AO-2018-005 MD Helicopters 600N, ZK-ILD Engine control malfunction and forced landing, Ngamatea Station, 14 June 2018

What happened

1. On 14 June 2018, a visual survey flight over Ngamatea Station was being conducted by a pilot with four additional occupants on board an MD Helicopters 600N helicopter.
2. During the survey flight the helicopter’s electronic engine control unit detected and recorded a number of faults, resulting in the ‘full authority digital engine control’ system changing to ‘fuel flow fixed’ mode. The fuel flow fixed mode resulted in the rotor speed varying beyond normal operating parameters. The pilot was not able to control the varying rotor speed and a forced landing ensued.
3. The helicopter struck the ground hard and remained upright, while the engine continued to produce high power. This, combined with an imbalance in the rotor system from the ground impact damage, resulted in a severe shaking of the airframe, which destroyed the helicopter.
4. One occupant seated in the front-left position received fatal injuries. The pilot and one other occupant received serious injuries; the remaining two occupants seated in the centre of the cabin received minor injuries.

Why it happened

1. The Transport Accident Investigation Commission (Commission) found that the automatic governing of the engine power failed due to an undetermined intermittent fault. This fault had previously occurred but had not been rectified, likely due to its intermittent nature. The full authority digital engine control system was not switched to manual mode, which would have allowed the pilot to control the engine power. This was likely influenced by the pilot’s misunderstanding of manual mode and emergency procedures. The pilot’s misunderstandings were likely due to the local training provided in respect of the engine control system.
2. The Commission found that local training for the pilot’s type rating did not include an in-flight demonstration of the actions to be taken in the event of an engine control unit failure. This was likely due to the perceived risks associated with this particular procedure. This likely contributed to the pilot’s reluctance to select the engine control system’s manual mode in flight.
3. In addition, the Commission found that the pilot and occupants were not wearing helmets throughout the accident flight, likely due to the operator not having a formal policy on the wearing of helmets.

What we can learn

1. It is well publicised (refer to Emergency Procedures Training, Federal Aviation Administration Safety Team (FAASTeam [see faasafety.gov]) (see citations)) that with the right training and preparation pilots can be ready for any unexpected situation that arises. Instructors can make better decisions when appropriate information for conducting training exercises is available. When this information is unavailable, misconceptions about the risks involved may prevail. The Commission found that a lack of awareness of the risks associated with in-flight demonstrations of engine control unit failures during training was a safety issue. Therefore, the Commission recommended that the Director of Civil Aviation publish an educational article raising awareness of the importance of pilot type training being sufficiently comprehensive to mitigate any risks presented by particular helicopter characteristics.
2. There are well documented benefits for aircraft pilots and occupants wearing appropriate helmets, when practicable and when operational conditions indicate potential benefits (p.g. 89, ROPWG (Rotorcraft Occupant Protection Working Group)). The Commission identified a safety issue in the operator’s lack of a formal policy related to the wearing of helmets. Since the accident the operator has implemented a policy for its pilots to wear helmets on all flights. The Commission believes a recommendation made to the Director of Civil Aviation to promote educational awareness of the benefits of aircraft pilots and occupants wearing appropriate helmets, when practicable and when operational conditions indicate a potential benefit, is warranted.
3. A key lesson of this inquiry was that a pilot’s technical knowledge and understanding of aircraft systems is essential to their interpretation of and response to malfunctions.

Who may benefit

1. Operators, flight instructors, pilots and aircraft occupants may all benefit from the lessons of this inquiry.

Narrative

1. On 14 June 2018, the pilot of an MD Helicopters 600N helicopter, registered ZK-ILD (the helicopter), was tasked with transporting personnel for the purposes of conducting an aerial visual survey of farmland at Ngamatea Station.
2. At about 0742 the helicopter departed from Ongaonga with the pilot and an occupant (who was another company pilot but not rated on this helicopter type) on board. The helicopter arrived at Ngamatea Station about 20 minutes later to pick up three more occupants to participate in the visual survey.
3. While on the ground, the pilot conducted a safety briefing and removed the front-left door. However, the safety briefing was most likely insufficient to fulfil all the elements required under Civil Aviation Rules Part 91.211.
4. The original front-seat occupant relocated to the rear-right seat. The Ngamatea Station manager sat in the front-left side next to the pilot. The other two occupants sat in the centre seats. The helicopter, with the pilot and four occupants on board, departed at about 0817 to begin the visual survey.
5. Approximately 24 minutes after departure and while descending at about 300 feet (91 metres) (Civil Aviation Rule 91.311 provides scope for flight below 500 feet (152 metres) above ground level if certain conditions are met and there is a bona fide reason for the lower height) above ground level, the pilot informed the occupants by intercom of a problem with the helicopter. The pilot continued to fly on a relatively straight flight path for about another 1,300 metres, before turning the helicopter to the left and descending to land. The pilot did not inform the occupants that they were about to land.
6. The helicopter struck the ground heavily in an upright orientation. The helicopter became airborne again and rotated about 90 degrees to the right before it hit the ground again. The helicopter began to shake violently. Two of the occupants estimated that this shaking continued for approximately 30 seconds.
7. The pilot and occupant seated in the front of the helicopter received severe head injuries and were unconscious when it came to rest. The pilot had no recollection of the accident flight, and the occupant in the front of the helicopter died in hospital the following day. The other company pilot seated in the rear-right seat of the helicopter also received severe head injuries, but later was able to recall the accident flight.
8. The two occupants seated in the centre seats reported remaining conscious throughout the accident sequence and received minor injuries. After the accident sequence they vacated the helicopter, observed a fire in the engine compartment and subsequently removed the other occupants from the helicopter. They then extinguished the fire with a hand-held fire extinguisher.

1. The emergency locator transmitter on board the helicopter had activated automatically and began transmitting a distress signal. The Cospas-Sarsat network received and forwarded the signal to Rescue Coordination Centre New Zealand at 0846.
2. The Rescue Coordination Centre dispatched a rescue helicopter and crew to the accident site. It also phoned the operator (Helicopters Hawkes Bay Limited) and advised it of the distress signal. The operator mobilised another helicopter, which arrived at the accident site at 0952, just before the rescue helicopter. After an initial site assessment by the rescue helicopter crew, two additional rescue helicopters with medical crews were dispatched to assist with treating the injured and transporting them to nearby hospitals.

Site and wreckage examination

1. The accident occurred over undulating, tussock-covered ground. The main wreckage, which comprised the helicopter cabin and engine, came to rest next to a small creek.
2. Ground impact scars made by the landing gear were situated 10 metres before the main wreckage. Fragments of the composite tail boom material were scattered in a direction consistent with the main rotor blade contacting the tail boom at the initial point of impact.
3. The tail section, which included the NOTAR®tail cone, both horizontal stabilisers and both vertical stabilisers came to rest in the creek.
4. The helicopter cabin structure was damaged. The front-right side of the canopy was severed by the main rotor blades. All rear cabin doors and the engine compartment doors remained attached to the helicopter.
5. There was fire damage to the airframe structure on the right side above the engine compartment.
6. The left landing gear cross tubes splayed outward from the ground impact. A seat cushion was found trapped directly underneath the left skid tube.
7. The main rotor head and driveshaft, with three main rotor blades still attached, came to rest to the left of the main cabin structure. Two other main rotor blades were in the creek nearby and the remaining rotor blade was located in front of the helicopter.
8. The main rotor transmission and its associated supporting airframe structure were propelled approximately 30 metres from the main wreckage.

Personnel information

1. The pilot held a commercial pilot licence at the time of the accident and a current medical certificate. The pilot was type rated for the MD 600N, with 45 hours on type and 9,659 hours total helicopter time.
2. The pilot had begun training for the MD 600N helicopter type rating on 13 April 2018, about two months prior to the accident. The type rating had been conducted in the accident helicopter by a suitably licensed flight instructor operating under Civil Aviation Rules Part 61: Pilot Licences and Ratings. The training consisted of 2.3 flight hours of dual instruction, followed by an additional 2.2 flight hours conducted under direct supervision (having an authorised and qualified pilot occupying a crew seat in the helicopter to monitor the flight).
3. The instructor had a total flight time on helicopters of approximately 7,000 hours, with approximately 250 hours logged on the MD 600N. The instructor held a category D instructor rating and ratings for multiple other helicopter types.

Organisational and management information

1. The pilot was also the chief executive of the operator and the senior person responsible for flight and ground operations.
2. The operator held Civil Aviation Rules Part 135: Air Operations Helicopters and Small Aeroplanes and Part 137: Agricultural Aircraft Operations air operating certificates allowing for both commercial helicopter and agricultural operations. The operator was mostly engaged in agricultural operations, in support of local farming and forestry.
3. The helicopter was listed under the operator’s Civil Aviation Rules Part 137 certificate. There was an intention to certify the accident helicopter for Part 135 operations, at the time of the accident (the CAA prosecuted the operator as a result of the accident. One of the charges was on the basis that the operator had two non-essential passengers on board a survey flight being conducted under the operators Part 137 Certificate).
4. The fleet included four helicopters. The accident helicopter had been included in the operator’s fleet four months prior to the accident and was its first and only MD 600N.
5. The operator had a drug and alcohol policy that required testing after an incident. The pilot underwent testing after the accident, and this returned a negative (clear) result.

Aircraft information

1. The MD 600N was an eight-seat helicopter, powered by a single Rolls-Royce 250-C47M turbine engine. It had been type certified by the United States Federal Aviation Administration in May 1997. The New Zealand Civil Aviation Authority (CAA) had issued a type acceptance certificate on 10 October 2003 to permit the helicopter type to operate in New Zealand.
2. The MD 600N used the NOTAR® anti-torque system instead of a conventional tail rotor and had a fully articulated six-blade main rotor system.
3. The MD 600N used conventional helicopter flight controls and had a throttle twistgrip (a handgrip style engine control located on the collective lever used to select cut off, ground idle and flight idle. If the FADEC system is in manual mode, the throttle twistgrip is used to modulate engine and rotor RPM) on the collective lever (one of the flight controls used by a helicopter pilot to 'collectively' adjust the pitch angles of all main rotor blades at the same time to alter the amount of thrust/lift being produced). In addition to the twistgrip, a toggle switch on the collective lever could be used to switch between ECU auto and manual modes.

1. The MD 600N was originally designed to be flown from the front-left seat. Some models, such as the accident helicopter, had been converted to allow single-pilot operations from the front-right seat. This modification removed the left cyclic and pedal controls, but the left-side collective lever could not be removed so remained in place.
2. The accident helicopter was manufactured in 2000 in the United States. The operator had purchased the helicopter and imported it to New Zealand in March 2018. It was one of only two MD 600N helicopters operating in New Zealand at that time.
3. The helicopter had logged 973.7 flight hours. The most recent scheduled maintenance for both the airframe and the engine had been completed on 29 March 2018. The next scheduled maintenance was due at 1,027.1 flight hours or on 29 March 2019, whichever was earlier.
4. After the most recent scheduled maintenance, unscheduled maintenance had been carried out to rectify a defect (refer to paragraph 3.17). These actions were recorded in the maintenance records. No current defects were recorded at the time of the accident.

Loading and performance

1. The all-up weight of the helicopter at the time of the accident was estimated to be 1,752 kilograms, which was within the maximum allowable all-up weight of 1,860 kilograms.
2. The longitudinal-centre-of-gravity position was calculated to be 2,336 millimetres, which was within the allowable window of 2,311-2,464 millimetres.
3. Performance charts for the helicopter indicated there would have been a sufficient power margin available for the intended flight.

Engine control

1. The helicopter was equipped with a ‘full authority digital engine control’ (FADEC) system. A switch on the end of the collective lever allowed the pilot to select between automatic and manual modes. In normal operations the FADEC system would be in auto mode, where the engine power was controlled to maintain a constant rotor speed. The FADEC system also provided automatic engine starting, temperature and over-speed protection, and fault detection. Any FADEC system malfunctions were displayed to the pilot on the cockpit warning panel. Critical cautions and warnings were also linked to an audible message in the pilot’s headset.
2. The FADEC system consisted of two major components: a hydro-mechanical unit (HMU); and an electronic control unit (ECU). The HMU was connected to the ECU via the ‘engine’ wiring harness. A second ‘airframe’ wiring harness connected various airframe sensors and components to the ECU (Figure 7).
3. The HMU was responsible for delivering the required fuel flow to the engine. A metering valve in the HMU was either adjusted mechanically by setting the throttle twistgrip while in manual FADEC mode, or driven by a stepper motor from the ECU when operating in automatic FADEC mode.
4. The ECU had two control channels: a primary channel; and a reversionary governor (part of the ECU that provides degraded engine control, in the event of a primary governor failure). Normally the primary channel would control the fuel flow, but if the FADEC system detected a problem, the reversionary governor would take over control. When the primary channel failed, the FADEC system illuminated three separate amber caution lights to indicate degraded operation. The reversionary governor did not provide the same level of automated engine protection but did provide basic electronic governing of main rotor speed. Both ECU control channels used the same stepper motor in the HMU to adjust the fuel flow.
5. If the FADEC system subsequently detected that both ECU control channels were unable to control the fuel flow, it would illuminate a red warning light indicating ‘ECU Fail’ and initiate an audible message for the pilot: ‘Fuel Flow Fixed’ (a fuel flow fixed mode is a FADEC system fail-safe mode in which, in the event of an engine control unit failure, the quantity of fuel being delivered to the engine is fixed at a constant rate until the pilot switches to ‘manual’ mode). The stepper motor would hold in the current position to maintain the engine running.
6. The FADEC system would remain in this state of failure with a fuel flow fixed setting until the pilot selected manual FADEC mode using the dedicated switch on the collective lever and took over control with the twistgrip on the throttle. There would be a short delay after the FADEC system was switched to manual mode before manual control was affected.
7. In fuel flow fixed mode, the engine power remained constant. Increasing the collective (a flight control located on a pilot's left side that alters the collective pitch of the main rotor blades, and therefore the rotor thrust generated) would result in a rotor RPM (revolutions per minute) decrease and decreasing the collective would result in a rotor RPM increase. If the FADEC system were not switched to manual mode, a manipulation of the throttle twistgrip would have no effect other than when twisted to the fuel 'cut-off' position.

1. The ECU recorded data for retrieval when an exceedance or fault was detected, for a period extending from approximately 10 seconds before the exceedance until 50 seconds thereafter. A list of the 30 most recently detected faults was also recorded.

FADEC malfunctions

1. Were the ECU's primary channel to fail and affect the FADEC system, the MD 600N rotorcraft flight manual emergency and malfunction procedures stated:
   • Avoid aggressive manoeuvres.
   • Avoid rapid power changes.
   • Do not conduct emergency procedures training.
   • Land as soon as practical (land as soon as possible in an open area where a safe landing can be conducted).
   • Advise maintenance.
2. If the ECU’s reversionary governor also failed, the MD 600N rotorcraft flight manual emergency and malfunction procedures stated:

• Do not change power setting.
• Reset ECU by momentarily placing the auto/manual switch to MANUAL and then back to AUTO (2 reset attempts allowed).
• Auto/manual switch to MANUAL at pilot’s discretion.
• Twistgrip: immediately reduce a given amount based on power setting.
• Twistgrip manually control Np/Nr at 100%.
• Land as soon as practical.
• Advise maintenance.

Meteorological information

1. A weather station located 29 kilometres west of the accident site recorded a light and variable wind of two to three knots (a measurement of speed, in nautical miles per hour, equivalent to 1.85 kilometres per hour) from the south east, and a temperature of five degrees Celsius.
2. Photographs and video taken by the occupants showed that the weather was good in the immediate area at the time of the accident.
3. The pilot of the first emergency response helicopter to arrive at the scene estimated the wind to be approximately 10 knots from the west and reported that the conditions were clear at the time.

Recorded data

1. Electronic devices including mobile phones were recovered and their recorded data analysed as part of the accident investigation.
2. One of the occupants seated in the middle of the cabin filmed segments of the flight with a mobile phone. The final video segment, which was three minutes and 23 seconds in duration, ended approximately 40 seconds and 400 metres before the first ground strike.
3. The videos and associated audio information were analysed, and the final video segment provided information about the groundspeed and height of the helicopter above the ground, the ground track, and the helicopter engine and rotor speeds in the lead-up to the accident.
4. The helicopter was equipped with a satellite-based flight-tracking device. This was configured to transmit the helicopter’s position, height, groundspeed and direction of travel every two minutes.

Survival aspects

1. The airframe structure remained upright, and the rear cabin area remained generally intact throughout the accident sequence, providing some protection for the rear occupants and allowing them to exit the helicopter quickly.
2. Four-point seat harnesses secured all the occupants.
3. The front two seats had an energy-attenuating structure, intended to deform and absorb vertical impact forces. The left seat base partially deformed while the right side remained intact.
4. The left-side skid assembly splayed outboard while the right-side assembly remained relatively straight, indicating that higher forces were experienced on the left side.
5. None of the occupants was wearing a helmet. The pilot later reported usually wearing a helmet while flying but was not able to recall why one had not been worn on the accident flight. Other pilots employed by the operator advised that pilots wore helmets on agricultural spraying operations, but not normally while conducting passenger flights (the operator had a range of helicopters, some were certified under Civil Aviation Rule Part 135 to carry passengers). There was no written policy to this effect in the operator’s documentation.

Tests and research

1. The ECU data was downloaded by a Rolls Royce advisor appointed by the National Transport Safety Board’s (NTSB’s) Accredited Representative (the Commission follows the International Civil Aviation Organization Annex 13 Accredited Representative procedures in the conduct of its inquiries). The ECU data contained operational and fault records for the accident flight and previous flights. The download was carried out at the Transport Accident Investigation Commission’s (the Commission’s) premises and the data was analysed with the assistance of engineers from both Rolls-Royce and the manufacturer of the ECU.
2. The ECU and HMU were also sent to their manufacturers in the United States for inspection and testing. This process was carried out while being observed by the NTSB and Rolls-Royce representatives.
3. The ECU and HMU were subjected to routine acceptance test procedures. The ECU was tested extensively, but the tests were unable to recreate the faults recorded on the accident flight. The ECU was installed on simulation equipment to test the correct activation of caution and warning lights (depending on the severity of the malfunction, warning lights were red and caution lights were yellow). It performed correctly without any faults.
4. Tests and inspections were also carried out of the main wiring harnesses by a licensed aircraft maintenance engineer (LAME) with an avionics rating. Although some external tooling damage was observed on the connector between the ECU and the airframe wiring harness, no faults were identified with the functionality of either wiring harness.

Introduction

1. During a visual survey flight over Ngamatea Station, the pilot experienced an engine control problem and as a result conducted a forced landing. The helicopter struck the ground heavily and the main rotor blades struck the tail boom. The helicopter became airborne again before settling on the ground. While on the ground, the helicopter shook violently due to the now out-of-balance, damaged rotor system being driven at high power by the engine. As a result, the helicopter broke up and parts were propelled some distance from the main wreckage. The pilot and two occupants received severe head injuries and became unconscious. One of those occupants died in hospital the following day.
2. The following section analyses the circumstances surrounding the occurrence to identify those factors, which increased the severity of its outcome. It also examines any safety issues, which have the potential to adversely affect future operations.

What happened

1. The data records from the FADEC system showed that approximately 17 minutes after commencing the survey flight, the ECU primary channel failed. The ECU reverted to the reversionary governor and continued to provide automatic engine governing for a further eight minutes before it also failed. The FADEC system subsequently reverted to fuel flow fixed mode and remained in that mode for another 68 seconds until after the helicopter struck the ground.

ECU failure

1. The ECU primary channel compared fuel-flow measurements from two different sources within the HMU. The ECU data showed that during the accident flight the difference between these two measurements exceeded a predefined value. This discrepancy caused the primary channel to declare a ‘step count fault’ (a fault relating to the incremental positioning of a stepper motor) and then fail, at which point the FADEC system changed to the reversionary governor mode.
2. The reversionary governor measured the rate of engine speed change using two sets of measurements. About seven minutes and 55 seconds after taking control, the difference between these two measured values exceeded limits, resulting in the reversionary governor also failing.
3. With both the ECU’s primary channel and the reversionary governor having failed, the FADEC system reverted to fuel flow fixed mode, as designed.
4. The pilot needed to select manual, using the auto/manual switch on the collective to be able to control the main rotor speed, with the FADEC system in fuel flow fixed mode. The recorded ECU data showed that the auto/manual switch on the collective lever was not selected to manual at any stage during the accident flight.

Ground strike and subsequent injuries

1. One of the occupants described the initial ground strike as “not overly substantial”. This observation was supported by the energy-absorbing seat bases only partially collapsing. The occupants survived the initial impact. However, the ground strike had likely resulted in the rotor system becoming imbalanced due to the rotor blades striking the tail boom.
2. The ECU data showed that the FADEC system remained in fuel flow fixed mode until approximately five seconds after the initial ground strike, at which point the ECU experienced an electrical power interruption. This power interruption caused the FADEC system to revert to manual mode. The position of the throttle at that time resulted in a rapid increase in fuel flow and consequently high engine and rotor speeds. The engine power turbine subsequently burst from an over-speed approximately two seconds later.
3. The high rotor speed and imbalanced rotor system likely resulted in the destruction of the helicopter and the severe post-impact injuries. The two occupants seated in the middle row of the cabin estimated that the entire ground shaking sequence lasted for about 30 seconds.
4. The engine could have been shut down by moving the throttle twistgrip completely to the cut-off position or by pulling the fuel shut-off valve located on the left side of the console. However, the fuel shut-off valve was found in the open position and the recorded ECU data showed the throttle remained open. It could not be positively determined why the pilot did not shut down the engine post the helicopter striking the terrain. It is as likely as not that the severe vibration created by the imbalanced rotor system, may have hindered the pilot actions.

5. The engine suffered a catastrophic overspeed after the helicopter struck the terrain, resulting in an uncontained failure of the power turbine. Parts of the power turbine disc and blades were ejected through the side of the engine and associated airframe structure. This resulted in combustion section flame escaping from the engine and causing localised burning of the surrounding external airframe structure. Source of FADEC system faults:

   The manufacturer of the ECU and HMU analysed the recorded data and advised that the initial step count fault and the reversionary governor fault were “indirectly related, in that both indicated a problem controlling the one stepper motor”.

6. During the post-accident testing of the FADEC system components, the HMU (which included the stepper motor) underwent multiple tests in an attempt to recreate the faults that were recorded on the accident flight. These faults could not be recreated and the reason for the recorded faults could not be identified.
7. At the time of the accident the helicopter was compliant with all required airframe and engine Service Bulletins (SBs). There was one engine SB (Rolls-Royce CEB 73-6063 (Triumph SB73-12)) relating to the ECU reversionary governor, that was due for compliance with the SBs instructions at the next removal of the ECU from the helicopter engine for any reason.
8. The SB requirement did not make the ECU unserviceable for continued operation. The post-accident testing of the ECU did not replicate any of the data fault codes associated with the fault the ECU SB was aimed at addressing.

Previous FADEC system faults with the accident helicopter

1. The ECU data showed that the primary channel had failed on two prior occasions since the operator had acquired the helicopter. In the first instance the primary channel had failed, the reversionary governor had not taken control and the engine had transitioned directly to fuel flow fixed mode. In the second instance the primary channel had failed, and the reversionary governor had taken over control and continued to operate until it also failed. The helicopter’s maintenance records contained no entries of any diagnostic or corrective maintenance associated with these earlier two faults. The Commission sought to understand the fault diagnosis process and the circumstances surrounding the faults.
2. The ECU data also recorded three collective potentiometer (a device that measures the position of the collective lever and provides that information to the ECU to assist with computing power requirements) faults. A collective potentiometer fault had degraded the ECU’s governing ability but had not resulted in the primary channel failing. The pilot in command recalled being alerted to these potentiometer faults by the illumination of a caution light, and had subsequently landed and called the LAME. All three occurrences of the potentiometer faults and associated corrective actions had been documented in the helicopter’s maintenance records. The engine manufacturer advised that they had not been related to the step count faults.

Fault diagnosis process

1. When a helicopter is electrically powered up, the ECU conducts a self-test. If the ECU detects a fault at that time, it illuminates a caution light in the cockpit. The LAME can then interrogate the ECU using a computerised maintenance tool to identify the fault.

2. The LAME did not have access to a computerised maintenance tool, and therefore used the flashing light method to diagnose FADEC system faults. This required the LAME to observe a sequence of flashing caution lights. The LAME then had to compare the sequence of flashing lights to a list of faults in the maintenance manual.
3. Only the current and ‘last engine run’ (the engine run immediately prior to the engine run for which the fault diagnosis is being conducted) faults could be displayed using the flashing light method. This method also relied on the position of the throttle twistgrip. If the twistgrip were positioned to cut-off, both current and last-engine-run faults were presented; if the throttle were positioned to ‘ground idle’ (a low engine and rotor speed state at which the helicopter cannot take off), only current faults were presented.
4. The discrepancy in fuel flow rates that initiated the step count faults could not have been a current fault without the engine running. Therefore, when the ECU powered up, the fault could only have been recorded as a last-engine-run fault and would have resulted in the caution light illuminating only if the twistgrip were positioned at cut-off.

First recorded primary channel failure

1. During interviews, the LAME and the pilot both recalled an incident while carrying out one of the first ground runs of the helicopter after its initial reassembly in New Zealand.
2. The helicopter engine had been started using an external electrical power source. After start-up and with the engine stabilised at ground idle, the aircraft had been switched to its own electrical power source and the ground power had been removed. At that time the engine had momentarily shut down before automatically relighting. The shutdown and relight process had lasted less than a second and resulted in some aircraft instrumentation being reset.
3. The engine had then been advanced to flight idle, where the engine and rotor RPM were both at the normal flight speed of 100%. The LAME had then carried out the intended checks.
4. After the checks had been completed, the pilot commenced the shutdown procedure by returning the throttle twistgrip to the ground idle position; however, the engine had remained at flight idle. The LAME and the pilot had collectively referred to the flight manual, after which they decided to switch the engine control to manual mode. The pilot had adjusted the twistgrip and moved the auto/manual switch to the manual position, after which the engine had quickly accelerated. The pilot had reduced the throttle twistgrip to stop the engine acceleration before any limitations were exceeded, then continued to shut down the engine.
5. Neither the pilot nor the LAME recalled any caution or warning lights illuminating while the engine was at flight idle (With the engine running in fuel flow fixed mode, the flight manual specified that the “ECU FAIL” warning light would be illuminated). The LAME recalled that the three FADEC caution lights had been illuminated after the engine was reduced to ground idle.
6. After the engine had been shut down, the LAME had interrogated the ECU fault records by utilising the flashing light method. Three faults had been presented at that time, of which one was a step count fault (the LAME recalled that one of the other faults was a temperature exceedance, but they could not remember what the third fault was. The LAME attributed both faults to the momentary engine shutdown and resetting of the electronic instrumentation).
7. The LAME had discussed this incident and the fault codes that had been presented with the chief engineer and the pilot. The LAME had then reviewed the fault codes by utilising the flashing light method once more. At that time the fault codes had no longer presented.

8. The chief engineer had emailed the helicopter manufacturer seeking more information on the uncommanded shutdown when the ground power was removed. The response from the manufacturer had advised

   Basically put, it is normal. The flameout occurs due to the split-second between power sources when moving the switch. The Permanent Magnet Alternator (PMA) on the ECU does not provide power until about 85% N2 so the split second of switching at idle makes the ECU reset

   The flameout should not occur if the start is done on battery power.

9. There was also a note in the normal procedures section of the flight manual providing similar information. That note stated:

   If aircraft electrical power is interrupted at ground idle speed, engine flameout may occur. If flameout occurs return twistgrip to CUTOFF.

10. With the feedback provided by the manufacturer and the fault codes no longer present, the LAME, chief engineer and pilot had reasoned that the engine being locked at flight idle, and the fault codes identified, were connected. The group had believed that these anomalies were a result of the power interruption after starting the engine.
11. The pilot had conducted several subsequent ground runs and no further anomalies or fault codes had been observed for the remainder of the ground run and test flight process. The helicopter had then been released to service.

Second recorded primary channel failure

1. The same fault had been recorded in the ECU data 14 engine hours after the first step count fault. The helicopter’s and the pilot’s logbooks showed that this step count fault had occurred during a day that included two hours of flying time in the helicopter and three separate engine starts.
2. The data showed that, when the fault had been detected, the primary channel had failed and the ECU had transitioned control to the reversionary governor. The reversionary governor had continued to operate for 11 minutes and 28 seconds before it also stopped controlling. The ECU manufacturer had advised that the reversionary governor had likely stopped controlling after the helicopter landed and the engine RPM decreased to ground idle, as the reversionary governor would not have functioned when the engine RPM was below 85%.
3. Neither the pilot nor the LAME had reported being aware of this step count fault occurring, therefore no ECU interrogation or rectification had been carried out and no relevant entries had been made into the helicopter’s maintenance records.
4. The investigation had been unable to determine if the caution light had illuminated and the pilot had not observed it, or if a fault within a common part of the FADEC system had resulted in the light not illuminating.

Continuation of flight with degraded FADEC system

1. Earlier in the accident flight, when the primary channel failed and control transitioned to degraded FADEC system under the reversionary governor, the helicopter was flying over open farmland. Several options for a precautionary landing were available at the time, including a return to the point of departure, which was less than two minutes away. However, the pilot continued toward a more remote area with fewer options for a safe precautionary landing and no practical mode of communication from ground level.

1. None of the occupants recalled any notification from the pilot over the helicopter intercom or any apparent change in the flight during the time when the data showed the degraded FADEC system. The video also showed no unusual movement of the helicopter, or that the pilot had taken any actions related to the recorded FADEC system malfunction.
2. An analysis of the sound in the final segment of the video recording revealed that the speed of the main rotor fluctuated significantly in the final few seconds of the recording.
3. The pilot had no memory of the accident flight and was unable to recall why the flight continued as it did with the reversionary governor in control. The investigation considered the following possibilities:

• the possibility that the FADEC system malfunction was not indicated to the pilot by the caution and warning system
• the possibility that the pilot did not observe the caution and warnings
• the possibility that the pilot observed the caution and warnings and elected to continue the flight.

The possibility that the FADEC system malfunction was not indicated to the pilot by the caution and warning system

1. When the earlier two step count faults caused the primary channel to fail, the pilot had experienced both the reversionary governor and the fuel flow fixed modes. Although the pilot was unable to recall the accident flight, the pilot did remember the first primary channel failure when the FADEC system had reverted to fuel flow fixed mode during the ground run. Neither the pilot nor the LAME had recalled any caution or warning lights illuminating as described in the flight manual.
2. The pilot also reported being unaware of the second primary channel failure. In that instance, when the reversionary governor had taken control, the flight had continued as normal. On the accident flight, when the reversionary governor was in control, the pilot’s actions replicated those of that preceding occurrence by continuing the flight as planned.
3. The ECU was installed on test equipment during the post-accident inspection and testing. During this testing, the caution and warning system functioned correctly.
4. It was not possible to test the components together within the accident airframe after the accident. Therefore, the functioning of the caution and warning system as it was installed within the accident airframe could not be fully determined.
5. A light dimmer switch was also installed on the MD 600N instrument panel. This was a dual-function switch; when rotated left and right it modulated the brightness of the instrument lights. When pushed inward the amber caution lights were dimmed (excluding the red warning lights). The caution lights did not return to bright until electrical power was removed, either by switching power to the helicopter off or by pulling the applicable circuit breaker.
6. Neither the pilot in command nor any other MD 600N pilots interviewed throughout the inquiry were aware of the caution light dimming function. However, it was unlikely that the pilot would have inadvertently pushed the dimmer switch on multiple occasions, coinciding with the ECU faults.

The possibility that the pilot did not observe the caution and warnings

1. Studies on the topic of inattentional blindness have identified that during times of high mental workload, cognitive resources can reach a saturation point and fail to register information that is not subconsciously deemed a priority (Mack, 1998).
2. Inattentional blindness would correspond with a situation where a pilot’s mental workload is high. On the accident flight the reversionary governor took control during a phase of flight coinciding with a comparatively low mental-workload requirement. Therefore, if the caution and warning lights had illuminated it is unlikely that the pilot would have suffered inattentional blindness.
3. Due to the pilot not being able to recall the accident flight, the investigation was unable to determine if the pilot observed any illuminated caution and warning lights.

The possibility that the pilot observed the caution and warnings and elected to continue the flight

1. The FADEC system transitioning to reversionary governor should not on its own jeopardise flight safety. The ECU data showed that the reversionary governor continued to provide automatic governing of power delivery within normal operating parameters.

2. The MD 600N flight manual procedure applicable to the reversionary governor being in control advised pilots to “land as soon as practical”, which was further defined as:

   Extended flight is not recommended. Whether to complete the planned flight is at the discretion of the pilot-in-command.

   However, the nature of the specific problem or malfunction may dictate termination of the flight before reaching the destination (this means landing as soon as possible in an open area where a safe landing can be conducted).

3. On the previous flights, when the ECU had detected the collective potentiometer faults and illuminated the ‘ECU DE-GRADE’ caution light (refer to paragraph 3.17), the pilot elected to return, land the helicopter and contact the LAME for rectification. It is likely that the pilot would have repeated this response and returned to land if they had been presented with and observed the three caution lights indicating that the reversionary governor was in control. There was no reason to suppose that the pilot would have acted differently if presented with other caution lights.

Management of the fuel flow fixed mode

1. Whether or not the fuel flow fixed mode was correctly indicated to or observed by the pilot, the diverging rotor RPM during the final minute of flight would have been apparent to the pilot. The first paragraph in the ‘FADEC Malfunctions’ section of the MD 600N rotorcraft flight manual stated:

   Not all FADEC system failure modes are annunciated to the pilot via the warning/caution indicator panel or voice warning system. Should abnormal rotor/engine control occur without cockpit annunciation, the pilot should take necessary action to avoid exceeding limits. Refer to “Other FADEC Malfunctions” at the end of this paragraph.

• The MD 600N rotorcraft flight manual procedure for ‘Other FADEC Malfunctions’ was essentially the same as for the fuel flow fixed mode:
• Adjust collective as necessary to control rotor RPM
• Auto/Manual switch to MANUAL
• Twistgrip: immediately reduce a given amount based on power setting
• Twistgrip: manually control Np/Nrat 100%
• Land as soon as practical

1. The helicopter was at about 300 feet (91 metres) above ground level and had an airspeed of between 80 and 100 knots when the FADEC system transitioned to fuel flow fixed mode. The engine power output at that time was not enough to maintain a straight and level flight; however, it was sufficient for the helicopter to remain airborne for at least one minute while the helicopter descended. There would have been time for the pilot to select manual mode and reconfigure the helicopter to maintain controlled flight to a suitable landing site. The following were considered as possible factors contributing to why this did not happen:

• the effects of ‘startle’ and ‘surprise’
• the knowledge and understanding of the FADEC system.

The effects of startle and surprise

1. Startle and surprise are normal human reactions to unexpected stimulus (the terms ‘startle’ and ‘surprise’ are often used interchangeably in various academic and technical reports; however, there are distinct differences between the startle reflex and the surprise emotion. The article ‘Startle and Surprise on the Flight Deck: Similarities, Differences, and Prevalence’ (Rivera, Talone, Boesser, Jentsch, & Yeh, 2014) provides a more detailed definition of the two as well as an analysis of their usage in previous occurrence investigation reports). Where the stimulus is appraised as threatening, the activation of the sympathetic nervous system institutes widespread changes in the body. This arousal, which is also associated with the acute stress reaction, is generally known as the fight or flight reaction and has been shown to have significant effects on cognitive and psychomotor processes (Martin, Murray, & Bates).
2. On the accident flight, the engine control reverting to fuel flow fixed mode and the consequences of that would likely have been unexpected. It could not be determined whether such a physiological phenomenon would have affected the pilot’s ability to interpret and respond to the malfunction.

Knowledge and understanding of the FADEC system

1. The nature of the head injury sustained by the pilot meant that two months elapsed before an interview was possible. The pilot had no memory of the accident flight, but was able to recall the earlier training and experiences with the accident helicopter. At the time of that initial interview the pilot did not describe correctly some aspects of the MD 600N FADEC system and the prescribed responses to various malfunctions.
2. The pilot expressed a reluctance to use the manual mode in flight and could not describe its operation correctly.
3. During the earlier ground-running incident (refer to paragraph 3.23), when the pilot had moved the auto/manual switch to the manual position, the throttle had not immediately reduced as required, resulting in the engine quickly accelerating. No limitations had been exceeded, but it is likely that this incident contributed to the pilot’s reluctance to use manual engine control in flight and the misunderstanding of when its use would be appropriate.
4. The pilot had completed a written examination as part of the MD 600N type rating. One question in the examination had asked them to detail the action to be taken with the illumination of the ‘ECU fail’ light (indicating fuel flow fixed mode). The pilot’s written answer had made no mention of the correct actions required involving the auto/manual switch or the use of manual throttle control in the specified situation.
5. The pilot’s answer in this exam had been marked as incorrect and no correction had been annotated on the exam by the instructor. The instructor had completed the required CAA form (CAA form 24061 /21 – ‘Helicopter Competency Demonstration Records’). Under the heading Emergency Procedures – Other, an entry ‘FADEC/ECU’ had been written in and initialled as indicating the pilot had been assessed as competent.
6. There was only a small number of pilots with MD 600N experience in New Zealand. The pilot had been communicating with some of them in an effort to gain knowledge.
7. Two pilots in this group with whom Commission investigators spoke, including the pilot’s instructor, were not aware of the existence of the reversionary governor, and both expressed a reluctance to use the manual mode in the event of a malfunction or during training.
8. The pilot of the accident flight had significantly more experience in flying other light helicopters powered by non-FADEC variants of the RR-250 engine. On the accident flight, while the helicopter was flying in fuel flow fixed mode, the pilot reduced the throttle on the collective twistgrip, as shown by the ECU data. This was the prescribed procedure for a fuel control system malfunction resulting in a high rotor RPM with the non-FADEC RR-250 engine variants.

Pilots’ concern about using manual mode

Safety issue: There was not an appropriate means for pilots to gain experience in matching throttle position and required engine speed when transitioning to FADEC manual mode.

1. A NASA (National Aeronautics and Space Administration) study of airline crew performance found that 85% of “textbook” emergencies (those that crews had trained for) were handled well, while only 7% of “new” emergency situations were handled with the same degree of success (Peterson, 2007).
2. The pilot of the accident helicopter and the two other MD 600N pilots interviewed expressed some concern regarding the use of, and training in, manual mode. This concern was predominantly associated with the risk of over-speeding the engine and rotor (over-speeding the engine and rotor systems can result in damage and requires a specific maintenance inspection after an overspeed event) when transitioning from automatic to manual mode.

3. The MD 600N rotorcraft flight manual procedure advised pilots to:

   Immediately reduce the twistgrip (throttle) a given amount based on power setting.

4. An additional note advised:

   The amount of twistgrip reduction required is based on power setting (torque). Low power settings require a larger reduction to prevent Np/Nr overspeed.

5. However, the flight manual provided no guidance as to how much physical movement of the twistgrip the “given amount” represented. With no reference to a corresponding twistgrip position, when the FADEC system completed the transition to manual mode there was the possibility of the engine and rotor speeds rapidly increasing beyond allowable limits, as occurred in the incident described in paragraph 3.25.

Training requirements and guidance

Safety issue: The helicopter manufacturer did not provide information to assist instructors in training for flying in manual mode.

1. The requirements and guidelines for the issuing of a helicopter type rating are described in CAA documents, including: Civil Aviation Rules Part 61; Advisory Circular 61-10: Pilot Licences and Ratings – Type Ratings; and Demonstration of Competency – Type Rating – Helicopter.
2. For the simulation of emergency procedures training, the Demonstration of Competency guide allowed some discretion to demonstrate ‘knowledge of’ rather than the performance of actual emergency procedures, which was not always practical. There were some emergency procedures for which simulations posed greater risks than the likelihood of the emergencies themselves.
3. Both the pilot and the pilot’s instructor said that in-flight practice on the use of manual throttle was not performed by the pilot during training, due to the perceived risk of over-speeding the engine and rotor.
4. The instructor had spoken about this procedure with the Category A flight instructor who issued the instructor’s type rating in 2003, and the Category A flight instructor had advised that the procedure should not be practised by the pilot. The pilot and the instructor only discussed the procedure for the rating assessment, because of the perceived risk.
5. The ‘emergency procedures’ section of the CAA standard form CAA 24061/21, Helicopter Competency Demonstration Record, completed by the instructor during the pilot’s type rating, had a handwritten entry ‘FADEC/ECU’, and the competency demonstration column had been signed by the instructor. This record had been sent to the CAA after the rating was issued.
6. The helicopter manufacturer advised the Commission that a procedure existed for training pilots in the use of manual mode. However, this procedure was proprietary information and not available outside the manufacturer’s own training organisation.
7. To assist in training, some other helicopter types are equipped with a throttle position indicator. This assists the pilot to more accurately select the required throttle setting when conducting emergency procedures training.
8. The manufacturer also advised that it had no record of any accidents or incidents related to the transitioning to, or the use of, manual mode control during training.
9. It was likely that the reluctance of the instructor to practise the use of manual mode in the MD 600N during training was perpetuated by a lack of information and guidance, resulting in a perceived high level of risk.
10. The content of the instructor’s technical examination (refer to paragraph 3.75), completed by the pilot for the type rating, had previously been accepted by the CAA on 20 October 2003. However, the depth of flight training provided to the pilot was at the discretion of the flight instructor.
11. The MD 600N has systems that are technically advanced. The Commission believes this is an example of a helicopter type that likely warranted more emphasis by the instructor on the need to conduct practical demonstrations of the manual fuel control as part of the flight training syllabus.

Use of helmets

Safety issue: The tendency to not wear helmets increased the risk of injury.

1. Neither the pilot nor any of the occupants were wearing helmets on the accident flight. The pilot was unable to recall why this was the case. Other pilots from the operator advised that pilots wore helmets on agricultural spraying operations, but not normally while conducting passenger flights. However, there was no written policy in the operator’s documentation. There was no Civil Aviation Rule to mandate the wearing of helmets.
2. Due to the complex sequence of events that occurred in this accident, the Commission was unable to determine if the use of helmets would have minimised the severity of the injuries received by the pilot and the occupants.

3. A significant amount of research exists on the benefits of aircraft occupants wearing appropriate helmets. MD Helicopters (2019), the CAA (CAA, p.g. 9, 2013), the Transport Safety Board of Canada (TSB 1997 and n.d.) and the United States Federal Aviation Administration, through the Rotorcraft Occupant Protection Working Group (ROPWG, 2018), have all documented the benefits of wearing helmets on board helicopters to prevent head injuries. This is especially so for pilots during occurrence events, when they need to maintain awareness and act quickly. The ROPWG (p.g. 89, 2018) documents the issue well:

   Blunt impact injury to the head has also been identified as one of the most common and severe types of injuries sustained by occupants in survivable helicopter crashes. While numerous studies have documented the effectiveness of helmets in preventing injury in military helicopter crashes and motorcycle and bicycle crashes, flight helmets are unfortunately not as widely used in helicopter flight operations as the ROPWG believes they should be.

4. After the accident the operator implemented a formal policy for its pilots to wear helmets on all flights.

1. An intermittent fault in the ‘full authority digital engine control’ (FADEC) system almost certainly resulted in a loss of automatic governing of the engine power. The source of this fault could not be determined.
2. The intermittent fault had occurred on previous occasions. It was likely that it had not been rectified due to its intermittent nature and the difficulty in performing fault diagnosis using the flashing light method.
3. The pilot did not switch the FADEC system to manual mode. It could not be determined whether the pilot was aware that the FADEC system had failed.
4. A forced landing was carried out without control of the engine power, and the helicopter landed heavily.
5. The occupants’ injuries were very likely the result of the engine continuing to run, after the heavy landing, at high power with a damaged rotor system.
6. The limited local training provided regarding the MD 600N FADEC system likely contributed to the pilot’s misunderstanding of aspects of the FADEC system and emergency procedures. The instructor used discretion when electing not to conduct a practice of switching to manual mode in flight.
7. There was no means for pilots to match throttle position and engine speed when transitioning to the FADEC system’s manual mode. This likely contributed to the pilot’s stated reluctance to select the FADEC system’s manual mode in flight.
8. Information regarding the training procedures of an in-flight ECU failure was not distributed outside the manufacturer’s own training organisation.
9. The pilot and occupants were not wearing helmets throughout the accident flight. The operator did not have a formal policy on the wearing of helmets. 

General

1. Safety issues are an output from the Commission’s analysis of factors that have contributed to the occurrence. They typically describe a system problem that has the potential to adversely affect future operations on a wide scale.
2. Safety issues may be addressed by safety actions taken by a participant, otherwise the Commission may issue a recommendation to address the issue.
3. Recommendations are made to persons or organisations that are considered the most appropriate to address the identified safety issues.
4. In the interests of transport safety, it is important that safety actions are taken, or any recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

Awareness of flight training risk.

1. Helicopters have various levels of complexity, and certain helicopter types present higher risks than others when particular procedures are demonstrated during flight training and assessments. The Commission believes this warrants increased awareness among pilots, instructors and operators of the risks involved in flight training associated with these helicopter types and the need to take steps to mitigate these associated risks.

2. On 27 May 2021 the Commission recommended that the Director of Civil Aviation publish an educational article raising awareness of the importance of pilot type training being sufficiently comprehensive to mitigate any risks presented by particular helicopter characteristics. (004/21)

   On 23 June 2021, the Civil Aviation Authority replied:

   The Authority will accept recommendation 004/21. The Authority agrees with publishing educational articles, such as those published in Vector to raise awareness of the importance of comprehensive pilot type training to mitigate the risks presented by different helicopter characteristics. The Authority will update the Commission when an educational article is published.

   Furthermore, guidance material for helicopter type ratings is contained in Advisory Circular (AC) 61-10. It references a suitable syllabus of training covering normal, abnormal and emergency procedures for each type. On 8 March 2019, the Authority gave greater clarity in Revision 10 of AC 61-10 around the measure that should be referenced in creating training programmes. This was to further assist operators and instructors in developing suitable training programmes.

   This revision directed operators and instructors to the OEM (original equipment manufacturer) and OSD (operational suitability data) training syllabus for complex and Multi engine type ratings. This has been further emphasised in Revision 11 dated 6 June 2021 (still in draft as it's out for consultation) which gives further direction to look at the Federal Aviation Administration Flight Standardization Board reports.

   The OEM, as the manufacturer of the helicopter, offers the best training guidance on the conduct of abnormal and emergency procedures for each of its helicopter types.

   Further development work continues by the Authority with closer liaison with the OEMs. More guidance is required for single-engine helicopters and is under review.

Awareness of the benefits of wearing helmets

1. The benefits of wearing appropriate helmets have been well documented by MD Helicopters and aviation regulators. This is especially so for pilots during occurrence events, when they need to maintain awareness and act quickly. The operator did not have a formal policy on the wearing of helmets, and this exposed the pilot and occupants to the risk of suffering head injuries, when operational conditions indicated there were potential safety benefits in wearing them.
2. Since the accident the operator has implemented a formal policy for its pilots to wear helmets on all flights. The Commission believes it is beneficial for all aircraft operators to have policies on the wearing of helmets. This would provide confidence that the risks relating to head injury are being managed by the aviation industry.

3. On 27 May 2021 the Commission recommended that the Director of Civil Aviation promote education awareness of the benefit of aircraft pilots and occupants wearing appropriate helmets when practicable and when operational conditions indicate a potential benefit. (005/21)

   On 23 June 2021, the Civil Aviation Authority replied, in part:

   The Authority believes that Civil Aviation Part 100 Safety Management and the Health and Safety at Work Act 2015 already sufficiently require operators to consider their risks and whether the use of personal protective equipment (including a flight helmet) is appropriate for use during operations. Specifically, CAR 100.3 requires certificated organisations to implement a process for risk management that identifies hazards to aviation safety, and that evaluates and manages the associated risks. Hazards, incidents, and accidents must be internally reported and analysed, and actions must be taken to prevent recurrence. Likewise, section 30 of HSWA requires the elimination of risks to health and safety, so far as is reasonably practicable; and if it is not reasonably practicable to eliminate risks to health and safety, to minimise those risks so far as is reasonably practicable.

1. A pilot’s technical knowledge and understanding of aircraft systems is essential to their interpretation of and response to malfunctions. Attending an aircraft manufacturer’s endorsed flight training course gives pilots a more consistent and practical experience in understanding helicopter characteristics and their associated malfunctions.
2. Civil Aviation Rules provide the minimum levels of safety. Operators must determine their safety requirements relative to their operations and consider the use of appropriate helmets for aircraft pilots and occupants, when practicable and operational conditions indicate potential benefits.

1. On 14 June 2018 the CAA notified the Commission of an accident involving an MD Helicopters 600N helicopter (MD 600N). The Commission opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
2. On 14 June 2018, in accordance with Annex 13 to the Convention on International Civil Aviation, the Commission notified the state of aircraft and engine manufacture, the NTSB. On 15 June 2018 the NTSB appointed an Accredited Representative for the United States and appointed MD Helicopters and Rolls-Royce as its Technical Advisers.
3. On 15 June 2018 three Commission investigators conducted an examination of the accident site.
4. On 16 June 2018 the wreckage was removed from the accident site. On 18 June 2018 the wreckage was transported to the Commission’s technical facility in Wellington for further detailed examination.
5. Between 16 and 28 June 2018 interviews were conducted with witnesses, the first responders, the operator and the maintainer. Relevant documentation relating to maintenance and the operator was obtained.
6. On 9 and 10 July 2018, an examination of the wreckage was conducted by Commission investigators with Rolls-Royce and MD Helicopters technical advisors present. Additionally, data was downloaded from the helicopter’s engine control system.
7. Commission investigators conducted interviews with other New Zealand-based pilots experienced with the MD 600N helicopter type.
8. On 17 August 2018 Commission investigators interviewed the pilot, who had not been able to be interviewed previously due to injuries received during the accident.

CAA. (2012) The Helicopter Flight Instructor Manual.

CAA. (2013). Flight Helmets are Good Insurance. Vector September / October.

Crowley, J. S. (1992). Flight Helmets: How They Work and Why You Should Wear One. Fort Rucker: United States Army Aeromedical Research Laboratory.

FAA Safety Team (FAASTeam), General Aviation Joint Steering Committee. (2018) Emergency Procedures Training. https://www.faa.gov/news/safety_briefing/2018/media/SE_Topic_18_03.pdf.

Freeman, R. (n.d.). Helicopter Safety Helmets – A Hard S(h)ell. Transport Canada. Mack, A. (1998). Inattentional Blindness. MIT Press.

Martin, W. L., Murray, P. S., & Bates, P. R. (n.d.). Startle, Freeze and Denial: An Analysis of Pathological Pilot Reactions during Unexpected Events. Griffith University, Australia.

M.D. Helicopters. (2019) Operational Safety Notice OSN2019-002.

Peterson, B. D. (2007). Emergency Procedures: Safety Advisor. Operations and Proficiency No.

12. AOPA Air Safety Foundation.

Rivera, J., Talone, A. B., Boesser, C. T., Jentsch, F., & Yeh, M. (2014). Startle and Surprise on the Flight Deck: Similarities, Differences, and Prevalence. Human Factors and Ergonomics Society.

Rotorcraft Occupant Protection Working Group (2018) Final Analysis Report to the Aviation Rulemaking Advisory Committee. https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/ROPW G%20Task%206%20Final%20Report%20Revised%202018-09-27.pdf.

TSB. (1997). Do Helmets Really Save Lives? Vector Issue 4, 1-3.

TSB. (n.d.). Low Usage of Head Protection by Helicopter Pilots. Transportation Safety Board of Canada.