with the TM with regards to the supervision of training and checking of flight crew.

5. After the November 2015 accident, the training supervisor stated that their responsibilities included type rating training, role training and pilot supervision. The training supervisor’s understanding was that having a Category D flight instructor rating permitted them to conduct that level of training, although it was noted that CAA inspectors had given conflicting advice to the training supervisor on whether that training was permitted.
6. The training supervisor had not seen the training manager since mid-2013. When advice had been needed, the training supervisor had usually asked an external flight examiner or a senior pilot from another operator.

Other safety occurrences

3. In 1989 two passengers had died when one of the operator’s helicopters crashed during a scenic flight over Fox Glacier. The other two occupants had been seriously injured. The helicopter had been flown below the minimum permitted height above ground (Office of Air Accidents Investigation report 89-047, Hughes 369HS, ZK-HXA, 2 May 1989, Fox Glacier). 
4. The operator had notified six other accidents, of which three involved injury. The accidents during the six years before November 2015 were as follows:

• in September 2009 a pilot of a Hughes 500 reported having experienced an engine compressor stall when about to land on the Fox Glacier névé (snow catchment area). The pilot attempted to fly away but a landing skid caught in the snow. The helicopter rolled over, causing minor injuries to two of the occupants. The chief executive counselled the pilot.
• in November 2012 a pilot of an AS350BA intending to land at Pioneer Hut above Fox Glacier overflew the usual landing area and lost ground reference and depth perception because of ground-level blowing snow. A landing skid contacted the snow, causing the helicopter to roll over. No-one was injured.
• in June 2015 a Hughes H369 crashed on take-off from an alpine site above Poerua River in Westland. The pilot and a passenger were seriously injured. The chief executive suggested to the Commission at the time that the pilot had not realised that the helicopter involved had a tail rotor type that had less authority than similar models. The CAA found that a landing skid had likely caught the ground during the take-off, but identified no training or organisational factors.

3. The pilots involved in these three alpine accidents had fewer than 900 total flying hours each.
4. In the six years before November 2015, seven ‘aviation-related concerns’ had been lodged with the CAA regarding the operational practices of the operator or the chief executive.

The pilot

Prior to flying with the operator

1. The pilot had begun helicopter flight training in 2008 and been issued with a New Zealand commercial pilot licence in 2009. The pilot had obtained a type rating for the AS350 in April 2010 and then worked as ground staff at the operator’s Franz Josef office. In 2011 the pilot had gone overseas and flown commercially in Robinson R44 and Bell 206 helicopters. The pilot had returned to New Zealand in late 2013, having accumulated 1,209 hours’ total flight time, and taken a break from flying.
2. The pilot had not flown an AS350 helicopter since obtaining the type rating in 2010. In August 2014 the pilot had completed a biennial flight review in an AS350 and had had an additional 40 minutes of dual instruction in emergency procedures and mountain flying.

Flying with the operator

1. In September 2014 the operator had hired the pilot as a summer-season pilot at the Franz Josef base. The training supervisor had conducted the pilot’s training with the operator. The pilot had obtained a type rating in the Hughes H369, which was another helicopter type used by the operator, and passed an annual flight crew competency check on that type.
2. On 23 September 2014 the pilot had flown a 20-minute ‘familiarisation’ flight in an AS350 with the training supervisor, and a further 4.15 hours over the next few days under the direct supervision (direct supervision means having an authorised and qualified pilot occupying a crew seat in the helicopter to monitor the flight) of the training supervisor. By then the pilot had had 13 hours’ experience on the AS350, of which 4.6 hours had been flown with the operator on air operations. The operator had then authorised the pilot to perform pilot-in-command duties on the AS350 for glacier hiking flights only. The Civil Aviation Rules required a pilot of a single-engine aircraft to have a minimum of five hours of supervised experience in air operations before being designated pilot-in-command of any air operation conducted by the operator (Civil Aviation Rule 135.505 refers. The required experience excludes time accrued during training for the type rating, the operator’s initial or transition training, and the competency check required by Rule 135.607. The operator’s training manual included the requirement).
3. On 7 November 2014 the training supervisor had conducted an initial route check of the pilot in an AS350. The training supervisor said the pilot had accumulated 100 hours on the AS350 before the check, although that was not a documented requirement of the operator, but the pilot’s logbook showed 63 hours accrued on the AS350 by that date.
4. The training record noted that the 1.3-hour initial route check had focused on snow landings at all of the operator’s landing sites and huts, and included discussions on flat light and blowing snow conditions. The pilot had been approved for solo landings at Chancellor Shelf following that check flight. The pilot had not logged this flight (refer to Civil Aviation Rule 61.29, Pilot Logbooks – General Requirements, one of which is to record flight details accurately).
5. On 17 March 2015 the pilot had flown a scenic flight in a Hughes H369. The pilot had five hours of type experience, but did not have the required five hours of supervised air operations on the type.
6. In April 2015 the pilot had left the operator for a job overseas flying a different helicopter type.
7. On 7 October 2015 the pilot had returned to work for the operator and flown a nine-minute solo ‘re-familiarisation’ flight in an AS350. A flight crew competency check had been completed in the AS350 the next day. The flight examiner had not certified the flight crew competency check in the pilot’s logbook, as required, but commented later that the check flight had taken 50% more time than was usual because the pilot had been given some training and then re-checked. The check flight had included few snow landings because the training supervisor had told the flight examiner that the pilot would be given more mountain flying training later that month.

8. Additional training had taken place on 23 October 2015. Both pilots had logged the flight as a ‘route check’, but the pilot had not recorded that it was conducted by the training supervisor. The training form, which the pilot had not signed, stated that the 35-minute flight had been “dual training to all landing sites Fox and Franz Josef Glaciers… discussion about flat light, snow conditions, weather”. The form had also noted:

   [The pilot] has improved greatly since completing full season. Approved to all landing sites and hut sites. Under supervision for any hut site landing.

9. No record was found of an initial categorisation of the pilot under the operator’s pilot categorisation scheme (see paragraph 3.6.9). A categorisation form, dated 24 October 2015 and signed by the chief executive, showed that the pilot was an A-category pilot on the AS350 and a B-category pilot on the Hughes H369. Manuscript footnotes on the form added that the pilot had been checked on the AS350 by the training supervisor for the B-category on 7 November 2014 (see paragraph 3.7.5) and for the A-category on 23 October 2015. There was no date shown for the check on the Hughes H369. The pilot had not signed this categorisation form.
10. The training supervisor had certified an entry in the pilot’s logbook for a scenic flight in a Hughes H369 helicopter on 27 October 2015, and another Hughes H369 flight three days later. The certification suggested the flights had been supervised command practice. However, the training supervisor had not logged the flights in their own logbook.
11. The pilot had logged 29 hours’ flying in the 30 days prior to the accident, including one hour in the week before the accident. Up until the day of the accident the pilot’s logbook showed 1,792 hours’ total flight time, which included 415 hours on the AS350, of which 406 hours had been flown with the operator.

Regulatory surveillance

Introduction

1. New Zealand’s aviation regulatory system is based on a life-cycle approach (these introductory paragraphs are adapted from CAA Surveillance, www.caa.govt.nz/surveillance). Participants enter the system, operate within it, and ultimately exit. Participants enter this system when they have met the minimum standards and have been issued with the relevant aviation documents, for example an air operator certificate or pilot licence. While in the system, they must continue to comply with these standards and the conditions of their documents. At intervals, their compliance with standards is checked by monitoring and inspection, and any corrective actions are identified. These activities form the CAA’s surveillance function.
2. The CAA noted that surveillance can only be a sample of the state of an aviation document holder’s compliance. It does not replace a participant’s responsibility to self-check their own compliance with legislative requirements, and their continued safe operation in accordance with the safety standards, practices and conditions attached to their aviation documents.

3. With regard to its surveillance methods, the CAA noted that:

   Staff performing inspection and monitoring tasks are responsible for accurately assessing the state of compliance of industry participants, for reporting this objectively, and for ensuring the CAA is kept informed of changes in the circumstances of individual participants that might adversely affect compliance and safety.

   Staff may also provide support and advice to participants. This is always directed at risk management and compliance with regulatory standards. It is not consultancy. The line between the two is a fine one, and staff must not give any advice that could be interpreted as usurping the participant’s internal decision-making processes or responsibilities.

Surveillance of the operator

1. The CAA’s Helicopter and Agricultural Unit was responsible for the certification and surveillance of approximately 100 commercial operators of more than 200 helicopters (CAA, 2018, p. 11). The unit manager said that priority was given to certification activities. Surveillance primarily involved scheduled audits supplemented by spot checks. The unit had full-time positions for six flight operations inspectors and six airworthiness inspectors. This unit had been the primary CAA contact with the operator.
2. The CAA’s Personnel and Flight Training Unit was responsible for the certification and oversight of operators that were approved to provide flight training, and individual pilots who held flight examiner ratings. Since 2013 this unit’s chief flight examiner had had increasing contact with the training supervisor who was working towards gaining a flight examiner rating.
3. A CAA risk assessment prepared for an audit after the accident in 2012 noted potential risks in the areas of chief executive oversight, pilot supervision and the effectiveness of the lead pilot (training supervisor).
4. The cover letter sent to an operator before each audit states that “senior persons and any personnel with responsibilities under your aviation certificate should be present at the entry meeting”. The training manager had not attended any of the audits between March 2011 and late 2015, including the routine audit on 5 March 2015 (CAA audit 15/ROUG/18), the scope of which included, in part, the “effectiveness of crew training and lead pilot in their roles” and that the “pilot training syllabus and programme reflects the company’s operations”. The auditors’ checklist for that audit had noted that no senior person interviews were planned. The CAA later confirmed that it was left to an auditor’s discretion on whether they required a senior person to attend a routine audit.
5. The CAA flight operations auditor tasked with the March 2015 audit had completed an operator risk assessment that included the following notes to explain for their manager the recommended audit scope:

• Crew training manager is touring month on/off.
• Risk statement – with [the training manager] not being in country full time there is a risk that he is not fulfilling his Senior Person duties and responsibilities correctly. This would cause [a] risk of ineffective training that [could] in turn lead to an incident or accident.
• In the past there has been a company culture of poor airmanship… [The training supervisor] was appointed as lead pilot to solve these issues. There is a risk that [their] appointment has had no effect on… culture. This would continue to increase the risk of an accident/incident.
• The following are generic potential safety risks within the air operations sector. As such they are being targeted as specific safety initiatives:
  • poor standard of training and competency assessment programme documentation…

1. Informal notes made during the audit indicated that the auditors had determined that there was a low risk of a poor company culture, and that the training situation was “good”. The notes stated that the training supervisor had “made vast improvements” and that crew members were receiving “good practical recurrent training”. No findings were made at this audit.
2. The helicopter (ZK-HKU) had been chosen at random and inspected during the same audit. There was no evidence that the auditors had realised that the helicopter was not listed in the operations specifications (the helicopter had been added to the fleet after the issue date of the operations specifications that were current at the time of the audit).
3. The CAA had new concerns about the operator’s training following the June 2015 accident. Inspectors conducted a spot check in September and interviewed the chief executive and the training supervisor. The inspectors’ notes suggested that the training supervisor had in effect been acting as training manager. They noted that the training supervisor had improved the operator’s performance. The CAA made no findings during the spot check.
4. An operator risk assessment prepared less than three weeks after the accident recorded, for the first time, that the training manager had little involvement with the operator and that it appeared that the training supervisor was carrying out the duties of this role. The risk assessment included a statement that the training situation posed a high risk of an accident/incident, but noted that the training supervisor had the requisite skill and experience. The assessment also recorded that there was “much debate” within the CAA about the exercise of Category D flight instructor privileges, because of different interpretations of some Civil Aviation Rules.
5. After the November 2015 accident CAA flight operations inspectors said that they had verbally directed the training supervisor, during the spot check in September 2015, to cease training immediately. The training supervisor did not recall receiving such a direction. The CAA acknowledged that the inspectors had made no notes relating to that spot check until after the accident.
6. On 27 February 2016 the CAA wrote to the chief executive to inform them that the approved training manager had not fulfilled the senior person role for four years and, the CAA understood, had been replaced by the training supervisor. The letter stated that the CAA “had been led to believe” by the chief executive that the training manager had been active in the role, and expressed dismay that the training supervisor was acting as the training manager and conducting unauthorised training. The CAA directed the operator to “immediately complete a full risk assessment” of operations and pilot training.
7. On 27 May 2016 the Director of Civil Aviation suspended the operator’s air operator certificate. The operator then surrendered the certificate and, at their request, the Director revoked it on 9 June 2016.

Introduction

1. The widely accepted theory of accident causation looks beyond the action (or inaction) of individuals who are in control of vehicles or activities when something goes wrong (see Appendix 4). There are often underlying conditions and systemic factors that have either influenced the actions of those individuals or not provided adequate defences to prevent the accidents. These types of accident are sometimes referred to as ‘organisational accidents’. The following analysis of the accident suggests that this was one such case.
2. There were no witnesses to the accident and no survivors to retell events. Not all of the helicopter wreckage could be recovered from the hazardous glacial environment and there were no on-board recorders to help piece together what went wrong.
3. The analysis looks firstly at what is known to have happened and the various proximate factors that could have contributed to the helicopter striking the terrain. The analysis then looks at two systemic safety issues within the operational and regulatory environments that are considered to have been significant factors contributing to the accident:

• the operator’s system for training its pilots did not comply fully with the Civil Aviation Rules or the operator’s operations specifications, and did not adequately prepare the pilot for the role and responsibilities required for flight operations that day
• the operator had been allowed to continue providing helicopter air operations with little or no intervention from the CAA, in spite of the CAA having identified significant non-compliances with the operator’s training system and managerial oversight.

What happened?

The impact with the glacier

1. There was no recorded evidence of the flight path taken by the helicopter after departing Chancellor Shelf. In good conditions pilots usually descended as soon as they were clear of the shelf and flew down the right side of the valley as required by a locally agreed traffic rule. If visibility was poor they might descend at a reduced speed in order to maintain visual contact with the rock faces that provided good visual references on the right side. The lower speed required low engine power.
2. The extensive destruction of the lower fuselage and the lack of significant damage to the heavy vibration assembly atop the main rotor drive shaft indicated that the helicopter hit the ice in a relatively level attitude with a very high rate of descent. Although the front left cabin and lower vertical stabiliser appeared to have contacted the ice first, that damage was very likely a consequence of the uneven surface where the helicopter struck rather than an indication of the helicopter’s true attitude at impact. The forward speed was also high, as shown by the landing skids having sheared and rotated backwards. The wreckage scatter was constrained by the many ice mounds and walls.
3. That the helicopter struck the glacier with a high forward speed and high rate of descent is supported by the post-mortem examinations of the occupants, which determined that all had died from multiple, high-energy impact injuries. Although it could not be determined conclusively where each passenger was sitting for the return flight, it was confirmed that four passengers were ejected from the helicopter during the impact sequence.
4. Indications were that the main rotor had low rotational energy when it came to rest. The leading edges of the blades had no significant damage, and they were found straddling an ice mound, which suggested that the rotor might not have been rotating when it fell into that position.
5. The main rotor and the transmission, although found on top of the helicopter, were not attached to the fuselage. The main rotor head and blades exhibited damage indicative of severe downwards flapping, which was a strong indication of a very high rate of vertical impact. It was as likely as not that the main rotor assembly and transmission separated from the fuselage in the initial impact, and that these large items ‘flew’ together until they hit the ice cliff. Without any driving power behind them, the revolutions per minute of the main rotor blades would have rapidly decayed during this brief period before carving the few short, shallow arcs into the ice cliff face that were noted during the site assessment. This hypothesis could explain why the main rotor blades were not significantly damaged.

Factors that possibly contributed to the crash

1. The following possible scenarios were considered reasonable for the known circumstances, and are discussed below:

• pilot incapacitation
• a flight control problem
• weight and balance out of limits
• an engine problem
• loss of visual cues
• vortex ring state.

Pilot incapacitation

1. The pilot had had three days off duty prior to 21 November 2015. Witnesses said that the pilot’s behaviour and demeanour on the day of the accident were normal and the pilot appeared fit to fly.
2. According to family and friends, the pilot lived an active and healthy lifestyle with no indication of any health issue. On their most recent application for the issue of an aviation medical certificate, the pilot had not listed any current medical concern or noted that they had seen a health professional or taken medication in the preceding three years. A review of the pilot’s medical records revealed nothing that would suggest a medical issue that could have affected their performance.
3. The pilot’s medical file held by the CAA raised no medical concern. On 16 October 2015 the pilot had been issued with a Class one medical certificate with no attached conditions or restrictions.
4. The post-mortem examination of the pilot found no sign of any pre-existing condition that might have affected performance. Toxicological analysis found no evidence of any performance-impairing substance.
5. In view of the above, it is unlikely that the pilot was medically incapacitated during the flight or that their performance was impaired in any way.

Flight controls

1. Because the forward section of the cabin could not be recovered, it was not possible to establish whether there was complete flight control continuity from the pilot’s controls to the main and tail rotors. However, as discussed above it is about as likely as not that the helicopter struck the glacier while flying straight and descending at a high rate.
2. If a pilot had had a collective lever control problem after take-off, it might have been expected that they would turn the helicopter towards the smoother snow to the side of the glacier rather than continue towards the middle of the glacier. If the pilot had had a problem with the cyclic stick control, it is unlikely that the helicopter would have struck the glacier in the level attitude that it did.
3. In post-accident testing, three of the four flight control servos failed internal leak checks, and all four failed static load tests (a static load test involved applying hydraulic pressure to the servo unit and a static load on the output ram, to determine the load required to overload the servo and make the ram move). The combined leak rates of all servos would have been about 35 litres per hour, compared to the hydraulic pump output of 600 litres per hour. The overhaul company that performed the functional tests was of the view that the internal leakages should not have affected normal operation. Further, the test procedure was for new or overhauled control servos. The servos as tested were used, with one being overdue for overhaul. Therefore the static load test results achieved were not considered unusual.
4. Servo transparency is a flight control characteristic that can occur when the in-flight loads on the main rotor exceed design limits and are fed back through the flight control servos. A service letter issued by Eurocopter (Service Letter No. 1648-29-03, Hydraulic power system: servo transparency, 4 December 2003) (the predecessor of Airbus Helicopters) noted that servo transparency is affected by airspeed, collective pitch input, gross weight, ‘G’ (manoeuvring) loads and density altitude. An adverse combination of these factors could provoke servo transparency without any individual factor exceeding the flight manual limitation.
5. The symptoms of servo transparency are:

• the flight controls become very heavy or stiff to move
• an uncommanded right cyclic force, or an existing roll to the right, increases

• the nose of the helicopter pitches up.

  The AS350 flight manual noted that these forces were controllable, but they had to be relieved immediately. If the forces were not relieved, the helicopter’s natural response would reduce their severity within a few seconds.

1. Although servo transparency is not commonly encountered, it was considered a potential factor because the impact site and wreckage suggested that the helicopter had reached a high speed. The gross weight and density altitude were also high.
2. The actual airspeed and the manoeuvring that preceded the impact are not known. However, the training supervisor thought it unlikely that an AS350 would exceed 100 knots when descending from Chancellor Shelf (in part, because of the additional drag from the ski basket). The maximum permitted airspeed at 5,000 ft (1,500 m) was 140 knots. Ordinarily it would be unlikely for a pilot to demand a high collective pitch during a descent.
3. The BEA stated that poor servo condition could make servo transparency “more likely in some cases”, but said it was not aware of any accident where the servo condition had been a contributing factor.
4. The helicopter might have achieved a sufficiently high airspeed during the descent that, in combination with an abrupt pull-up, a servo transparency event occurred. Such a pull-up might have been necessary in an attempt to avoid striking the ice. However, the wreckage did not indicate that the helicopter had been in a right roll at impact. It was virtually certain that the pilot had not encountered a servo transparency event in the descent and been able to recover to a level attitude just as the helicopter hit the ice.
5. All factors considered, it was unlikely that the helicopter encountered servo transparency.

Weight and balance

1. The all-up weight of the helicopter exceeded the maximum allowable internal weight limit throughout the flight.

2. Pilots and operators have separate responsibilities for complying with the published limitations, including weight and balance limits, for their aircraft. Civil Aviation Rule 91.109 states:

   No person shall operate an aircraft unless it is operated in compliance with the operating limitations specified in the aircraft flight manual.

   The operator’s responsibility was covered in Civil Aviation Rule 135.305, which stated in part:

   (a) A holder of an air operator certificate must ensure that—

   (1) the limitations contained in the aircraft flight manual, or other approved document, relating to the weight and balance of an aircraft are complied with; and

   (2) maximum allowable weights are not exceeded for zero fuel, manoeuvre, take-off, and landing; and

   (3) the aircraft’s centre of gravity is within the limits referred to in paragraph (a)(1) at departure, and will remain within those limits throughout the air operation.

3. Operators are responsible for ensuring that the weights of passengers are established, and typically relieve pilots of that task (Civil Aviation Rule 135.303, refer). The operator used standard passenger weights and standard load plans that did not require, ordinarily, that the actual weight and balance be calculated for a flight.
4. However, an advisory circular (Advisory circular AC119-4, Passenger, Crew and Baggage Weights) to the rule states that, “Information relating to the weight and balance of an aircraft needs to be made available to the pilot-in-command prior to commencement of the flight so that he or she can assess the safety of the proposed flight. It is the responsibility of the operator to make this information available, and the pilot-in-command’s responsibility to use the information to satisfy himself/herself that each flight can be conducted safely.”
5. The advisory circular also states that, “There is no relief provided in the rules for an aircraft to operate over weight when using standard passenger weights. Rules also require air operators to adhere to the limitations set by the aircraft manufacturer. When using a standard passenger weight from the rules, an operator is required to establish and comply with procedures that help identify those factors which may lead to the aircraft weight limitations being violated.”
6. The flight manual charts showed that, at the calculated weight, the helicopter would have been close to the performance limit to achieve an out-of-ground-effect hover (a hover without the benefit of the rotor downwash ‘cushion’ on the surface. See ‘ground effect’ in the glossary) when it was at Chancellor Shelf. There is no requirement to have out-of-ground-effect hover capability, but having a small performance margin can restrict the options available to a pilot for manoeuvring the helicopter at low speed.

7. The Commission has commented in other reports on the safety issue of operating an aircraft outside permissible limits, and in an earlier inquiry made the following finding in regard to using standard passenger weights and loading plans:

   The use of standard loading configurations that use standard passenger weights should not be permitted when aircraft are fully loaded and operating close to permissible limits (report AO-2014-005, Eurocopter AS350-B2 (ZK-HYO), collision with terrain during heli-skiing flight, Mount Alta, near Mount Aspiring National Park, 16 August 2014).

8. On 27 November 2015 the CAA issued an emergency airworthiness directive, which had been drafted before this accident, that operators calculate the actual weight and balance before every flight of an AS350 with occupants or cargo on the dual front seat (airworthiness directive DCA/AS350/128, now at revision C, refers. The directive was in response to previous occurrences involving AS350 helicopters equipped with dual front seats).

Engine

1. A detailed engine inspection established that there were no pre-existing defects with the engine or its accessories that would have contributed to the accident, and that the engine was operating at the time the helicopter struck the glacier. The wreckage review (see Appendix 1) showed that the helicopter’s main and tail rotors were rotating, although most likely under relatively low power, when the helicopter struck the glacier.
2. An examination of the engine output shaft carried out by Airbus Helicopters (see paragraph 3.4.5) determined that the damaged splines were the consequence of a significant over-torque (above the maximum torque) during the ground impact sequence.
3. If the helicopter had experienced a loss of engine power after departing Chancellor Shelf, there were smooth areas below Chancellor Shelf and further down the valley where the pilot might have attempted an emergency landing. Even if no power was available, the pilot would have had control over the helicopter’s forward speed and rate of descent, whereas the impact was at high speed.
4. The fuel control lever for the AS350 helicopter is located on the floor between the pilot and the dual front seat. Incidents have been caused by passengers in the front centre seat inadvertently grabbing the fuel control lever, or a bag or camera strap has caught the lever and shut off the fuel. However, this helicopter was fitted with a shoulder-high barrier between the front centre seat and the pilot’s seat to prevent this happening. Although the forward fuselage was not recovered, the damage to the engine-transmission splined coupling could not have occurred had the fuel been shut off.
5. The smearing of the engine-transmission output shaft splines, the sheared bolts on the forward flexible coupling, and evidence of rubbing on the starter fan blade were good indications that the engine was driving the transmission (and therefore the rotors) when they both separated from the airframe.
6. Considering all of the above, it is very unlikely that any engine-related issue contributed to the accident.

Loss of visual cues

1. The helicopter was not equipped with the instruments necessary for safe flight in low or no visibility, and the pilot was not trained for instrument flying. Without the necessary training and instrumentation, a pilot who loses horizon references or visual contact with terrain will very likely become quickly disorientated and lose control (International Helicopter Safety Team, 2018). In mountainous terrain, or if already at a low height, a collision with the ground is virtually certain.
2. Three conditions were considered that could lead to a pilot losing visual contact with the glacier surface:

• fogging or other obscuration of the windscreen
• flying in cloud
• loss of depth perception.

1. Windscreen fogging is a known problem, caused by moist, warm air in the cabin coming into contact with a colder windscreen. A favourable condition for fogging is having passengers with wet clothes on board. The fastest way to clear fogging is to vent the cabin by opening a window or to blow heated, demisting air across the windscreen.
2. The standard practice of the operator’s pilots was to have the cabin heater on and to close the doors after passengers had disembarked for a snow landing. As it was snowing, the pilot and passengers could have had damp clothes on when they got back on board.
3. As the forward section of the helicopter was not recovered, it could not be determined whether the demister and heater had been in use.
4. Rain or snow on the windscreen also restricts a pilot’s view of the terrain ahead. The chief executive opined that any rain on the windscreen would not have dispersed until the airspeed was above 40 knots. Rain and windscreen fogging together could severely limit a pilot’s forward visibility.
5. It had been snowing while the passengers were outside on Chancellor Shelf, and from the photographs it could be seen that changeable cloud conditions existed in the area. The actual conditions when the helicopter departed the landing site are not known. The pilot would have been unlikely to take off if conditions of reduced visibility were present in all directions. The safe option would have been to remain parked until the weather improved.
6. It is very unlikely that the pilot would have intentionally entered cloud after take-off. However, the weather was marginal and conditions were fluctuating quickly.
7. Loss of depth perception can easily occur, particularly in flat light conditions or when visibility is restricted in some way. Pilots could use the rock faces for reference after taking off from Chancellor Shelf in flat light conditions.
8. Below Chancellor Shelf, a relatively smooth, snow-filled depression extended for some hundreds of metres along the right edge of the glacier. It is more difficult to gauge one’s distance from a smooth snow surface than it is from jagged ice like that of the glacier. One local pilot said that in flat light conditions “you’ve got nothing to see; it’s all white”.
9. The first impact was on a relatively smooth mound of snow-covered ice on the edge of the heavily crevassed part of the glacier. If flat light conditions had been present, and especially if the helicopter had been descending quickly, the pilot could have misjudged the helicopter’s height above the glacier and when to reduce the rate of descent.
10. None of the cameras recovered from the wreckage had recorded any images after the passengers re-boarded the helicopter, whereas passengers did photograph the departure from the operator’s base near the Fox Glacier town. The absence of any further imagery after leaving Chancellor Shelf is unusual for tourists on a scenic flight. It suggests that the visual conditions might not have been ideal for photography.
11. Further information on the risks associated with flight in degraded visual environments is given in Appendix 5.

Vortex ring state

1. Vortex ring state is the term given to a phenomenon where the main rotor blade tip vortices, which are produced as a consequence of generating lift, remain attached to the blade tips. Vortex ring state generally will not occur with an AS350 unless the airspeed is low (20 knots or less) and the rate of descent is 1,000 ft (305 m) per minute or more. When a helicopter is established in vortex ring state, an increase in power to reduce the rate of descent or to attempt a climb will, instead, increase the downwash and cause the helicopter to descend faster. More information on vortex ring state is given in Appendix 6.
2. The substantial vertical crushing of the fuselage at impact was the only evidence that might support the possibility of the helicopter having encountered vortex ring state. As described above, the wreckage distribution indicated that the forward speed of the helicopter was almost certain to have been above 20 knots. Although Airbus Helicopters calculated that significant torque was present at impact, the relatively high forward speed was not consistent with the helicopter having been in vortex ring state at impact.
3. For the reasons discussed above, it is virtually certain that the helicopter was not in vortex ring state when it crashed.

Summary of possible contributing factors

2. In the absence of other identifiable causative factors, it is very likely that the helicopter struck the glacier due to the pilot losing awareness of the helicopter’s height above the glacier until it was too late to avoid a collision.

Organisational issues

Safety issue: The operator’s system for training its pilots did not comply fully with the Civil Aviation Rules or the operator’s operations specifications, and did not adequately prepare the pilot for the role and responsibilities required for flight operations that day.

1. Given that the pilot had little more than one summer season of operational experience in the alpine region, the Commission considered the operator’s training system and how it prepared and assessed a pilot for increasing levels of responsibility.

   The decision to fly and land on the glacier

2. Under Civil Aviation Rule 135.153, a person performing an air operation under visual flight rules must use meteorological information of “sufficient reliability and accuracy provided from a source considered acceptable to the operator and the pilot”. This rule recognises the limitations of forecasting for places such as Fox Glacier where local conditions can differ from the area forecast and change rapidly. Most of the West Coast is mountainous. Operators and pilots rely heavily on the observed present weather when making operational decisions, especially for flights expected to take less than 30 minutes.
3. The pilot was the only pilot flying for the operator at Fox Glacier that morning and, being an A-category pilot, was authorised to decide whether a flight could take place. That organisational responsibility was in addition to a personal responsibility as a pilot-in-command to ensure that the weather was suitable for an intended flight. The operator’s Franz Josef pilot was the lead pilot that day, but only the pilot at Fox Glacier could properly assess the conditions at Fox Glacier. At 0700 the pilot judged that the weather was unsuitable for flying. By 0830 the conditions were suitable to fly the glacier guides to the lower landing site. These were reasonable judgements considering that other operators at Fox Glacier had made similar decisions.
4. The pilot decided to make the scenic flight only after seeing the upper valley while flying the glacier guides to the lower landing site. The pilot had acknowledged that the flight might have to be shortened if the weather up the glacier was poor or if a snow landing was not possible.
5. When the scenic flight departed the town, the weather conditions were above the minima for visual flight rules and better than the user group’s minima. However, some pilots who were operating to the lower Fox Glacier landing sites and saw the helicopter proceeding up the valley told the Commission that they had been surprised that the pilot made the flight further up the valley in the changeable conditions. Only one other operator commenced a scenic flight that morning. That flight departed the Fox Glacier town at about 1115 but because of low cloud its pilot did not attempt to reach landing sites in the upper Fox and Franz Josef Glaciers.
6. The weather deteriorated as the helicopter flew higher up the glacier. From passenger photographs and interviews with glacier guides and others who were located in the lower valley at the time, conditions were marginal for visual flight rules up until the time the helicopter landed on Chancellor Shelf at about 0951 (the times of arrival at and departure from Chancellor Shelf were determined from an analysis of photographs taken by passengers). The training supervisor said that Chancellor Shelf was a good landing area in poor weather because there were plenty of terrain references and from there one could see what the weather was doing in the lower valley.
7. Passengers’ photographs taken when the helicopter was parked on the shelf showed that the visibility towards the glacier was variable, with some cloud lower than the shelf. The lower valley was partly visible in one view, which suggested a visibility greater than the minimum 1,500 m required for visual flight rules. In other directions the flat light allowed little or no distinction between the surface and the cloud.
8. If the conditions had been below the visual flight rules minima before take-off on the return flight, the pilot had the option of waiting for an improvement in the weather and radioing that decision to the Fox Glacier office. Good radio communication was possible between Chancellor Shelf and the Fox Glacier town, but nothing was heard at the office.
9. The decision to continue with the scenic flight and make the landing was imprudent given the changeable conditions. The pilot was considered by others to be very confident, but a senior pilot commented that the pilot had at times shown a lack of awareness of how quickly the weather could change. Nevertheless, the pilot could have decided to turn back at any time while proceeding up the valley.
10. The operator permitted its pilots to supplement their incomes by taking photographs of passengers with cameras carried on board. On this flight, each passenger group had their own camera. Therefore it was unlikely that the potential for additional income influenced the pilot’s decision to land on Chancellor Shelf. However, such a practice should be carefully managed by operators so that pilots have no incentive to make flights in marginal conditions.
11. At the time there was no user group agreement that all operators would cease flying if one of them stopped because of poor weather. The reason given was that conditions could improve as rapidly as they could deteriorate, and the skill and experience of the pilots on duty would likely vary across the operators. Three weeks after the accident, senior pilots from the different operators at Fox Glacier agreed to advise each other when they thought marginal weather conditions existed and that they would treat any such assessment as though it were made by one of their own senior pilots.

Operator’s training system

1. The operator’s training system was described generally in its training manual, with more detail of the requirements shown in the associated forms. The training manual stated that the training manager was the CAA-approved senior person responsible for the training system. The chief executive retained custody of the training forms and, according to the training manual, was responsible for ensuring that training and checking forms were completed and filed correctly.
2. However, the training manager, whose primary employment was with another company, had been absent from the operation for nearly four years. The minutes of pilot meetings and training records showed that it was the training supervisor who had played the lead role in operational supervision and pilot management. The training supervisor’s proposed duties (see paragraph 3.6.31) closely matched those approved for the training manager (see paragraph 3.6.18).
3. The pilot had re-joined the operator in September 2014 with more than 1,200 hours’ helicopter experience, but only 8.5 hours on the AS350 helicopter, accrued over five years. The chief executive said new pilots usually started on the Hughes H369, but the pilot’s experience on the Bell 206 had prepared him for the AS350. The training given to a pilot could differ from the programme specified in the operator’s exposition as long as the reason for the variation was recorded (Civil Aviation Rule 135.557 refers). The operator had no specific training programme, so the various training decisions, which may have had a valid basis, were not formally recorded.
4. The training supervisor had recognised the pilot’s low experience, both on the AS350 type and with flying in the mountains. The training supervisor said the pilot was given the same training as other pilots and had “a very controlled progression” through the pilot categorisation system, but the training records and logged flights did not support that view.
5. There was no record found of the pilot having been initially categorised in the operator’s pilot categorisation scheme, and only an informal record that showed the pilot had been given a B-category after two months with the operator, during which time the pilot had flown 55 hours on the AS350.
6. The pilot had been authorised by the operator to act as pilot-in-command on air operations in the AS350 before completing the required five hours of supervised experience in air operations on that type. The operator had also authorised the pilot for scenic flying in the Hughes H369 helicopter before they accrued any supervised consolidation, which was not in compliance with the Civil Aviation Rules.
7. All pilots are examined to check that they have the appropriate meteorological knowledge for the levels of pilot licence they wish to hold, but theoretical knowledge must be complemented with practical training and experience. An understanding of local weather patterns is essential for pilots employed in mountainous areas, and it would usually take some years to acquire that understanding. The pilot’s decision to land on Chancellor Shelf under such changeable conditions was not what would be expected by a senior, unsupervised pilot under the operator’s categorisation scheme.
8. Air operators must provide training programmes to ensure that their pilots are trained and competent to perform their assigned duties (Civil Aviation Rule 135.553 refers). The pilot’s training and work experience with the operator had been gained in little more than one summer season. The operator’s records showed that the pilot had been promoted to A-category only six weeks after re-joining the operator in 2015.
9. The pilot’s most recent route check had been on 23 October 2015 and lasted 35 minutes. The training supervisor had noted on the training record that the flight was “dual training to all landing sites Fox and Franz Glacier, all hut sites”. The pilot had not confirmed that the training had taken place by signing the operator’s training form, and had not logged the correct details for the flight as required by the Civil Aviation Rules (Civil Aviation Rule 61.29 refers). A similarly described route check in 2014 had taken 1.3 hours (see paragraph 3.7.6). It is unlikely that effective training and checking took place at all landing sites and hut sites in 35 minutes, because it takes 12 minutes or more just to fly to the head of one of the glaciers and back.
10. The standard of the pilot’s operational performance was unclear because of conflicting records provided by the operator. The training supervisor had noted on the training record of the 23 October 2015 flight that the pilot was “approved to all landing sites and hut sites”, but had added “under supervision for any hut site landing”. According to a pilot categorisation form signed by the chief executive on 24 October 2015, the pilot was awarded an A-category on the AS350 as a result of that route check. However, the operator’s training manual stated that an A-category pilot was “able to work unsupervised”.
11. The pilot had not signed the most recent categorisation form to show awareness of the awarded category and its associated responsibilities and privileges. The operator’s procedures required pilots to sign the forms (Operator’s training manual, section 3.2.1). The CAA had raised an audit finding in 2012 for the same omission in regard to another pilot (CAA audit 11/SPTG/36 refers).
12. The Civil Aviation Rules required an operator to “maintain accurate records of all required training undertaken by its crew members” and “all competency assessments and testing of its crew members” (Civil Aviation Rules 135.555 and 135.613 refer). Not all of the training records covering the pilot’s training had been signed by the pilot to confirm that the details were correct. The variances described above show that the operator had not complied with those requirements.
13. The operator’s standard operating procedures included five pages of ‘Mountain flying notes’, but did not specify what flight training pilots had to undergo. The notes acknowledged that “Mountain flying techniques require special knowledge and no pilot employed by the Company is to fly the Company’s helicopters in mountainous areas unless approved by the Operations Manager”, and that “mountain flying approvals will only be given after the [operations manager is] satisfied that the pilot concerned has demonstrated [their] capability and knowledge and the pilot concerned is listed on the pilot categorisation form” (Operator’s standard operating procedure, chapter 7).
14. Some of the instruction given by the training supervisor to the pilot (on snow landings, for example) would very likely have been mountain flying training. However, at the time there was no organisation or operator in New Zealand that had been approved by the CAA to conduct mountain flying training as described in Advisory Circular 119-3 (see paragraph 3.6.21). Consequently the operator did not give the pilot any recognised mountain flying training.
15. The speed with which the pilot was put through the operator’s training programme and the fact that the training programme was not conducted in strict accordance with the Civil Aviation Rules are signals that the operator’s training system had not given the pilot the training, experience and supervision commensurate with the level of responsibility the pilot was given as an A-category pilot and necessary to mitigate the hazards of the area of operations.
16. Given the shortcomings in the operator’s training system, the following section discusses the oversight of the operation by senior persons.

Management oversight

1. Senior management in aviation companies are responsible for giving effective oversight of compliance systems and processes. However, the civil aviation rules and standards provide only a minimum or ‘foundation’ level of compliance. Responsible management operates on a continuous improvement basis to exceed minimum standards and achieve good or even best industry practice. In this case the operator did not achieve compliance with those minimum standards outlined in the civil aviation rules, particularly in respect of providing sufficient personnel to plan, perform and supervise its operations. This is discussed further below.
2. The findings made in CAA audits, the minutes of pilot meetings and the circumstances of the operator’s three most recent accidents were indicators that the operator had not provided sufficient senior management oversight of its operations as required by the Civil Aviation Rules and as described in its exposition.

3. Civil Aviation Rule 119.101, Personnel Requirements, stated:

   (a) An applicant for the grant of a general aviation air operator certificate must employ, contract, or otherwise engage

   (1) a senior person identified as the chief executive who—

   (i) has the authority within the applicant’s organisation to ensure that all activities undertaken by the organisation can be financed and carried out in accordance with the requirements and standards prescribed by this Part; and

   (ii) is responsible for ensuring that the organisation complies with the requirements of [Part 119]; and… 

   (3) sufficient personnel to plan, perform, supervise, inspect, and certify the operations listed in the applicant’s exposition

4. The chief executive was closely involved with other aspects of the business and, in effect, left the daily management of the Fox Glacier tourism operation to the office manager and the training supervisor. However, the office manager was not qualified to supervise operations. Their responsibility under the operator’s exposition was for occurrence investigations only. The November 2015 pilot meeting had noted, for the second time, that the chief executive was difficult to contact when advice was needed.
5. The Civil Aviation Rule requirements for an air operator certificate recognised that a training manager was a key person, yet the approved individual had been absent for nearly four years.
6. The training manager had known that a training supervisor had been appointed. However, it was not until June 2015, when asking for details of the Hughes H369 accident earlier that month, that the training manager had learnt that their senior person appointment might have ceased. The training manager had never been formally advised by the chief executive of this change.
7. In spite of the training manager no longer having an active involvement, the chief executive had not mentioned this situation, even during the audit in March 2015 that examined pilot training. In January 2015 the operator had requested CAA approval to replace the training manager with either the chief executive or the training supervisor, but the application had been declined.
8. The training supervisor, although well intentioned, had conducted pilot training outside the approved operations specifications. The pilot group had recorded a concern about the lack of structure in the operator’s training system.63
9. Other issues that involved the control of maintenance (see paragraph 3.3.12) and the control of aircraft weight and balance (paragraph 4.3.18) were examples of the non-compliances that were the subject of findings in other CAA audits of the operator.
10. The operator’s internal audit programme had not made findings or identified corrective/preventive actions for the management and training issues referred to above.
11. CAA audit reports showed that the CAA had had indications as early as March 2011 about the absence of the training manager, and was aware, at least from 2013, that the training supervisor had effectively assumed the role. However, the CAA had made no findings about these variations from the operations specifications.
12. CAA inspectors informed the Commission that there had been discussions with the operator and between CAA staff regarding different interpretations of the rules applying to the operator’s training situation, and whether the training supervisor was a suitable candidate for the training manager position. Some of the internal CAA discussions had been recorded in emails between staff.

13. The requirements for pilot instructors were stated in Civil Aviation Rule 135.567, which read

    135.567 Flight crew member instructor qualifications

    Each holder of an air operator certificate shall ensure that any person carrying out functions as an instructor in its flight crew member training programme established under this Part—

    (1) has satisfactorily completed the training required by this Subpart to serve as pilot-in-command in operations; and

    (2) holds a Category A, B, or D flight instructor rating; and

    (3) completes initial and recurrent training requirements applicable to the instruction carried out.

14. The CAA did not clarify its interpretation of the instructor requirements until after the accident (see section 7.4. The CAA further clarified the requirements by introducing the role of ‘operational instructor’ to subsequent approvals of operator operations specifications). The statement “its flight crew member training programme” in the above rule made it clear that instructor requirements had to be read in conjunction with the applicable operations specification. If the operator had had CAA approval to conduct internal flight training, then the training supervisor, who held a Category D flight instructor rating, might also have been approved to conduct the training. However, prior to the accident there had been no CAA approval for internal training against which the instructional competence of the training supervisor could have been assessed.
15. The CAA had commented on, and in some cases raised findings for, aspects of pilot training and competency checks after conducting audits of the operator in 2005, 2008, 2011, 2013 and March 2015. CAA staff were aware that the training supervisor had been conducting training, most likely since 2013, but they had made no specific finding of non-compliance during any audit between then and the accident in November 2015.
16. Following the accident, in a letter to the operator in February 2016, the CAA expressed extreme concern that the operator had “appointed an unapproved person to act as the training manager and also that unauthorised training has been conducted”. The letter added that the CAA had been “led to believe” by the chief executive at previous audits that the training manager had been acting in that senior person role. However, CAA auditors and inspectors had known of the situation for some years. This issue is discussed in the following section.

CAA surveillance

Safety issue: The operator had been allowed to continue providing helicopter air operations with little or no intervention from the CAA, in spite of the CAA having identified significant non-compliances with the operator’s training system and managerial oversight.

1. The CAA auditors and inspectors had raised concerns at various audits since 2012 about the operator’s management oversight and training system. However, the CAA had not responded decisively to the information provided by its surveillance unit.
2. As previously discussed, the CAA surveillance staff had had strong signals for nearly four years leading up to the accident that the training manager was likely to have had little involvement with the training and checking of the operator’s pilots. The CAA staff had known the extent of the training supervisor’s internal training, and very likely had known that the operator had no approval for this. Some CAA surveillance staff admitted that there had been some uncertainty with interpreting the rules but, in their view, the training supervisor had raised the operator’s standards. Nevertheless, an avoidable safety risk existed because the operator’s training system, including the use of internal instructors, had not been formally assessed and approved by the CAA.
3. Without any formal findings having been raised during any audits at which this situation was observed, the CAA had not been able to address the continued non-compliance. Internal CAA processes had not ensured that higher-level CAA managers were made fully aware of the true situation. Without the correct information, the managers could not take the most appropriate action necessary to get the operator to comply with the requirements of its air operator certificate.

4. The training manager’s absence was not a ‘change’ to the list of approved senior persons, but the substitution with the training supervisor was a variation to the organisational structure that the operator should have advised to the CAA. The relevant Civil Aviation Rule stated:

   119.165 Changes to certificate holder’s organisation

   (a) A holder of an air operator certificate must— (1) ensure that its exposition is amended so as to remain a current description of its organisation…

5. However, as mentioned in the previous section, the training and supervision of the pilot had not been of a sufficient standard for the level of responsibility the pilot was gien. This was a likely consequence of all the issues the auditors and CAA inspectors had identified over several years. Good standards of pilot training and supervision are critical to safe operations. The CAA should have responded decisively to the observed and continuing non-compliance in those areas.
6. The CAA website noted that improvements made in 2012 to its surveillance system had resulted in “an enhanced risk profiling process, and audits that are more focussed on the areas of higher risk within an organisation”.

7. The Commission had identified a safety issue in a previous inquiry (Inquiry AO-2011-006, Britten-Norman BN.2A Mk.III-2, ZK-LGF, runway excursion, Pauanui Beach Aerodrome, 22 October 2011) where the CAA regulatory tools had not been decisively used when dealing with another operator who had recurring audit findings in the areas of management and operations. On 26 February 2014 the Commission had recommended to the Director of Civil Aviation:

   that he apply stricter requirements upon holders of air operator certificates to take effective action to correct identified deficiencies, and that any serious safety issues that are identified with managerial oversight of airline operations always result in findings (recommendation 001/14).

8. A similar recommendation could be applied in regard to the CAA’s surveillance of this operator. CAA audits had identified, although not necessarily made findings about, the following recurring areas of concern:

• organisational leadership – setting examples, compliance with the Civil Aviation Rules, the chief executive’s view of audits
• actions, required to correct audit findings, not completed by the agreed dates
• senior person absence and accessibility
• lack of transparency about absence of training manager.

Sector risk profile for operations conducted under Civil Aviation Rules Part 135

1. Since 2011 the accident rate in the New Zealand Part 135 aviation sector, which includes helicopters and small aeroplanes, had had an upward trend. The underlying causes had not been immediately apparent. In 2015 the CAA had commissioned an external project to examine the underlying influences on safety within the sector and to present a risk profile of the sector. The goal had been to assess the risks and to inform targeted and appropriate interventions. The CAA published the first report on ‘Part 135 Sector Risk Profile’ on 27 November 2015 (Navigatus Consulting, 2015).
2. The sector risk profile was updated in June 2018. More information is in Appendix 7.

Summary

1. At the time of this accident the operator had one of the largest helicopter fleets in New Zealand. There were a number of serious and persistent issues with the senior management oversight of the operation. Of particular relevance to this accident was management oversight of its pilot training system and the degree of supervision it provided for its pilots.
2. The operator carried the prime responsibility for ensuring that, as a minimum, its operation was conducted in accordance with the Civil Aviation Rules and its exposition. The CAA had a responsibility to conduct effective surveillance of the operator as part of its monitoring compliance across the industry.
3. The CAA cannot reasonably be expected to ensure total compliance by all participants in the sector. However, its surveillance activity should ensure that where deficiencies are found they are formally recorded so that regulatory decisions can be informed. Appropriate action can then be taken to either cause change or remove the threat from the system before an accident occurs.
4. In this case the CAA had had good cause and ample opportunities to intervene at an early stage. Instead the operator had been allowed to continue, with little change to improve its training and management system, and little improvement in senior management oversight of the Fox Glacier operation. That situation had put the pilot in a position of responsibility that the pilot was not sufficiently trained or experienced for.
5. Ultimately the pilot had been prematurely put in a position to make operational decisions, unchecked. Whatever happened after the helicopter lifted off from Chancellor Shelf, the accident was a culmination of deficiencies in the system that put the pilot there on that day.
6. Since about 2010, in response to reviews and recommendations, the CAA has made a number of changes with a focus on improving its performance of its regulatory role. These changes have been made through the regulatory surveillance period referred to in this report, and as such are relevant to its oversight of this operator prior to the accident. The CAA referred to some of these earlier changes in its response to a previous recommendation made by the Commission (refer to section 7of this report). This work is an ongoing part of the CAA’s ‘Regulatory Craft Programme’.

1. The helicopter struck the glacier surface with a high forward speed and a high rate of descent, with the engine delivering power.
2. Throughout the flight, the all-up weight of the helicopter almost certainly exceeded the maximum permitted weight.
3. It is unlikely that mechanical failure with the helicopter was a factor in the accident. Although not all of the wreckage was recovered, an examination of the recovered components (including all the dynamic assemblies) revealed no pre-existing failure.
4. The tail rotor servo had exceeded the maximum flight hours permitted before overhaul, although that was unlikely to have been a contributory factor.
5. The weather conditions on the day were unstable and unsuitable for conducting a scenic flight. The localised weather conditions in the area were very likely to have been frequently below the minimum criteria required by the Civil Aviation Rules.

6. It is very likely that when the helicopter took off from Chancellor Shelf and descended down the valley the pilot’s perception of the helicopter’s height above the terrain was affected by one or more of the following conditions:

• cloud
• precipitation
• flat light conditions
• condensation on the helicopter’s front windscreen.

7. The pilot had not been properly trained and did not have the appropriate level of experience expected under the operator’s categorisation scheme to fulfil the role and responsibilities expected of a senior (A-category) pilot in this type of operation.

8. The operator’s system for training its pilots was ill-defined and did not comply fully with the Civil Aviation Rules.

9. The operator’s training system did not have sufficient oversight by the designated senior persons. This was a factor that allowed the pilot to be assigned roles and responsibilities without the proper training and experience.
10. The Civil Aviation Authority had identified significant and repetitive non-compliance issues with the operator’s training system and managerial oversight that warranted intervention long before this accident occurred.

1. The operator’s system for training its pilots did not comply fully with the Civil Aviation Rules or the operator’s approved operations specifications, and did not adequately prepare the pilot for the role and responsibilities required for flight operations that day.
2. The operator had been allowed to continue providing helicopter air operations with little or no intervention from the CAA, in spite of the CAA having identified significant non-compliances with the operator’s training system and managerial oversight.

General

1. The Commission classifies safety actions by two types:

   (a) safety actions taken by the regulator or an operator to address safety issues identified by the Commission during an inquiry that would otherwise result in the Commission issuing a recommendation

   (b) safety actions taken by the regulator or an operator to address other safety issues that would not normally result in the Commission issuing a recommendation.

Safety actions addressing safety issues identified during an inquiry

2. The CAA published an article, ‘Heli[copter] weather decision making’, in the March/April 2016 issue of its Vector aviation safety education magazine that sought to emphasise the correct use of meteorological minima.
3. On 27 May 2016 the Director of Civil Aviation suspended the operator’s air operator certificate, and on 9 June 2016 revoked the certificate. The CAA later laid charges under the Health and Safety in Employment Act 1992 against some senior persons of the company.
4. On 18 July 2016 the CAA issued a letter to the chief executives of all Part 135 operators on the subject of pilot training programmes. The letter outlined the history of using pilots with Category D flight instructor ratings to deliver operational instruction, and clarified the privileges of flight instructors operating within or outside approved training programmes. The letter also explained the training programme details that must be shown in an operator’s operations specifications.
5. On 3 August 2016 the CAA issued revision 9 to advisory circular 61-18 to clarify the privileges and limitations of the Category D flight instructor rating. This defined operational flight training as the theoretical and practical training required for a pilot to operate an aircraft safely on commercial operations in accordance with the competency requirements defined in an operator’s crew member training programme. The circular stated that Part 135 operators should have an established operational flight crew training programme within which the Category D flight instructor may operate as an operational instructor. The CAA now requires approved operational instructors to be identified in operations specifications.
6. In September 2016 the CAA issued an air operator certificate to a new company that took over from the former operator. Although it had the same owner, that person no longer held a senior person role. The operations specifications included training approvals appropriate to the new company’s activities.

Safety actions addressing other safety issues

7. None identified.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector. In this case, a recommendation has been issued to the Director of Civil Aviation, with notice of the recommendation given to the Secretary of Transport.
2. In the interests of transport safety, it is important that this recommendation is implemented without delay to help prevent similar accidents or incidents occurring in the future.

Previous recommendation

1. During an inquiry into an earlier serious incident involving a runway overrun by an aeroplane at Pauanui Beach aerodrome (Inquiry AO-2011-006, Britten-Norman BN.2A Mk.III-2, ZK-LGF, runway excursion, Pauanui Beach aerodrome, 22 October 2011), the Commission had commented on the importance of taking action to correct recurring deficiencies to prevent their becoming contributing factors in a later incident.
2. The Pauanui incident had drawn attention to recurring deficiencies with the aeroplane operator that had been previously identified by CAA audits. For various reasons corrective actions had been ineffective, with the result that some of these deficiencies had contributed to the runway overrun. A delay in correcting identified deficiencies can be a latent factor that contributes to future incidents.
3. Some of those earlier audits had also discussed serious safety issues with that operator’s management oversight and the general culture of the company, but not all of those issues had resulted in audit findings.
4. On 26 February 2014 the Commission had recommended to the Director of Civil Aviation that they apply stricter requirements upon holders of air operator certificates to take effective action to correct identified deficiencies, and that any serious safety issues identified with managerial oversight of airline operations always resulted in findings. (001/14)

5. On 5 March 2014, the CAA had replied in part:

   The Director accepts the Commission’s recommendation and advises that effective action has already been taken to implement its intent. In this respect, it is noteworthy that the focus of the Commission’s investigation primarily related to events in late 2011 and early 2013. Since that time the CAA has undergone considerable organizational change: a real focus of which has been to supplement its strong aviation technical expertise with an enhanced regulatory skill set. To this end it has recently invested considerable time and effort in articulating and strengthening its regulatory approach. This work started to take effect at about the same time as the Pauanui Beach runway overrun occurred and has subsequently both gained impetus and been consolidated. Examples of this investment include:

• significant changes to the CAA’s existing Surveillance Policy made in Sep 2011. Relevant to the second element of the Commission Recommendation, the following direction was introduced regarding the raising of findings: “When a document holder’s performance falls below the required standard a finding will be raised”;
• new ‘CAA Use of Regulatory Tools’ policy introduced on 23 Sep 2011. The new policy was created to provide guidance to CAA staff about the use of regulatory tools in discharging their obligations;
• new ‘Regulatory Operating Model’ adopted and promulgated by the CAA on 17 Feb 2012. The new policy was created to sit above the ‘CAA Use of Regulatory Tools’ policy and identify, at a high level, the overarching regulatory principles and approach the CAA adopts in discharging its obligations;
• [a consultant] has been engaged to up skill regulatory staff on good regulatory practice and operational risk management (workshops held May 2013 and Feb 2014). All senior regulatory staff, and the majority of all regulatory staff, have attended one of these seminars;
• the addition of Operational Risk Management and Safety Management System skills to the competency framework for regulatory staff. Development and the delivery of such training with the latest element of the training delivery commencing March 2012;
• internal review processes for regulatory functions ensure compliance with proper process and identify learnings that can drive improvement;
• review of the current risk profile ‘triggers’ for targeting oversight of any operator with action underway to move toward targeting of the upper quartile of the risk profile distribution (as opposed to utilizing fixed trigger ‘scores’ for this purpose); and
• the introduction of a risk-based approach to regulation that focusses attention on the circumstances of a particular case, the risks posed and the selection of the most appropriate regulatory intervention to provide the required risk mitigation.
• The efforts outlined above constitute a significant strengthening and sharpening of the CAA’s regulatory focus in the time since the overrun at Pauanui. While incremental improvement is always possible the CAA has invested considerably in providing its staff with the direction, guidance, skills and tools necessary for them to make sound, evidence-based decisions in the public interest.

1. Based on the CAA’s stated actions, the Commission had closed the recommendation on 24 June 2015.

New recommendation

1. As noted above, the CAA said that it had put in place changes in policy and training for its inspectors by February 2014. Leading up to that date, and afterwards, CAA inspectors had overlooked significant non-compliances by the operator of the helicopter at Fox Glacier and they had not raised findings on matters of non-compliance with Civil Aviation rules.
2. In this case the CAA had had good cause and ample opportunities to intervene at an early stage. Instead the operator was allowed to continue, with little change to improve its systems. Those systems put the pilot in a position of responsibility that the pilot was not sufficiently trained or experienced for.
3. The Commission is concerned that there could be a wider safety issue whereby other Part 135 operators that were in the civil aviation system during the same period could have significant non-compliances that have either not been identified or not been resolved.

4. On 21 February 2019 the Commission recommended that the Director of Civil Aviation initiate an independent review of CAA surveillance reports and any findings raised for Part 135 operators since 2014 to measure the effectiveness of the surveillance policies and procedures that the CAA has put in place, including the effectiveness of their implementation. If the independent review finds unidentified or unresolved safety issues with specific operators, it is recommended that the Director of Civil Aviation take the appropriate urgent action to resolve those issues. (002/19)

   On 11 March 2019, the Chief Executive of Civil Aviation Authority replied:

   The CAA undertook its own investigation into this crash and subsequently successfully prosecuted the operator for not taking all practicable steps to ensure the safety of its pilot and his passengers. Participants in the aviation system have a responsibility to maintain compliance with regulatory requirements and this operator failed to do that.

   The CAA investigation also identified that its safety oversight of this operator in the period leading up to the accident – particularly during the period 2010-2012 – didn’t meet its own standards. In summary, it lacked the rigour demanded by its policies and procedures.

   The analysis of those shortcomings was conducted in early 2017 and it was concluded that the work already underway to improve the CAA’s regulatory performance (the start of which is referred to by the Commission in its recommendation) was addressing the deficiencies observed in the dealings with this operator. Since initiating that work in mid-2013 the CAA has made significant changes to improve its regulatory performance and oversight of aviation system participants, and this work continues. Significant capability building initiatives have been implemented and further initiatives will continue to be progressed as the CAA works to further enhance its performance and regulatory oversight. As a result of the work undertaken to date, and that currently in progress, the CAA of 2019 is a much more effective regulator than the one that was dealing with this operator in the period leading up to the 21 November 2015 crash.

   The CAA has already commenced implementation of the Commission’s recommendation. PriceWaterhouseCoopers (PwC) was appointed to undertake the independent review, which will sample 200 inspection activities conducted over the period 1 January 2014 to 1 December 2018. At the time of writing, the PwC review was well advanced but was not yet complete. The work done to date has not identified any operators with significant non-compliances that have either not been identified or not been resolved. The independent review is expected to be completed by 31 March 2019 and the report will be made available to the Commission as soon as it is available.

1. Aircraft operators’ senior management have a regulatory duty to maintain proper and effective oversight of their operations. Doing otherwise will compromise the safety of the operations and increase the risk of repeat accidents.
2. Proper training of pilots is critical to the safety of air operations. Any training and competency system must ensure that pilots are trained and experienced to levels appropriate for their roles and responsibilities.
3. Every operator must provide adequate supervision of its pilots, appropriate to the pilots’ experience and training and the nature of the operations.
4. Aircraft manufacturers set ‘never exceed’ limitations for good reasons. Pilots should not, under any circumstances, load or operate their aircraft outside the limitations.
5. With knowledge comes responsibility. If a senior person working for an air operator or an inspector working for the regulator identifies a serious safety issue with an operation, the issue should be formally raised and action taken to address it.

CAA. (2017). Civil Aviation Rules Part 135. Wellington: CAANZ.

CAA. (2018, May 18). Sector Risk profiles - More Information. Retrieved from CAA: http://www.caa.govt.nz/safety-info/safety-reports/sector-risk-profiles-more/

International Helicopter Safety Team. (2018). Inadvertent entry into instrument meteorologicval conditions. Retrieved from www.ihst.org: http://www.ihst.org/Default.aspx?tabid=3056&language=en-US

Navigatus Consulting. (2015, November 27). Part 135 Sector Risk Profile 2015. Retrieved from CAA: http://www.caa.govt.nz/assets/legacy/Safety_Reports/srp_part_135.pdf

Between 27 January 2016 and 29 January 2016 the recovered wreckage, except for the engine (the engine had been shipped to the manufacturer in the United States for examination), was examined at the Commission’s Wellington facility by the Commission’s investigation team, the Accredited Representative of France, two other investigators from the BEA and an investigator from Airbus Helicopters.

The following notes include observations made by Airbus Helicopters during this examination. 

General

The fuselage forward of the cabin bulkhead, including the flight controls and underfloor control linkages, was destroyed by high vertical and horizontal impact forces. Most of the seats, doors and exterior panels were detached. The rear frame of the dual front seat was bent backwards to an angle of approximately 60 degrees. The right (inside) frame of the seat and the back cushion from the top centre to the middle right were missing. The passenger seat belts attachments had pulled free of the structure.

The left rear cabin structure had a substantial crease, made when the tail boom was still attached, but the tail boom had been subsequently torn off to the right.

The landing gear cross tubes had sheared from the landing skids and rotated upwards, and the left landing gear shock absorber had been pulled from the structure.

The pilot’s instrument panel was recovered, but the instruments had been ejected and no useful information was obtained from them.

Main rotor blades

The three blades were connected to the rotor head. There were no significant impact marks on the stainless steel leading edges or the blade tips. The upper and lower surfaces of each blade had opened at the trailing edge, which was an indication that drag loads had been imparted to the blades. The broken spar on one blade showed a mix of upward flapping and drag loads. One blade had lost much of the trailing edge, which was likely caused by impact with the ice late in the accident sequence.

All of the observed damage was a consequence of overload during the accident. No pre-existing damage was identified.

Main rotor head

The rotor head was connected to the main gearbox, but they were completely separated from the mechanical/engine deck and displaced rearwards. The position indicated that they were disconnected from the airframe before falling there. The rotor and swashplate turned freely when driven by the main gearbox input flange.

Two of the three starflex® arms were broken: one showing a 45 degrees break that signifies a failure in drag, and the other evidence of flapping. Damage to other rotor head components was consistent with their having experienced sudden stoppage drag loads.

The drive and stationary scissors and all pitch change rods were in good condition and operated correctly. The vibration absorber that sits on top of the rotor drive shaft was largely undamaged.

The droop restraining ring was significantly deformed by impact with the thrust fittings on each blade. This indicated substantial simultaneous main rotor blade flapping associated with a vertical impact.

All of the observed damage resulted from the accident. No pre-existing failure was observed.

Main gearbox, and engine to main gearbox coupling

The gearbox was connected to the rotor mast but the four transmission suspension bars were broken in overload. The input flange was partially connected to the engine-transmission shaft by one of the flexible coupling bolts. The other two bolts were missing, but the lack of elongation of the flange holes indicated that they had failed in tensile overload. No external or pre-existing damage was observed to the gearbox. The magnetic plug was clean.

The connecting casing, gimbal ring and coupling tube were connected to the engine, but they had disconnected from the gearbox because of overload failure of the connecting casing at the gearbox end. There was evidence of light rotational interference between the gimbal ring and the flexible coupling bolt heads at the gearbox end, which most likely occurred when the connecting casing broke, and between the drive shaft and the coupling tube.

The drive shaft was in good condition and connected to the flexible couplings at each end. The engine end flexible coupling was connected to the engine shaft flange. The splined shaft that connected the engine to the main transmission had moved rearwards. The splines showed signs of smearing that would have required the shaft to have been driven by the engine, and therefore likely occurred during the accident sequence. The splined engine shaft was inspected during the engine tear-down in the United States, and then sent to France for further examination (see section 3.4 in the main report).

Tail rotor drive shafts

The tail rotor forward steel drive shaft, from the engine accessory gearbox, was seen at the crash site but was lost during the wreckage recovery. As was the case for the accessory gearbox output to the main rotor, the gearbox output to the tail rotor was displaced rearward and the retaining clip was missing.

There was evidence of rotational interference between the flange of the light alloy section of the drive shaft and the hole in the engine compartment fire bulkhead through which the shaft passes. That indicated that one or both sides of the flange were missing during the break up.

The long drive shaft was visually not twisted. It was still connected to the tail gearbox, and had little damage apart from the bearing support being bent forward due to impact forces. All six shaft support bearings turned freely without binding. The impact had caused grease to be ejected forward and down from the drive shaft bearings at a relative angle of 30 degrees (this did not necessarily prove the helicopter’s pitch attitude (compared to the horizontal) at impact) (see Figure 10).

Tail rotor assembly

Both tail rotor blades had significant damage and the tail rotor gearbox output shaft was bent forward. The drive key between the tail rotor hub and the rotor shaft was not sheared, which indicated the blades were not being driven under high torque at impact and that flapping was the main mode of damage.

The tail rotor gearbox remained connected to the tail boom and rear light alloy drive shaft, and did not exhibit any damage. The gearbox turned freely and the magnetic chip detector was clean. The pitch change operation was normal. The blade tip ‘fingers’, which show whether the blades have contacted anything, were bent in a flapping direction and did not indicate significant rotation at impact.

Flight controls

Except for the tail rotor pitch controls (including the control servo on the upper tail boom) and the main rotor control servos, the main rotor and tail rotor control rods were destroyed and could not be recovered from the site. The observed damage on available components was caused by overload resulting from the accident. No pre-existing damage was observed.

Hydraulic servos

The hydraulic system was severely damaged during the accident. Examination of available components, including the hydraulic pump and the flight control servos, did not reveal any pre-impact damage.

Fuel and other systems

The fuel and electrical systems could not be examined in detail because of the wreckage condition. The fuel tank cradles had detached from the structure. The fuel boost pumps from the base of the tank were not recovered.

Conclusions

The examination was limited because of the significant damage and because not all of the wreckage could be recovered. Those systems and assemblies that were examined did not allow any technical explanation for the accident. All of the observed damage was a consequence of the accident.

The Airbus Helicopters representative noted that while the damage to the main rotor blades was “generally representative of a lack of power” if the main rotor blades had impacted the ground while powered by the engine, the trailing edge damage to the blades was usually indicative of drag loads applied when the blades were under power.

The weight and balance calculation for the return flight from Chancellor Shelf.

*The moment is the turning effect of a force, in this case the listed item’s weight, about the datum when applied at the stated distance from the datum.

Notes

1. The basic empty weight of the helicopter included an axe, fire extinguisher, first aid kit, dual front seat, avionics, snow shoes, rear locker extender, unusable fuel and ballast.
2. The maximum permissible weight was 2,100 kg.
3. The allowable longitudinal centre-of-gravity position at an all-up weight of 2,100 kg was between 3.185 m and 3.445 m.
4. The occupants’ weights were estimated from the best available ante-mortem and post-mortem sources.
5. The calculation assumes that the passengers were in the same seats for the return flight as they were when the helicopter departed the Fox Glacier base.
6. The ski basket and survival kit were not included in the helicopter basic empty weight.
7. The ski basket was weighed by the Commission and the weight of the survival kit was provided during operator interview.

MetService provided the following post-accident analysis of the weather on 21 November 2015:

On the morning of 21 November 2015 a broad trough of low pressure was moving slowly eastwards across New Zealand. The north-eastern end of a weak warm front in the Tasman Sea, lying more or less parallel with the Fiordland coast, was moving slowly southeast towards the coast. A moist westerly airstream flowed onto the west coast of the South Island.

The West Coast area forecast for the period that included the time of the accident predicted a westerly wind at about 15 knots at 3000 ft (923 m) (heights in this section are above sea level), increasing in strength at higher altitudes. The freezing level was forecast to be at 6000 ft.

Visibility was forecast to be about 20 km, reducing to 6 km in moderate rain showers. Broken layers of cloud (broken means a layer covering between five and seven eighths of the sky) were predicted, with a base at 3000 ft (923 m) and tops at 10,000 ft.

Recorded observations at Franz Josef, 16 km north NE of Fox Glacier town, showed that there had been a period of heavy rain between about 0200 and 0700 that morning. Between 0700 and 0900 there was light to moderate rain, which ceased (at Franz Josef) before 0900. The separation between the air temperature and dew point (dew point is the temperature to which air must be cooled to become saturated with water vapour. When further cooled, the vapour will condense to form liquid water, visible as cloud) at Franz Josef indicated that cumulus cloud could have been expected with a base at about 1,200 ft in the heavy rain, and at about 3000 ft after the rain had ceased.

The ‘Swiss Cheese’ model of accident causation, originally proposed by James Reason, likens human system defences to a series of slices of randomly-holed Swiss cheese arranged vertically and parallel to each other, with gaps between each slice.

Reason hypothesises that most accidents can be traced to one or more of four levels of failure:

• organisational influences
• unsafe supervision
• preconditions for unsafe acts
• the unsafe acts themselves.

In this model, an organisation’s defences against the above potential failures are shown as a series of barriers, represented as slices of cheese. The holes in the cheese slices represent weaknesses in the individual parts of the system. The potential weaknesses vary in size and position, and over time. A system failure occurs when holes in each slice momentarily align, permitting “a trajectory of accident opportunity”. A hazard can then pass through all of the defences, leading to an accident.

It is important to understand that the unsafe act, although depicted as a failure of the final barrier, is nearly always preceded by failures at other levels in the system.

Based on the article, James Reason HF Model, source: www.skybrary.aero

Excerpts from European Helicopter Safety Team training leaflets Degraded visual environment

A continuing significant number of accidents are due to pilot disorientation in a degraded visual environment. Research has demonstrated the strong relationship between helicopter handling characteristics and available visual cues. This has clearly shown that there are likely to be visual cueing conditions, helicopter handling characteristics and pilot capabilities which, although manageable individually, can be predicted to be unmanageable when in combination.

Analysis indicates that any, or a combination of, the following three scenarios could result in a serious accident:

a. Loss of control when attempting a manoeuvre to avoid a region of impaired visibility, i.e. backtracking, climbing above or descending below the degraded visual environment.

b. Spatial disorientation or loss of control when transferring to instrument flight following an advertent encounter with instrument meteorological conditions.

c. Loss of situational awareness resulting in controlled flight into terrain/sea/obstacles or a mid-air collision.

1.1 Helicopter Handling Characteristics

The inherent instability of the helicopter is a major factor in such accidents. For small un-stabilised helicopters, it is the pilot who has to provide the stability and he needs visual cues to do so.

1.2 Pilot Capabilities

Whilst most pilots receive limited basic training in ‘flight with sole reference to instruments’, the competence in this skill can deteriorate rapidly and therefore cannot always be relied upon to safely extricate the unprepared pilot from an inadvertent instrument meteorological conditions situation.

1.3 Visual Cues

Evidence shows that for a significant number of fatal accidents the primary causal factor was degraded visual cues. Common factors, which act to degrade the available visual cues, include:

a. Low levels of ambient light leading to a general reduction in the quality of the visual scene and the available optical cues, e.g. at dusk/night.

b. Reduced visual range and/or loss of sight of the ground/surface of the sea due to the effects of fog or cloud.

c. The presence of atmospheric haze or sun glare.

d. A lack of surface texture or features such as buildings, roads and rivers, or lack of street lighting etc. when flying at night.

e. A lack of texture on the surface of the sea/water, i.e. calm water.

f. Poorly delineated sloping or rising ground contours i.e. snowfields.

g. Misleading cues such as a false horizon from, for example, a distant row of street/road lights.

h. Obscuration due to precipitation or misting on the cockpit windows.

1.4 Risk Analysis

When planning a visual reference flight 'with the surface in sight', there are a number of obvious risk factors which should be taken into consideration prior to take-off:

a. The aircraft is certificated for visual flight rules/visual meteorological conditions flight only.

b. The pilot is not trained/current for instrument flight operations.

c. The pilot is not trained/current in recoveries from unusual attitudes.

d. The navigation will be by map and visual reference, perhaps with GPS backup.

e. The flight is planned to take place at a height at which the surface cannot be clearly defined.

f. A segment of the route involves over-flight of a rural, unpopulated area or large featureless areas such as water, snow etc.

g. The flight is at night or in conditions of atmospheric 'gloom'.

h. Flight at night when there is no moon, or the stars and moon are obscured.

i. There are, or are likely to be, significant layers of low level cloud en-route (4/8 – 8/8).

j. The visibility is, or is likely to be, limited en-route, i.e. visual range at or close to the minimum required for conducting a safe flight,(which may be significantly higher than the stated state minima).

k. There is a significant probability of encountering mist/fog/haze en-route.

l. There is a significant probability of encountering precipitation en-route.

If these risk factors are considered as a risk assessment checklist, it can be seen that the magnitude of risk increases with the number of risks 'ticked'. For example:

• If risks 1 to 4 were to be ticked, this would only pose a normal, acceptable level of risk provided that the flight were to be undertaken in good visual meteorological conditions.
• If risks 1 to 9 are ticked, experience indicates that the flight should not be undertaken.
• Risks 7 to 12 all add to the type of conditions that would make it extremely unlikely that a pilot would be able to maintain control of the aircraft’s attitude by visual references alone.

http://www.aeronauticalsafety.com/Download/05%20-%20Leaflets/HE%207%20Techniques%20for%20Helicopter%20Operations%20in%20Hilly%20and%20 Mountainous%20Terrain.pdfaccessed 14 November 2017

European Helicopter Safety Team, HE7 Training Leaflet EH7, EASA, Cologne, undated.

When a helicopter is generating rotor thrust or lift, there will be some recirculation of air around the end of the blades or rotor disc (the ‘rotor disc’ is the area enclosed within the circle described by the rotor blade tips). The recirculation is most pronounced at high power and low airspeed, as in a hover, and reduces as the helicopter moves forward. Vortex ring state occurs when the tip vortex becomes more energised and a secondary inner vortex is established towards the centre of the rotor disc because the rate of descent exceeds the induced downward flow (see Figures 11 and 12).

The onset of vortex ring state can be sudden, resulting in the helicopter descending at a very high rate. Any increase in rotor thrust in an attempt to reduce the high rate of descent energises the vortices further and increases the rate of descent. Rates of descent of more than 3,000 feet (914 m) per minute are not unusual. A National Transportation Safety Board report into an AS350-B2 accident cited rates of descent between 4,000 feet (1220 m) and 6,000 feet (1829 m) per minute (National Transportation Safety Board, 2001). This is significantly faster than the 1,500 to 2,000 feet (457 to 610 m) per minute rate experienced in an autorotation following a total power loss.

The conditions required for the formation of vortex ring state are very limited. The helicopter needs to be under power to generate the downwash that initiates the tip vortices, and be descending in its own downwash to energise the vortices and help establish vortex ring state over the full disc. The helicopter therefore needs to be slow and descending.

Airspeeds of 10 knots (19 km per hour) or less and a rate of descent of more than 300 feet (90 m) per minute or more may be required to initiate vortex ring state. A steep downwind approach is often cited as a situation where power, low airspeed and a moderately high rate of descent can combine to create vortex ring state. Flying in up-draughting air may reduce the rate of descent required to induce vortex ring state.

To exit vortex ring state, the direction of the airflow through and around the rotor disc needs to be changed. The traditional method has been to increase forward airspeed to move clear of the downwash, or to enter autorotation, which stops the air being accelerated down through the disc (another technique, the ‘Vuichard Recovery’, is now promoted. This involves the use of cyclic to clear the downwash laterally). Both actions result in a significant height loss. All helicopter pilots are taught about vortex ring state and how to recover from it during their training.

1. The CAA describes Sector Risk Profiles as follows (CAA, 2018):

   A Sector Risk Profile is a way of examining the various underlying influences on safety within a given sector. By breaking the overall risk into specific risk statements, attention can be focused onto specific problems. For example, ‘reducing landing accidents’ is more easily addressed than simply ‘reducing accidents’.

   An important aspect of sector risk profiling is understanding that the participants within a sector are well placed to evaluate the risks they face. Accordingly the sector risk profiling method is based around capturing the knowledge, experience, and perceptions of as many participants as possible from within the sector. The resulting mix of fact and opinion is combined with evidential data, such as industry studies and demographics, and expressed as a set of risk statements that describe both the risk and the severity of its influence on safety.

   The ranking of risks in the sector of interest is what makes it a sector risk profile.

   Sector risk profiles help inform the CAA where to target its actions and resources. However, some areas of risk may be beyond the effective influence of the CAA. Some operational practices may carry risks that are highly dependent upon the actions of individual participants, organisations, or industry groups.

   The greatest value of a sector risk profile is derived when participants read the statements, decide which ones apply to their organisation and then determine what they can do to minimise that risk.

2. Without ignoring the diversity of factors in the helicopter and small aeroplanes sector of the industry – such as operator size, location and activities – the project identified the following key risk themes:

• training and pilot experience
• organisational environment and culture
• sector safety culture and collaboration
• institutional clients and their role in safety leadership
• the regulator (CAA) and its practice.

1. Brief, selected comments made for each theme included the following:

• training and pilot experience
  • the normal training pipeline does not in itself prepare pilots for Part 135 operations. Operators must have resources necessary to continue to develop pilots
  • some operators do not provide operational and recurrent training, or training in human factors and decision-making
  • there is a shortage of experienced instructors
• organisational environment and culture
  • experienced pilots feel younger pilots are not aware of, or don’t communicate, their limitations.
  • some larger operators have structures/cultures that hinder communication.
  • there is pressure to fly, especially in the peak season, which is a combination of commercial pressure, organisational culture and personal attitudes. However, in most cases pilots were not pressured to fly in adverse weather.

• sector safety culture and collaboration

  • the influence of user groups is not fully utilised

• regulator and its practice

  • there is a view that the CAA is overly focused on rule compliance and neglects operation, safety management and culture aspects
  • auditors lack operational experience and are focused on box ticking
  • there is inconsistency across auditors with too little feedback to operators.

1. The report commented that “directly relevant to the cockpit and in-flight context and the decisions made are the pilot’s experience and attitude, the company culture and communication, and management’s focus on supporting pilots and developing the right attitude.”
2. The full report is at http://www.caa.govt.nz/assets/legacy/Safety_Reports/srp_part_135.pdf