AO-2018-009 MD Helicopters 500D, ZK-HOJ, In-flight breakup, Near Wānaka Aerodrome, 18 October 2018

What happened

1. At 1053 on 18 October 2018, an MD Helicopters MD 500D helicopter registered ZK- HOJ (the helicopter) took off from Wānaka Aerodrome with a pilot and two Department of Conservation workers on board. The flight was part of a Department of Conservation operation to control the wildlife population in national parks.
2. The helicopter had just departed from the perimeter of the aerodrome when it started to break up in flight, began spinning while descending near vertically and caught fire after it struck the ground.
3. None of the three occupants on board survived the accident.

Why it happened

1. The Transport Accident Investigation Commission (the Commission) found that it was very likely that the left-rear door opened unexpectedly in flight and a pair of unsecured overalls exited from the rear cabin and was struck by the tail rotor. That led to the tail rotor assembly breaking off from the tail boom and being propelled forward, then being struck by two of the five main rotor blades. That caused the outer sections of those two adjacent main rotor blades to break off. The tail boom was then struck by a main rotor blade and subsequently failed, resulting in the tail section separating and the helicopter becoming uncontrollable.
2. The Commission found it very likely that the left-rear door opened as a result of observed wear in the left-rear door-latch mechanism and the non-specific door-latch maintenance requirements, and that this door opening initiated the accident sequence. Given the operator’s practice of not using restraints to secure cargo within the cabin of this helicopter, and that items were distributed across the main wreckage site, it is virtually certain that the cargo items had not been properly secured with a seat belt or other restraining device.
3. In the absence of clear requirements to report door-opening events, or an understanding that these events could have adverse consequences, it is likely that the risks associated with them either may not be recognised or will become normalised. This could be detrimental to safety.
4. The Commission also found that ambiguity in the Civil Aviation Rules in the definition of crew and passengers continues to be a source of confusion for pilots and operators.

What we can learn

1. A helicopter door opening in flight presents a significant risk to the helicopter and its occupants. It is important that pilots report all incidents of doors opening unexpectedly in flight.
2. Unsecured items in helicopters can be fatal. Doors opening unexpectedly in flight are a known risk, which is why pilots should ensure all items are appropriately secured.
3. Standard loading plans can save time, but to be safe the conditions specified in the plans must be clear and be met.
4. Aircraft manufacturers should clearly describe how maintenance tasks are to be conducted and what to expect when equipment is performing correctly.
5. Aircraft engineers and general aviation maintenance organisations must ensure maintenance is conducted in accordance with aircraft manufacturers’ approved repair and maintenance procedures.
6. When Civil Aviation Rules are clear and unambiguous, it is more likely that aviation participants will comply with them.
7. Cockpit video recorders, where fitted, can potentially provide valuable information on the causes of accidents and help avoid recurrences.

Safety recommendations

1. In December 2018 the Commission published an interim report with an urgent recommendation that the Director of Civil Aviation remind aviation participants of the importance of incident notifications in accordance with Civil Aviation Rules Part 12 – Accidents, Incidents, and Statistics (035/18).
2. The Commission has in this report made one new recommendation to the Director of Civil Aviation, to address the non-reporting of doors opening in flight, and one new recommendation to the Secretary for Transport that they work with the Civil Aviation Authority to resolve ambiguity in the definition of crew members in commercial transport operations.

Who may benefit

1. Aircraft operators, pilots, maintenance organisations, engineers, aircraft manufacturers, aviation regulators and organisations that engage operators to provide helicopter services may benefit from this report.

Narrative

1. The helicopter involved in the accident was an MD Helicopters Incorporated (At the time of the accident the helicopter manufacturer’s company name was MD Helicopters Incorporated (MDHI). As of 30 March 2022 the company was renamed MD Helicopters (MDH). In this report the helicopter manufacturer is referred to as MDH) MD 500D (The accident helicopter had a Federal Aviation Administration designation of Model 369D, and an MDHI commercial designation of MD 500D, but it was commonly referred to as a Hughes 500D or MD 500D. In this report the helicopter type for all models in the series is expressed as MD 500, and for the accident helicopter as MD 500D) helicopter, registered ZK-HOJ (the helicopter). On 18 October 2018 the helicopter was part of an airborne wildlife-culling operation in the Landsborough River area. The flight was the first for the day. Two Department of Conservation (DOC) workers and their equipment would be flown to a remote staging point, where some of the equipment on board was to be shared with the crew of a second helicopter. Both helicopters would then conduct several flights from the remote staging point, with some of the doors removed to enable the wildlife cull.
2. The Transport Accident Investigation Commission (the Commission) was able to build a picture of the events, in the hanger and on the apron in front of the hanger, leading up to the flight’s departure from images captured on two separate digital camera systems. By 1030 (all times in this report are New Zealand Daylight Time in the 24-hour format) that morning the pilot had moved the helicopter from its hanger to the apron, prepared it for flight, refuelled (The fuel-tank gauge is marked in four graduations representing pounds x 100 to full (435 pounds of fuel). The marks can be easily referenced to the tank volume in percentages of 40 per cent, 50 per cent, 60 per cent, 75 per cent and 100 per cent as used on the standard load sheets) it to 100 per cent and loaded extra aviation fuel in two 20-litre plastic containers into the rear cabin ( In this report, the rear passenger/cargo compartment is called the rear cabin). The two DOC workers arrived with the rest of the items to be carried and by 1045 had loaded them into the rear and front cabin areas.
3. The major items (items as used in this report include cargo and baggage and personal items) packed in the cabin were: four rifles; 4000 rounds of ammunition; a chilly bin with food and drink; recording equipment for the wildlife cull; and two 20- litre plastic containers full of aviation fuel. All three occupants had loaded their cold- weather overalls in the cabin. Two of the rifles were stowed between the front seats and two under the rear seat. Most items were loaded into the rear cabin and stowed on the floor, in front of, or under the left side of the rear bench seat.
4. Camera records showed the DOC workers near their respective doors on the right- hand side of the helicopter and the pilot near the two left-hand side doors just before it departed.
5. At 1053 the helicopter took off from Wānaka Aerodrome with the pilot and the two DOC workers on board. The pilot sat in the front-left seat. One DOC worker sat in the front-right seat and the other sat on the right side of the rear bench seat.
6. The pilot lifted and air-taxied towards the helicopter final approach and take-off area, then made a broadcast radio call to local traffic, advising they were rolling on Runway 11 and would vacate from the downwind leg towards Hāwea. The helicopter followed the runway centreline until it was about 300 feet (91 metres [m]) above the ground. The pilot called the pilot of a Robinson helicopter that was in the circuit to advise them of their intention to conduct an early turnout from the circuit. The pilot of the Robinson helicopter acknowledged the call. The helicopter then turned left and headed out on a northerly track at about 500 feet (152 m) above the aerodrome (see Figure 3 and Appendix 2).

1. Several witnesses at the aerodrome saw the helicopter behaving differently from how they expected. One witness recalled seeing the helicopter descend near vertically, with items trailing behind it. They described the helicopter rotating at various angles. The witnesses lost sight of the helicopter as it descended below the escarpment to the north of the aerodrome.
2. There were two experienced flight instructors in the Robinson helicopter that was in the circuit. They were glancing at the accident helicopter to maintain their separation. One instructor reported seeing items exiting the helicopter towards the tail rotor. Moments later that person saw the tail section bend upwards and separate from the helicopter and the helicopter yaw to the right. The helicopter continued to spin in a flat attitude as it descended, with several items being flung out. After 4-6 seconds it impacted the ground and caught fire.
3. The other instructor saw the helicopter rotating in a low-speed descent with items being ejected from the cabin that looked like confetti. Once the tail fell off, the forward speed reduced to zero and the helicopter fell almost vertically but continued to rotate.
4. The pilot of the Robinson helicopter flew to the accident site. They circled the scene while making a Mayday call and contacting emergency services. They then landed nearby to the southwest. They noted that light debris from the helicopter was still falling from above when they landed.
5. A pilot of a fixed-wing aircraft was arriving to land from the north at the time of the accident. As they were near Albert Town Bridge (to the west of the aerodrome) they noticed a flashing white light near the accident site. They then heard the Mayday call from the Robinson helicopter. They continued to land at Wānaka. They later reflected that the white light that had caught their attention was probably the landing light from the accident helicopter as it was spinning.
6. Other people started to arrive at the scene about five minutes after the Robinson helicopter landed. The aerodrome emergency service vehicle arrived at the scene, closely followed by Police, fire and ambulance services. The fire service and the aerodrome emergency service vehicle crew contained the fire while the Police secured the scene. All three occupants on board the helicopter died in the accident.
7. The accident occurred in daylight at 1055. The accident site was at 892 feet (272 m) above mean sea level and 250 feet (76 m) below the level of the aerodrome.

Personnel information

1. The pilot had started training in helicopters in 2004, had gained a commercial helicopter licence in 2007 and had accumulated approximately 5500 hours’ total helicopter flight time. The pilot also held a private pilot licence for fixed-wing aircraft, in which they had accumulated approximately 314 hours’ experience. The pilot had been rated by the operator and was current for sling loads, agricultural operations (Grade 1) and Civil Aviation Rules (CAR) Part 135 – Air Operations – Helicopters and Small Aeroplanes operations. The pilot’s most recent Part 135 renewal flight test had been conducted about three months before the accident, in July 2018, and was current to 4 October 2019. The pilot had ratings in Robinson R22, Robinson R44, MD 500 and AS350 type helicopters.
2. The pilot had accumulated 1138 hours on the MD 500. In the previous 90 days they had flown 67 hours in all helicopter types; 35 had been in the MD 500.
3. The pilot had been back at work for one week following a 10-day holiday. The workload had varied during the interim week, but had been within the limits of a normal eight-to-five working day. The pilot’s spouse reported the pilot had been sleeping well and was rested.

Aircraft information

1. The helicopter was manufactured in 1979 by Hughes Helicopters, as a Hughes 369D. The helicopter type is also known as a Hughes 500D or MD 500D.
2. The MD 500D is a five-seat helicopter (three front and two rear), turbine powered and constructed primarily of aluminium alloy. The pilot flies from the front left-hand side. The main rotor is a fully articulated five-bladed system that rotates anticlockwise (when viewed from above), with anti-torque provided by a two-bladed, semi-rigid type tail rotor. The tail rotor rotates anti-clockwise when viewed from the left side of the helicopter. Power from the engine is transmitted through the main transmission drive shaft to the main transmission and from there up to the main rotor. A tail rotor drive shaft conveys power from the main transmission to the tail rotor gearbox and the tail rotor.
3. On 15 October 2018 the helicopter’s total time in service had reached 19,496.25 hours. The helicopter had a non-terminating certificate of airworthiness. The most recent 100-hour inspection had been made on 25 June 2018 at 19,430.5 hours.
4. The engine was a turbine Rolls Royce 250-C20B. It had entered service on 13 August 1977 and on 15 October 2018 had logged 18,569.85 hours.
5. The operator had leased the helicopter as a fleet stopgap until two newly purchased helicopters arrived. The lease period had started on 31 August 2018. The lessor specified that pilots had to have a minimum of 2000 hours’ total helicopter flight time, including at least 500 hours on the helicopter type. The operator had approved four commercial pilots (plus one private pilot who worked for the company) to fly it, who had all met the lease requirements.

Meteorological information

1. At the time of the accident the weather was fine with 20 kilometres’ (km) visibility. The MetService weather station at the aerodrome recorded:

• air temperature/dewpoint temperature of 16/08 degrees centigrade
• windspeed of 7 knots (13 km per hour) and variable between 110 and 170 degrees true
• cloud cover of six octas, with bases at 4600 feet (1402 m)
• air pressure (This was the QNH for altimeter pressure setting at the aerodrome, corrected to mean sea level using international standard atmosphere) of 1024 hectopascals.

Aerodrome information

1. Wānaka Aerodrome is unattended (it does not have an air traffic control service) and used by many local operators. The aerodrome operator had a facility to record all radio transmissions on the local traffic frequency and time lapse digital camera images of the apron areas. The records from the day of the accident were made available to the Commission.
2. An emergency vehicle was based at the aerodrome and operated by volunteers. At the time of the accident the aerodrome emergency response unit was conducting a training exercise. It was one of the first emergency response units to attend the accident.
3. The operator’s security system included digital cameras that recorded still images inside the hanger when motion was detected. These records were also provided to the Commission.

Recorded data

1. A Garmin GPSMAP 296 moving map display was installed on the helicopter instrument cluster in view of the pilot. It was ejected from the helicopter during the accident sequence and found undamaged nearby. Data was extracted and used to plot the accident path (see Figure 3). It had been recording plots at 10-second intervals. However, the last plot was not saved, presumably due to a disruption to the device during the accident sequence.
2. The pilot carried an iPhone that was ejected from the helicopter during the accident sequence and recovered undamaged nearby. It had a global positioning system (GPS) flight-tracking application that provided an accurate record of the flight with track plots less than two seconds apart. The iPhone track plots matched the GPSMAP 296 track plots and continued to be recorded through the accident sequence, albeit with increasing position errors after the helicopter started to break up in flight (see Figure3 for a comparison of the GPSMAP 296 and the iPhone flight track).
3. The iPhone track data record indicated a false flight path that continued north of the main wreckage and over the Clutha River. An analysis of the data showed that this apparent flight path was when the iPhone was unable to establish an accurate GPS position and was working on position prediction. When the iPhone hit the ground, the antenna was still shielded from the GPS satellites, and it remained so until it was discovered and picked up by Police. An accurate record was re-established from that point until the iPhone was turned off in the Police evidence tent. The last reliable position recorded by the iPhone on the flight was at 1055:04.
4. The iPhone also had a weight-and-balance calculation application called iBal Rotary. This was normally used by a pilot to check that a helicopter was loaded within limitations. The iBal Rotary application did not have a weight-and-balance record for this flight.
5. The helicopter was fitted with a Spidertracks (an aircraft tracking device made by Spider Tracks Limited, 2020) flight tracker, which provided three- minute position updates during flights to the operator. It yielded little useful information because the flight had only lasted two minutes.

Site and wreckage information

1. The accident site was on a flat, open area next to the Clutha River. The river was fast flowing in the area.
2. The Police initially regarded the accident site as a crime scene, as the operator had received threats associated with its role in the DOC operation. Police secured the area after the fire was extinguished and set up a controlled entrance with an incident control and management base at the perimeter of the accident site.
3. The Commission investigators and Police co-ordinated the site search and recovery of accident debris. Most items of debris were described, photographed, GPS located and allocated reference numbers in the Police evidence register. Smaller items were grouped with nearby items and packaged together. The site was cleared on the third day. The wreckage and associated evidence bags were transported to the Commission’s technical facility in Wellington for further examination. The Police retained personal effects, the rifles and the ammunition.
4. The Commission initially focused on the large and significant items of wreckage. It soon became apparent that some significant items were still missing. Searches continued as the site investigation progressed.
5. The tail rotor gearbox and some missing pieces of the main rotor blade were found in the following days. They were GPS located, photographed and handed to the Commission.
6. Items of wreckage were spread over a wide area. For example, the remnants of acrylic from shattered windshields were found downwind of the impact area (the yellow sector on Figure 5). Other remnants were found much later on the south side of the river (see Figure 4). It is likely that some items fell into the Clutha River. A reconstruction of the helicopter windshields revealed that only about 60 per cent of the acrylic windshields was recovered (see Appendix 5).
7. It became evident early in the site investigation that the helicopter had begun to break up in flight and had been subjected to severe forces as it did so. The ground searches for wreckage were modified accordingly.
8. Parts of the aircraft and items that had been in the cabin were scattered within a 500 m radius from the main wreckage. An overview of the wreckage spread and the location of significant items are shown in Figures 4 and 5.
9. The following is a summary of what the wreckage revealed.

• The helicopter struck the ground in a steep angle, with a slight nose-down attitude while rotating left. The left landing gear skid was embedded approximately 600 millimetres (mm) into the ground under the main fuselage, and the right skid was laid out flat to the right side. The fuselage was facing south, back towards the direction of flight.
• The post-impact fire consumed most of the main helicopter wreckage. This included a large proportion of the engine and transmission housings made of light alloy metal. Ferrous items such as gears, turbines and the compressor housing remained intact.

1. A large part of the tail rotor and gearbox assembly was found approximately 100 m forward (north) of the main wreckage. A section of a main rotor blade tip (about 450 mm in length) was found nearby. Small fragments of the tail rotor gearbox were found between the tail section and the main wreckage. Impact marks on the tail rotor blade and the tail rotor gearbox matched the profile of the leading edge of a main rotor blade.
2. The tail boom had failed where it had been struck by a main rotor. The tail section had separated and landed clear of the main wreckage. It was intact except for the missing tail rotor and gearbox assembly referred to above (see Figure 6).

1. The first heavy items discovered in the wreckage trail included a pair of black, heavy cotton, padded, bib overtrousers (the ‘black overalls’) that had belonged to the pilot. A pair of red, padded overalls that had belonged to a DOC worker, two pieces of the tail rotor blades and the tip of one of the main rotor blades were found near the black overalls.
2. Paint transfer marks on the inside of one leg of the black overalls matched the colour and profile of the tail rotor blades. Also, the paint on one of the tail rotor blades was marked with impressions of a zip and a dome connector matching the zip and domes on the black overalls. The zip had also left impressions along the left side of the tail boom, just aft of the head of the ‘Danger’ arrow (see Figure 7).

1. The tail rotor drive shaft had a twist (see Figure 8), which was consistent with the engine having driven it against a solid resistance at the tail rotor end.
2. Four of the main rotor blades had left strike marks in the ground and were stacked (Where main rotor blades have been driven and stacked up after successively hitting the ground) to one side of the wreck with their leading edges curved backwards from the root to the tip (see Figure 8). The fifth main rotor blade had broken off at the root end about 500 mm out from the attachment pin and was found about 50 m from the main wreckage.

1. The left-rear door was found a short distance to the northwest of the main wreckage. The door had no signs of burn marks on it, indicating it had not been attached to the helicopter at the main wreckage site when the post-impact fire occurred (see Appendix 5 for a picture of the door).
2. Heavy items that had been stowed in the rear cabin were found on the ground away from the main wreckage. These items had been flung out of the rear cabin along a 200 m broad strip back towards the river. They included a chilly bin, five metal ammunition boxes and the two plastic fuel containers.
3. Other items, including personal items, the pilot’s iPhone, two GPS units, rope strops, fragments of acrylic windows, fragments of the tail boom, the major section of the tail rotor drive shaft and the left-rear door were spread over several hundred metres to the left of the flight track. Some paper debris was found across the river several hundred metres to the north of the main wreckage (see Figure 4 for this orientation).
4. The Commission placed a protection order over the area to capture any items found by the public. The river was searched with the assistance of Police after an item was believed to have been spotted in it. Nothing further of any significance was found after seven days. Subsequent rainfall and a higher river level in October 2018 discouraged further searching in the river.

Medical and pathological information

1. The pilot had a current Class 1 medical certificate at the time of the accident. Medical records held by the Civil Aviation Authority of New Zealand (CAA) and reviewed by the Commission’s medical advisor indicated that the pilot had been fit and well with no health problems likely to cause sudden incapacitation.
2. The autopsy report confirmed that toxicology showed no signs of drugs that could have impaired the pilot’s performance.

Organisational information

Alpine Helicopters

1. The Alpine Group Limited, trading as Alpine Helicopters (the operator), had a CAR Part 119 Air Operator Certification for CAR Part 135 Domestic Helicopter operations, accepted by the CAA. The Alpine Group Limited is a family-owned business established in 1963. The operator’s Operations Manual current at the time was Revision 27, dated 4 October 2018.
2. The operator had 17 aircraft listed on its operations specification at the time of the accident. It owned eight of the helicopters: five Eurocopter AS350 (Commonly referred to as a Squirrel and now an Airbus Helicopters H125), two MD 500 and one Guimbal Cabri G2. The other nine helicopters were leased: seven AS350s and two MD 500s. The accident helicopter was one of the leased aircraft.
3. The operator conducted tourist and commercial air transport flights including: aerial surveys; DOC support work; heli-hunting, heli-biking and heli-skiing flights; search and rescue; and firefighting. It was also approved to conduct all aspects of heli-lifting.

Airwork Holdings

1. Airwork Holdings was the owner and lessor of the helicopter involved in the accident. It engaged a separate maintenance controller to keep track of the helicopter’s maintenance and had several approved maintenance organisations to conduct maintenance.

Department of Conservation

1. The accident flight was part of a national wildlife culling programme managed by DOC. DOC is a high user of helicopters and has an internal risk-management system to ensure that its helicopter operations are conducted safely, and that staff involved with helicopter operations are trained and approved for the tasks. The Helicopter safety – Technical document (Helicopter Safety–Technical Document (doc CM-208219) last reviewed 1 March 2016) was its top-level operational safety document for these activities.
2. Key points in the DOC process described in the technical document were that: work had to have a safety plan; a safety briefing had to be carried out before an operation; the helicopter company and pilot had to be qualified and experienced; DOC staff had to be trained and competent; and a flight plan had to have been completed for the day.
3. In another document called Best Practice for Thar Control Aerial Shooting (best practice for Thar Control Aerial Shooting, docCM-5556786, version 0.2, updated 4 September 2018), DOC defined actions and procedures that it considered to be best practice for its operations. These included selecting helicopter contractors and identifying the MD 500 as the preferred helicopter for this task. It explained the roles of DOC workers and that staff were to ensure that all loose items of clothing and equipment were firmly secured so they did not exit a helicopter and hit the rotor blades.
4. As part of its safety-management process, DOC had facilitated refresher training for its staff on thar-control aerial shooting operations. The course had been run two days before the accident, on 16 October 2018. The course had required both helicopters to be used for the aerial shooting operation, and their pilots and six DOC workers (including the two in the accident helicopter). The course had comprised 1.5 hours of ground training on standard operating procedures for: low-level operations; wild animal recovery; sling loads; hover entries and exits; and hazard risk assessments. Topics covered had included: the helicopter door operation; basic helicopter safety; and loading of freight and equipment. It had been followed by a one-hour practical flight assessment.
5. All aspects of the DOC safety management system had been covered. The DOC staff had been signed off as trained and approved before the day of the accident.

McDonnell Douglas Helicopters

1. The Hughes name and association with the 500 series helicopters goes back to the original Hughes Aircraft Company that was founded in 1932, and its helicopter production under the Hughes Tool Company that was established in 1947. The manufacturer’s ownership was transferred several times in the succeeding years while retaining the Hughes name, until it was bought by McDonnell Douglas in 1984.
2. McDonnell Douglas later merged with Boeing, after which the helicopter manufacturing section was sold to an investment company. It was later on-sold to another investment company, which recapitalised it and formed MDHI. On 30 March 2022 the company ownership changed again, and its name became MD Helicopters (MDH).

Introduction

1. The accident occurred shortly after take-off from Wānaka Aerodrome on a fine day and in calm conditions. The operator was experienced in this type of operation, as was the pilot. The helicopter had reached cruising speed and was on a steady course towards its destination when the accident occurred.
2. The type of damage and spread of wreckage were typical of an in-flight breakup. Eyewitness accounts and damage to the tail rotor suggested that the in-flight breakup was initiated by a disruption to the tail rotor by items that had exited the cabin.
3. It is almost certain that the degree of in-flight destruction left the helicopter uncontrollable, upon which it descended rapidly and struck the ground and caught fire.
4. The following section analyses the circumstances of the accident and the contributing safety factors and safety issues. It also discusses other safety factors and safety issues that are considered to have not contributed to the accident, but from which the industry can draw lessons.

What happened

1. GPS data showed that two minutes after leaving Wānaka Aerodrome the helicopter was flying in a shallow, steady climb about 730 feet (222.5 m) above the river basin, at approximately 105 knots (195 km per hour). The wind was light and coming broadly from the right-hand side of the helicopter. The last reliable GPS plot was recorded at 1054:50. The helicopter struck the ground some 15 to 20 seconds later. A voiceless radio transmission was made from the helicopter at 1055, 10 seconds after the last recorded GPS plot.
2. It is not possible to establish with any accuracy exactly when the accident sequence began (witness recollections cannot be measured in seconds), but the Commission considers it likely occurred around the time and location of the last GPS plot (see Figure 3 for this location).
3. Witnesses described seeing items exiting the cabin toward the tail of the helicopter. It was evident from the witness accounts and the spread of the wreckage trail that the path and motion of the helicopter after the initiating event was dynamic and severe. As a result, and despite exhaustive investigation, the Commission was unable to establish with certainty the order in which some events occurred.
4. One of the first items to exit was likely to have been the black overalls. The evidence shows that the two-bladed tail rotor struck the black overalls multiple times. They were slashed and exhibited paint transfer marks from contact with the tail rotor. There were marks on one tail rotor blade that matched the zip on the overalls. There were more zip impressions on the left side of the tail boom just to the rear of the ‘Danger’ arrow. The tail rotor blade exhibiting the zip marks broke off and was found early in the wreckage trail near the black overalls (see Figure 7). It is very likely the black overalls were caught on this tail rotor blade and flailed around until the tail rotor blade broke off.
5. The tail rotor was driven by the engine via a shaft running along the tail boom and through the tail rotor gearbox. The tortional damage to the tail rotor drive shaft was typical of the tail rotor being subjected to a high load while still being driven by the engine. This was very likely a result of loads on the tail rotor caused by the black overalls entangled in it.
6. The tail rotor rotates at approximately 3200 revolutions per minute. The loss of one rotor would have created a substantial imbalance, causing severe vibration and loads on the tail rotor assembly. The tail rotor gearbox had shattered. The remaining tail rotor assembly, including the other tail rotor blade, had separated from the tail section and struck the main rotor disc. This remaining part of the tail rotor assembly bore the marks of two main rotor blade strikes, of which one severed the remaining tail rotor blade (see Figure 9).
7. The impact of the remaining tail rotor assembly with the main rotor disc caused severe damage to two adjacent main rotor blades, including the loss of the outer 500 mm of these main rotor blades. This damage would have unbalanced the main rotor disc and caused severe vibration and extreme motion in the helicopter.
8. The evidence shows that during the event the main rotor blades diverged from their usual plane of rotation. There were witness marks22 where they had struck the top of the tail boom. The tail section subsequently broke off and fell separately to the ground.
9. With the complete loss of the tail section and damage to the main rotor blades, it is almost certain that the helicopter became uncontrollable.

1. The left-rear door was found about 40 m northwest of the main wreckage. It had no signs of burn marks on it, indicating it had separated from the helicopter while in the air. An examination of the door and its attachment indicated it had been removed by force. The two door hinge plates had been riveted to the outer skin of the door, with three rivets each. The door had been pulled away from the hinge plates, ripping the door skin, and one rivet had broken. The door hinges were still attached to the door frame in the cabin.
2. This door too had been struck by a main rotor blade, which cut through its top rear corner above the door handle from the inside face outwards (see Appendix 4 for the door damage and Figure 1 for the orientation of the door and the helicopter). The main rotor blades rotated anticlockwise when viewed from above. The main rotor blade could not physically reach the left-rear door if it was open nor approach the inside surface of the left-rear door from an anticlockwise direction if the door was still attached to the helicopter. Therefore, the left-rear door could only have been struck by a main rotor blade after the door had separated from the helicopter.
3. With the loss of the left-rear door and the extreme motion of the helicopter as it began to spin and break up, the items stowed in the helicopter were thrown clear. They landed separately from the main wreckage, with the lighter items generally floating downwind of the flight path.
4. The last position of the flight controls and throttle settings could not be determined with confidence due to the damage caused by the post-accident fire. A radio transmission was recorded by the aerodrome monitoring system at about the time of the event. An analysis of the background noise during that transmission indicated that it was very likely to have been transmitted from the helicopter. It could have been the pilot’s attempt to issue a distress message, or an inadvertent transmission as the pilot tried to control the helicopter.
5. From the eyewitness accounts, the spread of items from the helicopter in the wreckage trail, and the damage signatures to various items, it is very likely that the in-flight breakup of the helicopter described above was initiated after the left-rear door opened in flight and the unsecured black overalls exited the cabin and were struck by the tail rotor.
6. The following sections discuss what might have caused or contributed to the left-rear door opening in flight. It may have been, that:

• the left-rear door was not secured properly before take-off, and it subsequently opened unexpectedly in flight
• someone opened the left-rear door in flight
• the crew opened some of the cabin air vents, which increased the internal air pressure to an extent that the door-latch mechanism on the left-rear door could not resist the increased loading and the door opened unexpectedly
• unsecured items moved against the door, or the door handle, causing the door to open in flight
• worn components in the left-rear door and the rigging adjustment to the door-latch mechanism allowed the door to open unexpectedly in flight
• the aerodynamic loading on the door-latch mechanism from the door window exceeded the ability of the door-latch mechanism to hold the door closed and allowed it to open unexpectedly in flight
• a windshield failed and pressurised the cabin, placing additional stress on the left-rear door-latch mechanism that allowed the door to open unexpectedly in flight.

1. The pilot was recorded on the aerodrome time-lapse camera as having been the last person in the vicinity of the left-rear door before the helicopter departed.
2. The safe-lock system requires all four latches to engage with their door-strikers and depress the safe-lock triggers before a door handle can physically be moved into the safe-lock position (see the next section for a description of the door-latch system). This is dependent on the door-latch mechanism being in good working condition and adjusted correctly.
3. Commission investigators determined, on another helicopter with a worn door-latch mechanism, that a door could be shut and safe-locked with the number four latch block not engaged with its door-striker. This could occur if cargo inside the cabin were pressing against the door as it was shut. However, it would also result in the door not sitting flush with the cabin skin near that latch.
4. A partly unlatched door could be difficult to see with a glance during a pre-flight inspection, but it would be easy to detect by feel with a hand sliding over the edge of the door. When the door has been safe-locked, the outside handle’s rest position is in line with the airflow, but it angles down when it is just latched shut. These differences would be noticeable to a pilot familiar with the door-latch mechanism.
5. There was no evidence to suggest that the pilot had not fully closed and safe-locked the left-rear door before the accident flight.
6. The DOC worker in the rear cabin was seated on the right-hand side, opposite the left-rear door. No one was sitting next to the left-rear door and there was no logical reason for anyone to attempt to reach over and open a helicopter door in flight. It is therefore unlikely that someone opened the door from inside the helicopter.
7. The helicopter had two snap vents in each rear-door window and one in each of the front doors. A single cabin front vent was controlled with a knob on the instrument panel. The front cabin air vent control was found in the closed position. The snap vents in each door could be turned around and pushed in or out to direct airflow into the cabin. Three snap vents were recovered, but their door positions and their respective open and closed status could not be established. If opening an air vent had caused the left-rear door to open, it would have confirmed that the door-latch mechanism and its adjustment were the causal factors, because the action of opening a vent should not cause a door to open.
8. The remaining four potential scenarios are discussed in more detail later in this report under the general headings of ‘Loose items in the helicopter’, ‘Maintenance of the helicopter doors’ and ‘Helicopter door windows and Windshields’. While none of these seven possible scenarios could be entirely discounted, the evidence is much stronger for the condition of the helicopter door-latching mechanism and its adjustment being the most significant factor that contributed to the left-rear door opening in flight.
9. The following sections describe the door-latching system on the MD 500 helicopter and how the doors on the accident helicopter were maintained and adjusted.

MD 500D door-latching systems

Door-latch operation

1. The MD 500D helicopter door-latch mechanism is operated from the outside or the inside door handle. A door is opened by turning the outside handle down and pulling the door open. In this open state the outside door handle rests at a downwards angle.
2. To close the door, it is pushed firmly against the cabin door frame without turning the handle. Spring-loaded latch bolts ride over the door-strikers and extend behind them, similarly to how a standard domestic house door-latches. In this door-closed position, the outside handle remains resting in the downwards angle, the same as when the door is open.
3. The inside door handle faces forward and follows the outside handle movements. In the latched rest or door open position, the inside handle is horizontal facing forward. When it is in the safe-locked position, it is angled down. To open it from the inside, the door handle is lifted through the horizontal latched position to angle upwards for the open position. To close the door from the inside, the handle is pulled into the cabin then turned down to safe-lock. This places all the closing force onto the door handle escutcheon bearing (the handle rotates in this bearing). (See Appendix 1 for a drawing of the door handle operation.)
4. To place the door into the safe-lock configuration for flight, the outside handle is lifted to above horizontal to move the latching mechanism into the safe-lock position. The safe-lock position further extends the latch bolt behind the door-striker to draw the door closer to the door frame, and it locks the latch bolt in this extended state. Upon the release from this position, the outside door handle drops down to rest in a horizontal position in line with the airflow (see Figure 10, and for more detail see Appendix 1).

1. The curvature and sizes of the doors require a distributed arrangement of the door- latch mechanism. The doors are hinged on the front edge, with the door handle on the rear edge. The door is fitted with four separate latch blocks spaced around its top and rear edges, numbered one to four (MDH structural repair manual CSP-SRM-6, Figure 204). The latch blocks are linked to the door handle by connecting rods between the latch block sliders, and operate together when the door handle is turned. All four doors have similar latch mechanisms (see Figure 11).
2. The latch bolt in each latch block engages with a mating door-striker mounted on the door frame to hold the door closed. The sliding contact surfaces of the latch bolt and the door-striker are arranged so that as the latch bolt extends behind the door- striker, it pulls the door against the rubber door seal to make the door airtight. Each latch bolt must overlap its respective door-striker by a minimum distance of 3.175 mm.

Latch block mechanism

1. The latch blocks are supplied as single items that cannot be disassembled. Each latch block houses: a spring-loaded latch bolt: a safe-lock trigger; and a latch slider (see Figure 12). The latch slider has a shaped cam slot connected to a cam roller on the latch bolt (further detail on the slider and cam roller is shown in Appendix 1). As the latch slider is moved longitudinally, the cam slot drives the latch bolt to extend or retract laterally.

1. The door-latching mechanism is interlocked with the safe-lock trigger to ensure that all four latch bolts in a door are engaged with their respective door-strikers before the door can be safe-locked. Each safe-lock trigger must be depressed by its mating door-striker by at least 3 mm before it will release that latch slider. Any excessive turning force applied to the door handle to override a locked latch slider is likely to bend a latch block connecting rod.
2. One of the key operational checks when closing a door is to ensure all latch bolts have engaged with their respective door-strikers. This can be assessed by the sound and feel of the latch bolt engagement as the door is pushed closed and by checking if the door sits proud of the cabin skin. Pressure may be required near a latch block to assist that latch bolt to engage with its door-striker.
3. Figure 13 shows the four stages of a latch bolt engaging with its door-striker. In stage (1) the door is in the open position. In stage (2) the spring-loaded latch bolt contacts the door-striker and rides up against the spring pressure. In stage (3) the latch bolt has ridden up over and extended behind its door-striker. This is the ‘closed’ position. In stage (4) the door handle has been turned to the ‘safe-lock’ position and the latch bolt has extended further behind its door-striker. The door has been pulled hard against the door seal by this safe-lock movement. The overlap distance is how far the latch bolt extends down behind the top of the door-striker.

1. The functional check procedure described in the MDH aircraft maintenance manual includes placing a sheet of paper in the door space against the rubber seal and checking that when the door is closed the door-latch mechanism compresses the door seal and grips the paper sheet. The door is also observed during this check as the door handle is moved to the safe-lock position, to ensure that all four latch bolts have engaged with their door-strikers and the door is pulled harder against the door seal at each point. Another part of the maintenance procedure is to check the overlap distance – that the latch bolt extends beyond the lip edge of the door-striker by at least 3.175 mm. This is approximately the same distance through which the latch bolt is extended by the cam in the latch block, when the door-latch mechanism is moved to the safe-lock position.

Post-accident inspection of the helicopter’s left-rear door

1. Maintenance records showed that the helicopter had been repainted in 2004. There were screwdriver impressions and paint disturbance on the screw heads and washers that held the internal latch block covers in place, indicating that they had been removed at least once since 2004. The latch block cover at the door handle exhibited signs of having been removed more frequently than this (see Appendix 4 for a more detailed description of the latching system condition).
2. The moving parts in the door-latch mechanism were greased but also dirty, with grit and metal fretting that had been there prior to the accident. Remnants of fabric like cleaning cloth were found in the door handle latch block. The slider movement was free but sloppy. The latch bolt cam and slider interfaces were also worn, allowing about 1 mm of free play in the latch bolt movement when it was fully extended in the safe-lock position. According to the maintenance manual, the minimum latch bolt overlap distance with the door-striker should have been 3.175 mm. The free movement would have directly affected that overlap distance, unless it had been compensated for in the door rigging.
3. The round clevis fastener holes were worn to ovals at some rod ends and at the internal door handle. This allowed more free movement between the handle and the slave latch blocks than was necessary for proper operation. The rods appeared normal except for the one damaged by the blade strike.

1. The external door handle was loose in its escutcheon bearing and the mechanical link from the internal door handle to No.3 latch slider was worn with 1-2 mm of free movement.
2. The damage to the helicopter prevented an observation of the actual latch bolt engagement and overlap with the door-strikers. The latch bolt on No.4 latch block exhibited wear on the face that indicated misaligned mating with its door-striker.
3. The rest of the helicopter’s door-latches were fire damaged but still intact. The lubrication had burnt away, but slackness observed in the linkage movement and the handles indicated that their condition would likely have been similar to that of the left-rear door.
4. The Commission was advised after the accident of four door-opening-in-flight incidents with this helicopter and operator. They were:

• On 3 October 2018, about two weeks prior to the accident, the accident helicopter was flown by another pilot to drop off hunters in a remote location. The left-rear door opened unexpectedly during that flight. The rear passenger leaned over and held the loose items against the seat until they landed.
• On 12 October 2018 the front-right door on the accident helicopter opened in flight just as the helicopter departed Wānaka Aerodrome for a frost- protection flight. Multiple witnesses saw the pilot return to the aerodrome to close the door.
• On 16 October 2018 the front-right door on the accident helicopter opened in flight when the pilot dropped off two technicians at a remote hilltop radio site.
• A pilot said that they had recently experienced the front-right door of the accident helicopter opening during a private flight.

1. The operator had no records of these recent incidents being reported through its safety management system at the time of the accident.
2. Incidents of helicopter doors opening in flight are not uncommon. The consequences can range from the door being closed and no incident being reported to the loss of the helicopter and the lives of its occupants.
3. The CAA aircraft register for 2021 had a total 887 helicopters registered. These comprised 76 MD 500 helicopters, with 31 of those being MD 500D models.
4. The CAA database records showed that between 2001 and 2018 there had been 77 helicopter-door-related events recorded. These included 17 MD 500-related events in that 17-year period.
5. The Commission is concerned that the risk of doors opening in flight could become normalised to some pilots. After this accident in 2018, the Commission issued an interim report that included recommendations for the CAA. The CAA issued a series of safety messages in 2019 regarding loose items in helicopters (see Appendix 6), the importance of securing and maintaining helicopter doors and the importance of reporting accidents and incidents.
6. Reports of door-opening occurrences to the CAA increased after the accident but have since dropped off. The total number of reported helicopter-door-security occurrences increased to 42 in 2019, then dropped to 33 in 2020, 16 in 2021, 14 in 2022 and 7 in the first three quarters of 2023. Within these totals were 14 occurrences in 2019 that were with MD 500s, 12 in 2020, 7 in 2021, 6 in 2022 and 3 in the first three quarters of 2023. The Commission does not have access to the CAA database and has not analysed these trends beyond the information presented above.

Maintenance of the helicopter doors

Safety issue: The MDH 100-hour maintenance inspection checklist did not specifically refer to the door-latching system functional checks in the maintenance manual; it left it up to maintenance engineers to determine how to check the ‘proper operation of latching and locking mechanisms’. This increased the risk of the door-latching mechanism not being maintained correctly and a door opening in flight.

1. There are two aspects to this safety issue: pilots making engineers aware of aircraft defects by reporting them in aircraft technical logbooks; and engineers being vigilant for signs of aging and wear and the need for adjustments in the door-latching system.
2. This section describes what was defined by MDH in the maintenance manual for MD 500 helicopter doors. It also describes how the door inspections and maintenance of this helicopter did not comply with what the manufacturer had intended, to ensure that the helicopter was maintained in a continued state of airworthiness. The maintenance of the door-latching system was a critical factor in ensuring the helicopter remained airworthy.
3. The helicopter’s technical log had had no entries in the previous four years related to pilots having reported defects with door latches.
4. Any defects encountered with helicopter doors, including their opening unexpectedly in flight, should be recorded in the helicopter’s technical log. These give clear instructions to maintenance organisations to conduct the required checks and rectifications.

5. The MDH maintenance manual covers several similar models of the MD 500 helicopter and refers to a set of associated manuals. Chapter 5, ‘Continued Airworthiness’, describes the periodical inspections the manufacturer requires for a helicopter to remain airworthy. The instructions on continued airworthiness checks and inspections at the start of the chapter describe what is meant by the visual inspection criteria.

   It will normally apply to those areas, surfaces, or items which become visible by the removal or opening of access doors, panels, fairings, or cowlings.

   A visual inspection that will detect obvious unsatisfactory conditions/ discrepancies. This type of inspection can require cleaning, removal of fillets, fairings, access panels/doors, etc. (CSP-HMI-2, Chapter 05-00-00, page 2, revision 38)

6. Chapter 05-02-00 of the maintenance manual contains checklists for the periodical inspections. At the start of the chapter is a description of the numbers to the right of a checklist item. Two digits refer to a chapter in the maintenance manual that provides further information on the area of a helicopter being inspected. Six digits refer to a specific chapter, section and subsection, where details for that inspection can be found.
7. Door-latch mechanisms must be inspected during each 100-hour check. The door- latch mechanism in this case had been inspected during the most recent 100-hour maintenance check, carried out on 25 June 2018, approximately 70 flight hours prior to the accident.
8. MDH estimated that a complete 100-hour check of the helicopter would have taken four person days plus the time required to rectify any defects that were found. An extract from the 100-hour maintenance inspection checklist (see Figure 15) showed the checks required of the cabin doors. It referred the engineer to Chapter 52 of the maintenance manual for further guidance as required but did not list or describe a specific check procedure that would confirm the ‘proper operation of latching and locking mechanisms’.

1. The maintenance manual includes work that is not called for in the current maintenance inspection and some details are unique to specific models. Chapter 52 of the maintenance manual is 30 pages long and covers models 369D/E/FF, 500N and 600N and two door-latch mechanism types. It covers door-latch mechanisms’ operational checks, inspections, maintenance and replacement. It is always available to engineers if needed for further guidance. Several engineers experienced with MD 500s advised the Commission they would usually only consult it if further adjustments or part replacements were required. Three items in Chapter 52 that could be used to check that doors and door-latch mechanisms operated correctly were:

• Item 6 – Door seal compression check
• Item 13 – Latching mechanism operational check
• Item 16 – Door latching mechanism inspection.

1. These items described how to ensure that all four latch bolts on each door engaged with their respective door-strikers and compressed the door seals sufficiently to grip a sheet of paper. They also described how to ensure that the safe-lock system operated correctly and further compressed the door against the door seal.
2. The ability of a door-latch mechanism to hold a door closed can also be affected by the door hinges and door seal. The doors are often removed for operations with this type of helicopter. If hinge pins are worn or loose or have not been fitted correctly, the overlap distance of the door-striker by the door-latch bolt could be affected. The flexibility and compression of the weatherstrip door seal can also affect the door closure. A note in ‘item 6 – Door seal compression check’ in the maintenance manual reminds the engineer doing this check that a deterioration of the weatherstrip compression seal, a deformation of the door frame, worn hinges and improper latching can all affect the performance of the door seal.
3. Item 16 in Chapter 52 of the maintenance manual referred to Figure 203, where Note 1 of that figure described the minimum overlap distance for the safe-lock function as 3.175 mm (see Appendix 1). This distance is about the same as that of the latch bolt extension when the mechanism is moved into safe-lock. The overlap distance can be observed from inside the cabin.
4. The MDH maintenance manual described some basic checks that would have enabled an engineer to check and confirm the ‘proper operation of the door-latching and – locking mechanism’. However, the maintenance checklist did not specifically call for those checks, leaving it up to maintenance engineers to determine the proper operation from their own experience and a general reference to the maintenance manual. Furthermore, the MDH guidance did not describe how the door-latch mechanism was intended to work and lacked specific measurements for wear limits.
5. The MDH maintenance procedure expected that any parts found not to meet the inspection criteria would be replaced. This is known as replacement ‘on condition’. Alternatively, some aircraft parts could be allocated specified lifetimes in service and require replacement when those lifetimes expired. The MDH maintenance manual (MDH manual CSP-HMI-2 for MD 500/600 series helicopters; CSP-HMI-2, section 04, page 5, item 2(2)). stated that all components maintained in an ‘on-condition’ state had a minimum life of 20,000 hours.
6. The helicopter had flown approximately 19,500 hours and the door-latch mechanisms were original.
7. The Commission interviewed four engineers from the two maintenance organisations who had carried out the previous two 100-hour inspections of the helicopter, as well as two other engineers.
8. The engineers were interviewed about their practice when completing the above checks. The consensus was that it would usually take less than five minutes per door to carry out a scheduled door inspections, and they did not usually need to remove the latch block covers. Some would pull on the handle and others applied pressure from inside the cabin to check if each latch block remained latched in the safe-lock position.
9. The engineers considered the 100-hour check to be a visual inspection and functional check to confirm that the door operated as they expected it should. The engineers all noted that if an inspection of a door-latch mechanism indicated an adjustment was required, that adjustment would be tricky and time consuming.
10. The engineers interviewed and those responsible for at least the previous two 100-hour checks of the accident helicopter had not carried out the cabin door functional checks described in the maintenance manual (items 6, 13 and 16) and they were not familiar with the checks described in those items.
11. The inconsistent use and interpretation of aircraft maintenance documentation is a long-standing safety issue in all sectors of the aviation industry. A failure to follow maintenance procedures is considered one of the most pervasive human factors issues in aviation maintenance (Estimates suggest failures to follow procedures contribute to between 40 per cent and 87 per cent of maintenance-related events (Key, 2022)). Globally, accidents and incidents illustrate that non- compliance with maintenance procedures is not unique to airline, military and general aviation domains. Yet, despite routinely being identified as a concern, non-adherence to procedures continues to persist as a safety issue (As examples, one FAA study found that the primary cause of major malfunctions within 90 days of a heavy maintenance check was a failure to comply with maintenance documentation (Johnson, 2001). A failure to follow procedures was also found to be the primary cause of maintenance errors reported through Boeing’s Maintenance Error Decision Aid (Rankin, 2008)).
12. Research on this topic demonstrates a complexity associated with procedural non- compliance, specifically a gap between the design and documentation of maintenance tasks and the reality of how work is conducted by end users ((Avers, 2011); (Drury C. G., 2013); (Fogarty G. J., 2003); (Hobbs A. &., Aircraft maintenance survey results. , 2000); (Hobbs A. &., Associations between errors and contributing factors in aircraft maintenance, 2003)). Two main themes appear to be:

• the way in which aircraft engineers perceive the utility and usability of the documentation provided to them by aircraft manufacturers
• the organisational influences, such as social norms and expectations, regarding maintenance expediency (Drury C. G., 2017).

1. The helicopter’s left-rear door-latching system, as determined after the accident, showed wear in the linkage that could not be attributed to the accident sequence. The door-latch mechanism can be adjusted to compensate for wear, but the recent occurrences of doors unexpectedly opening in flight with this helicopter indicate that the door latches were not rigged as effectively as they could have been. These previous occurrences were opportunities to identify this issue, and to make the helicopter doors airworthy.
2. Notwithstanding the information that was available to the maintenance engineers in the manufacturer’s maintenance manual, the maintenance engineers should have been directed by the 100-hour checklist to the relevant functional checks of the doors provided in the maintenance manual.
3. The previous incidents of the helicopter doors opening unexpectedly in flight reportedly occurred in the absence of any other contributing factors. Based on the observed wear in the left-rear door-latch mechanism and the non-specific maintenance requirements, it is considered very likely that the left-rear door opened and initiated the accident sequence.
4. However, we need to consider whether any other factors may have contributed to the door opening, such as a failure of one or more of the helicopter windshields causing an increase in cabin pressure. This alone should not have caused a door to open, but if the door-latch mechanism had been substandard or poorly maintained, such an event may have been sufficient to assist a door to open.

Helicopter door windows and windshields

1. The following sections discuss the possibility of one or more of the helicopter acrylic door windows or the windshields being a factor contributing to the left-rear door opening.

Door windows

1. The original MD 500 window types were curved slightly into the slipstream by approximately 25 mm at the centre. They were riveted in place with sealant and strengthening strips under the rivet heads. The original door windows on the accident helicopter had been replaced in New Zealand with an aftermarket product in 2004.
2. The replacement windows were the ‘cabin comfort’ style made by Tech-Tool Plastics Incorporated in the United States (USA). This window type had been approved by the US Federal Aviation Administration (FAA) in 1994 and it extended further into the slipstream than the standard profile. It increased the shoulder and elbow room for occupants. It had a wedge shape when viewed from above, with an extension of about 84 mm along the rear edge tapering to zero extension at the front edge. The cabin comfort window has sometimes been described as a bubble window, but the two are not the same. A bubble window extends up to 292 mm into the slipstream to allow a person to place their head in the bubble and look directly below the helicopter.
3. In this case the door window profile was considered because it placed a different aerodynamic load on the door-latch mechanism. The FAA approvals of the supplementary type certificates issued for the standard and comfort windows showed there was an increase in aerodynamic loading on the door latch between the standard and comfort windows of three to six kilograms (kg) depending on the airspeed. This was important to be aware of, but based on the time when these windows had been installed in this helicopter, the increased aerodynamic loading was not considered to be relevant to this accident.

Windshields

1. Several large pieces of acrylic window and many smaller fragments were recovered from the accident site. After attempting to reconstruct the windshields, an estimated 40 per cent of the pieces were still missing. The two lower and two upper windshields were the most complete reconstructions. Pieces from the two centre windshields and the door windows were either too small or too few to match or attempt to reconstruct (see Appendix 5 for the reconstruction).
2. The examination revealed two windshield crack repairs and an area of crazing. The repairs had been carried out by the helicopter owner. The repairs and crazing had existed before the operator leased the helicopter. The helicopter owner was responsible for maintaining the helicopter, and the operator was required to alert the owner to unscheduled maintenance.

1. The MD 500D has four pairs of windshields. These are made with stretched acrylic panels approximately 2.5 mm thick. From the front the panels are named: Lower (around the tail rotor control pedals); Centre (the main forward view for the pilot and a passenger); Upper (above the front two seats); and Aft (above the rear seats) (see Figure 16).
2. The MDH structural repair manual (MDH CSP-SRM-6, Reissued No.3: 26 May 2006, Page 201, Temporary Revision TR10-001, Section 53-10-00) states that minor defects and imperfections that do not impair a pilot’s critical visibility, or are not signs of impending failure, can be considered negligible. The manual provides details to assist engineers in determining the size or extent of defects that would be considered ‘negligible’. These include:
   • nicks to a depth of 0.254 mm and a maximum of 6 mm long
   • scratches to a depth of 0.254 mm and 13 centimetres long.
3. The MDH structural repair manual states that negligible defects or imperfections can be repaired in accordance with FAA Advisory Circular (FAA AC) 43.13-1B. Any window defect that is not within the definition of ‘negligible’ requires the windshield or window to be replaced. The FAA AC notes that repairs usually require a great deal of labour, so replacement is normally more economical than repair (FAA, 1998).
4. The FAA AC describes several methods for repairing a crack. They involve drilling a hole at the end of the crack to prevent it propagating further, then: drilling holes down either side so it can be laced together with brass wire; drilling holes along the crack for bolts with nuts and washers to compress and hold the crack together; or filling the crack with a solvent cement.
5. Two defects in the windshields had been repaired. Both were cracks beyond what the MDH structural repair manual described as being ‘negligible defects’ and should have initiated full windshield replacements. Maintenance records showed that the windshields had been in that state for at least six months prior to the accident, and probably longer (see Appendix 5 for details of damage and the reconstructed windshields).
6. One crack had been repaired on 5 February 2018 (Recorded in a 100-hour maintenance inspection as item 13, Work Package 103040, at total time of 19,266.7 hours). This was a 200 mm crack in the upper right windshield that had been stop drilled and patched with a clear, self- adhesive plastic covering on both the inside and outside of the windshield. This patch was still in place with the recovered pieces of windshield, but the crack had propagated sideways.
7. A shorter 90 mm crack from the rivet line of the lower right windshield had been repaired with a similar method, but no record of this repair was found in the logbook. It had three stop drill holes and a patch on the inside and out. This repair patch had failed and the crack had extended in the accident.
8. The two cracks exceeded what the manufacturer described as repairable. The method of repair was not in accordance with the manufacturer’s approved method as described in the FAA AC reference above.
9. Crazing is a form of stress defect that forms inside acrylic. It looks like a multitude of cracks but is actually micro-voids within the acrylic (J.D Stachiw, 1989). Crazing alters the refractive index and can obscure vision through otherwise clear panels. It can be caused by at least four factors:

• tensile stress
• temperature differential across the thickness of the acrylic membrane
• weathering
• contact with organic solvents.

1. The MDH structural repair manual CSP-SRM-6 describes what is acceptable in terms of ‘negligible damage’ for crazing. Crazing is acceptable around delaminated areas less than 0.254 mm deep. The only parts of an MD 500 windshield that can be subject to delamination are where the acrylic plastic is bonded to a Geon edging and in the doublers around penetrations such as snap-vent windows. Any crazing on a windshield that impaired a pilot’s critical visibility was not acceptable.
2. If the flexure stress in an acrylic panel is maintained at a low level, the crazing will not propagate. However, if the flexure stress remains high, the crazing can spread perpendicularly to the direction of stress and this can result in sudden failure.
3. Surface deterioration caused by long-term exposure to weather or chemicals can degrade the outside surface flexure strength significantly and initiate crazing. The effects of weather have been shown to reduce the flexure strength by 55 per cent over 10 years. This type of deterioration will only affect the top 1.5 mm layer of the acrylic panel, while the remaining thickness will retain its original strength. The windshield panels on this helicopter were about 2.5 mm thick.
4. The acrylic plastic along the bottom edges of the two centre windshields had areas of crazing (see Figure 17). This was more extensive than the MDH maintenance manual allowed, and it was in the pilot’s line of sight. It had been noted during a 100-hour inspection in 2016 (100-hour inspection looseleaf logbook entry for service carried out at 18,804.2 airframe hours on 16 December 2016) but there was no record of it being replaced.

1. The recovered pieces and reconstructed windshields had different types of fractured surfaces that indicated different modes of failure. The lower right and upper right windshields had long, smooth breaks. The pilot’s lower windshield had two parallel, jagged, diagonal breaks in the top half. The remnants of the two centre windshields generally had smooth edge breaks but there were some jagged edge breaks.
2. Witnesses recalled seeing debris streaming from the helicopter that would have included the acrylic windshield pieces. It was variously described by the witnesses as ‘sparkling debris streaming from the helicopter’ and ‘fluttering down well after the helicopter impacted the ground’. Acrylic pieces of the windshields were found over a wide area of the accident site.
3. It is not possible to determine with any accuracy what caused the windshields to shatter in the manner they did during the in-flight breakup. Equally, it could not be determined whether they had shattered before, or as a consequence of, the severe forces to which the helicopter would have been subjected during the accident sequence, or a mixture of both.
4. The helicopter windshields were in poor condition and had been repaired with unapproved repair techniques but had been in service for several years. Their strength may have been reduced, but there was no evidence to support a mechanical failure of the windshields initiating the accident sequence. The accident occurred in calm conditions at an estimated airspeed of 105 knots (The maximum permitted airspeed of the helicopter was 156 knots).
5. The Commission also considered several other possible reasons for the windshields to have broken before the helicopter started to break up in the air, such as a bird strike, a remotely piloted drone or a projectile fired from the ground, striking the helicopter.
6. A witness reported a flock of birds in the area that looked like seagulls. These were seen about half an hour before the accident flight took off. That flock of birds was beyond the aerodrome boundary, towards the river. The aerodrome operator did not have a specific risk-management plan for bird hazards on the aerodrome and was not responsible for managing the risk of bird activity beyond the aerodrome boundary. Records were not available prior to 2021, but only five incidents had been recorded within the aerodrome perimeter between 2021 and October 2023.
7. No forensic or pathology-related evidence was found to indicate that a projectile had been fired from the ground, a drone or a bird had hit the windshields, so the Commission was unable to determine if these potential sources had initiated the windshield failure. However, only about 60 per cent of the acrylic windshields were recovered and the damage caused by the impact and fire was extensive. Consequently, none of these hypotheses could be completely excluded.
8. Regardless of whether the poor standard of windshield maintenance was a factor in the accident, it is of concern.

Loose items in the helicopter

Safety issue: Loose items can exit a helicopter and compromise its safety. They can contact the tail rotor and affect the controllability and airworthiness of the helicopter. This can increase the risk of an accident occurring.

1. CARs largely categorise items in an aircraft as either baggage or cargo. The rules are applicable to all aircraft types. Cargo is defined as ‘any property carried on an aircraft other than mail, stores, and baggage’. Baggage means ‘personal property of passengers or crew, carried on an aircraft by agreement with the operator, or personal property of passengers or crew that is intended by passengers or crew to be carried on an aircraft’.
2. CAR 91.215 Carriage of cargo requires cargo to be properly secured by a safety belt or other restraining device to ensure that it does not shift under normally anticipated flight and ground conditions. CAR 91.213 Carry-on baggage requires that carry-on baggage be stowed in a baggage locker or under a passenger seat so that it cannot slide forward under a crash impact or hinder egress in an emergency.
3. Helicopters generally do not have the same internal storage options as larger, fixed-wing aircraft. The accident helicopter had no external cargo pods or internal baggage lockers, meaning all cargo and baggage had to be carried within the cabin. The operator had elected to treat cargo as the same as baggage in its Operations Manual.
4. The operator’s practice with this helicopter was to pack general items unsecured in the cabin when the doors were fitted. Its pilots usually packed items into the helicopter tightly to prevent them moving in flight, but did not tie them down. They would pack items on or under the rear seats or between the rear seats and the wall behind the front seats. Light items would normally be packed under heavy items or into containers. Seat belts were sometimes used to restrain loads. With careful packing in the small rear cabin, a load would be held firm by the physical constraints of the rear cabin and the weight of other items.
5. Following the accident, the operator conducted flight testing during which it assessed the airflow from the left-rear cabin when the door was opened in flight. The operator provided the Commission with video records of those tests and followed up with verbal descriptions of each test. The Commission considered this informal flight test information, but concluded it was not sufficiently robust to be relied on. The Commission considered conducting its own flight test, but the perceived safety risks were too high.
6. Instead of a flight test, the Commission researched accident data from the National Transportation Safety Board (NTSB) in the USA. Past accident reports showed that if a door opened in flight there could be an airflow out the door that would be sufficient to extract unsecured items from within the cabin. One example was in an accident in Kernville, USA on 7 October 2000 (NTSB, 2000), when the pilot suspected that a shirt in a plastic bag had escaped from the rear seat when the left-rear door opened in flight. The tail section had also separated in that accident, but the main rotors were not damaged, and the pilot had survived. Some other relevant accident reports are listed in the Citations section of this investigation report.
7. Time-lapse digital camera images from just before the flight showed that the three occupants loaded items into the accident helicopter, but no details were available to confirm exactly how they were packed.
8. The pilot had removed all loose seat cushions, apart from the pilot’s, during the morning preparations. These would have been risks for operating with doors off and would not have been required later in the day when the doors would be removed prior to the culling operation. The cushions were found after the accident where they had been left in a hanger.
9. Given the operator’s practice of not using restraints to secure cargo within the cabin of this helicopter, and that items were distributed across the main wreckage site, it is virtually certain that the cargo items had not been properly secured with a seat belt or other restraining device in the accident flight.
10. One potential scenario was that unsecured items within the cabin had shifted in flight and moved the left-rear door handle, causing the door to open. However the items’ movement would have had to be caused by a sudden change in motion of the helicopter or a crew movement in the rear cabin to create the initial movement of an unsecured item. The inside door handle faced forward and the tip would have needed to move upwards about 60 mm (a 60-degree rotation) from safe-lock to the ‘closed’ position and a further 40 mm upwards (a 30-degree rotation) to retract the latch bolt and open the door (refer stages 1 to 4 in Figure 13).
11. A door-handle movement from the safe-lock to the ‘closed’ position retracts the latch bolt by about 3 mm. In this state, the latch bolt is only held extended by spring pressure, so the door could be at risk of opening.
12. However, if the door had been only partially latched and an unsecured item within the cabin had moved hard against it, it may have added sufficient pressure to the locking mechanism to force the door open.
13. The Commission considered it very unlikely that unsecured items in the cabin were suddenly shifted in a way that could have enabled them to open the left rear door in flight and initiate the accident sequence. It was a calm morning with little or no turbulence. The helicopter was flying in a straight line before it was seen to be spinning, and the tracking data did not indicate the presence of a force that could move items to the left side of the rear cabin. Heavy items (such as the ammunition boxes and fuel containers) were flung out against the left-rear door, but that was after the black overalls had exited and well into the breakup sequence when the helicopter was spinning to the right (see Figure 5 for the location of items where they fell).
14. Prior to this accident the operator had experimented with using cargo nets to secure cargo, but found the nets created other hazards. It was decided after this accident to use heavy plastic, zip-closed carry bags for all loose items carried in helicopter cabins. The replacement helicopters were fitted with underslung cargo pods mounted between the skids.
15. The CAA issued a safety notice in November 2018 that loose items can be fatal (see Appendix 6).

Loading with standard loads

1. CAR 135.305 – Aircraft Load Limitations, requires pilots to assess aircraft loadings and ensure that they remain within the flight manual limitations for the duration of their flights. Exceeding aircraft load limitations compromises airworthiness and therefore the safety of the helicopter. The operator’s procedures made each pilot responsible for checking their own aircraft weight and balance before each flight. They could select standard loading options if they were appropriate, or they could weigh the items carried and calculate the weight and balance.
2. As part of its safety management system, the operator required every pilot to log aircraft flight details with its flight-following desk. These included details of the aircraft, the names of the pilot and any passengers, the cargo and the destination. During the flight the pilot would update flight-following with details of landings, take-offs and cargo changes.
3. For this flight, the pilot had declared that the helicopter was loaded to a ‘standard load Type A’ from the Operations Manual, table AHL06.
4. Standard loading enables operators to check quickly that aircraft are loaded within operating limits. A standard range of loading options is defined, and a pilot can quickly select a standard load rather than calculate the weight and balance based on actual weights. The Operations Manual provided options for pilots when there were obvious differences between passengers’ weights and the standard weight, including using a passenger’s declared weight plus 6 kg.
5. The selected standard load Type A comprised 100 per cent fuel load, two passengers and the pilot at standard weights of 80 kg each, and up to 140 kg of cargo.
6. The occupants’ total weight was more than the standard per-person weight allowance of 80 kg. The operator had current records for the people on the accident flight and the crew weights were listed on the Flight Sheet but not the pilot’s. Their combined weight was 49 kg above the allowance for three people at 80 kg each. This excess amount should have been deducted from the cargo allowance to keep it within the standard loading.
7. There was evidence that the cargo items were not weighed before they were loaded into the helicopter. The records of digital images showed the crew taking their equipment from their vehicle directly through the hanger to the helicopter, without deviating towards the cargo scales on the other side of the hanger.
8. Each of the operator’s pilots had the iBal Rotary application on their iPhone for checking weight and balance. This needed to be set up before use with the relevant helicopter’s registration, the helicopter type and the helicopter’s empty-weight details. The pilot would select a helicopter then add specific configurations for their flight with fuel, their own and other persons’ weights and cargo weights and determine from the application if the helicopter loading was within acceptable limits. The loading calculation would be saved on the iPhone and could also be emailed to the flight-following desk, subject to cell phone coverage. Alternatively, it could be completed using a company iPad mounted in a helicopter or in the office. A final dynamic check would be carried out at lift-off.
9. The specific weight and balance details for the accident helicopter were not entered into the iBal Rotary application on the pilot’s iPhone. There was no record in the iPhone application of the accident flight or a flight using a similar helicopter with different registration. No records could be found that showed the pilot had used a company iPad instead of the iPhone.
10. The helicopter was approved in the type certificate (normal category) to a maximum weight of 1361 kg (3000 pounds). The helicopter type was also approved to lift 249 kg above the maximum weight, providing it was not imposed on the landing gear. That is, the excess load was to be externally located on the cargo hook and jettisonable in an emergency.
11. Based on the recovered items and the actual and conservatively estimated weights and using the standard loading sheet (see Appendix 3 for the loading estimate), the helicopter cargo was calculated to weigh approximately 136 kg. That was just under the 140 kg limit for cargo under standard load Type A. When the excess pilot’s and DOC workers’ weights above the standard allowance were accounted for, the helicopter was loaded to approximately 8 kg over the maximum weight stated in the flight manual at the time of lift-off. That corresponded to approximately 45 kg over the loading limit for the standard load Type A.
12. It would have been normal for the pilot to conduct a dynamic hover check at the beginning of the flight to establish if the helicopter had sufficient power and was stable for the flight. However, a dynamic hover check does not establish if a helicopter is loaded within maximum limits set by the manufacturer and as stated in the type certificate. In this case the helicopter was still loaded to less than its maximum lifting capacity, with an underslung load.
13. It was unlikely that the loading exceedance on the accident flight contributed to the accident. However, the Commission has raised the issue in other inquiries where pilots have exceeded maximum permissible loadings of aircraft. This is yet another example.

Risk normalisation of helicopter doors opening in flight

Safety issue: A helicopter door opening in flight can create a potentially hazardous situation. Pilots who do not fully appreciate this risk may consider situations where doors open in flight to be normal. This can lead to an under-reporting of such events, inadequate investigations of the causes and an increase in the risk of accidents occurring.

1. A helicopter door opening in flight presents a significant risk to the helicopter and its occupants. The open door creates a path for any loose items in the cabin to exit the helicopter. A loose item could then contact external parts of the helicopter and affect its controllability or result in an accident.
2. CAR Part 12 – Accidents, Incidents, and Statistics describes air operators’ obligations to report accidents and incidents to the CAA. Incidents are classified into several groups, including an aircraft incident and a defect incident. A door opening in flight could be classified as an aircraft incident initially, then, depending on further investigation, become a defect incident. If the incident is defined as serious, the CAA must be notified as soon as practicable, but all incidents must be notified within 14 days. A ‘serious incident’ is one in which circumstances indicate that an accident nearly occurred.

3. The CAA provides Advisory Circulars (ACs) to assist aviation participants to comply with CARs. The AC for this rule is AC12-1; it states:

   This AC provides information and describes an acceptable means of compliance with the submission of occurrence notification and information required under Rules Part 12 – Accidents, Incidents, and Statistics. This AC should be read in conjunction with AC12-2, Occurrence Investigation, where an investigation report is required.

4. Appendix A of AC12-1 lists incidents that need to be reported to the CAA. There are approximately 180 examples of events that are clearly described in that list, including some specific to helicopters, but aircraft ‘doors opening in flight’ is not included. This lack of mention of or clarity on reporting door-opening-in-flight incidents could have reinforced a belief amongst operators and pilots that this type of event was not associated with unsafe outcomes.
5. As part of this inquiry, pilots who had flown this helicopter previously were contacted to check if the accident helicopter had had any history of door openings in flight. Pilots who had flown the accident helicopter under previous lease agreements were contacted first. This led to other pilots and operators with experience in flying MD 500 helicopters being contacted.
6. Nine pilots were interviewed by telephone. Their combined, verbally estimated flight experience in MD 500 type helicopters was more than 20,000 hours, including an estimated 1500 hours in the accident helicopter. None worked for the operator at the time they were contacted.
7. The pilots interviewed said they could not recall having had any problems with the doors on the accident helicopter, but many of the operations they had flown were with doors off.
8. Several of these MD 500 helicopter pilots had experienced door-opening-in-flight events. Some believed that a common cause of a door opening in flight was passengers or pilots catching door handles in their clothing, or handles being bumped by people or cargo.
9. This anecdotal information supported evidence already obtained that incidents of MD 500 helicopter doors opening in flight were not routinely reported by the pilots, either within their organisations or externally to the CAA. This was demonstrated in CAA data showing that in the 17 years prior to this accident there had been only 17 reported events of doors on MD 500s opening in flight, or about one per year. After the accident and the subsequent actions taken by the Commission and the CAA to raise awareness of the risks associated with helicopter doors opening in flight, 14 events with MD 500 doors were reported in 2019 and 12 in 2020.
10. From the CAA records and anecdotal evidence there appears to be a difference between occurrences of doors opening in flight and the number of reported incidents. If events of helicopter doors opening in flight are not reported, maintenance engineers will not be aware of the problems and the operators will not consider that safety actions may be required to mitigate the risks.
11. There could be many reasons for the low reporting rate of door-opening events, such as pilots considering they are human errors rather than aircraft- or defect-related incidents. Pilots may not readily associate these types of event with the potentially adverse consequences. A pilot’s perception of the risks associated with a door opening in flight may also be negatively affected by their familiarity with operations conducted with the doors off. There may also be questions around the benefits of reporting. CAR 12.63 Non-prosecution limits the extent to which the CAA can use reported information for the purpose of a prosecution investigation or prosecution. The incident database remains confidential to the CAA.
12. In the absence of a clear requirement to report door-opening events, or an understanding that these events could have adverse consequences, it is likely that the risks associated with them may not be recognised or will continue to be normalised.
13. Without a continued influence of regulators and operators on pilots to recognise the risks associated with opening doors in flight, the reporting of such events is susceptible to decline again in the future. This could be detrimental to safety.

Crew member or passenger status

Safety issue: The New Zealand helicopter sector and the CAA differ in their interpretations of the CARs for when a person is a ‘crew member’ or a ‘passenger’ performing a task, and this has resulted in ambiguity in the application of certain safety rules and regulations.

1. The Commission considered whether the DOC workers should have been described as ‘crew members’ or ‘passengers’ because this interpretation becomes important when considering the application of the CARs and the operator’s responsibility (for example, an air operator might have legal obligations in relation to crew members that differ from those for passengers concerning qualifications, training, equipment and fatigue. These are in addition to Health and Safety at Work Act 2015 obligations as a person conducting a business or undertaking in a workplace. A workplace can include an aircraft).
2. The operator and DOC defined the two DOC workers on board as crew members, while in terms of the CARs they should have been designated as passengers.
3. In the context of this flight, the only difference in the designation was that, as passengers, the two DOC workers would not have been allowed to load or stow cargo and equipment or open or close the helicopter doors. Without suggesting the DOC workers’ actions contributed to the accident, both actions were factors in this accident.
4. As part of the CAA consultation process prior to drafting a bulletin on the matter, industry participants opined that occupants who carried out specific duties or tasks integral to a flight operation (for example, shooters, police observers, fire crews and search and rescue workers) should be considered as supplementary crew members. That was certainly the case for the occupants of the accident flight. DOC had conducted a risk assessment for contracting helicopter operations, and an internal training and rating system that ensured the staff allocated to the tasks were approved, skilled, trained and current to carry out the operations.
5. The operator had assigned the DOC workers as ‘crew members’ with specific duties, and ensured that they were adequately trained in and aware of how to carry out their tasks during flight safely.
6. Part of this process was through the operator participating in a joint training and refresher course with all the occupants involved two days prior to the accident.
7. In an investigation into a helicopter impact with water (TAIC, 2019), the Commission raised the issue of the ambiguity of roles on aircraft, including whether a person’s status on board an aircraft changes based on their actions during flight (the Commission also considered the crew status in investigation AO-2018-005 (MD600N forced landing at Ngamatea Station)). In that investigation it appeared that, in accordance with the CAA’s ‘Legal Information Bulletin 4’, a paramedic on board a night flight transitioned from being a passenger performing a task to a crew member. The Commission commented in that report that the differences in status of persons on board aircraft continued to be a source of confusion for pilots and operators. The issue appears still yet to be resolved.
8. Appendix 7 gives a full explanation of the history of this safety issue.

1. The helicopter’s left-rear door very likely opened in flight, allowing an unsecured pair of overalls to exit the cabin and strike the tail rotor. This initiated an in-flight breakup.
2. The damage caused during the in-flight breakup almost certainly rendered the helicopter uncontrollable, upon which it descended rapidly and struck the ground and caught fire.
3. Based on the observed wear in the left-rear door-latch mechanism and the non- specific maintenance requirements, it is considered very likely that the left-rear door opened and initiated the accident sequence.
4. It was not possible to determine if one or more of the helicopter’s windshields failed first and influenced the left-rear door opening, or if it/they failed because of the in- flight breakup, or both.
5. The helicopter windshields were in poor condition and had been repaired with unapproved repair techniques.
6. Given the operator’s practice of not using restraints to secure cargo within the cabin of this helicopter, and that items were distributed across the main wreckage site, it is virtually certain that the items had not been properly secured with a seat belt or other restraining device.
7. In the absence of clear requirements to report door-opening events, or an understanding that these events could have adverse consequences, it is likely that the risks associated with them may not be recognised or will continue to be normalised. This could be detrimental to safety.
8. The loading exceedance on the accident flight was unlikely to have contributed to the accident. However, the Commission has raised the issue in other inquiries where pilots exceeded maximum permissible loadings of aircraft. This is yet another example.
9. Ambiguity in the CARs on whether aircraft occupants (in this case the DOC workers) should be considered as passengers or crew continues to be a source of confusion for pilots and operators. Their designation, however, is unlikely to have been a factor in this accident.

General

1. Safety issues are an output from the Commission’s analysis. They typically describe a system problem that has the potential to adversely affect future operations on a wide scale.
2. Safety issues may be addressed by safety actions taken by a participant; otherwise the Commission may issue a recommendation to address the issue.

Safety issues

Maintenance of the helicopter doors

Safety issue: The MDH 100-hour maintenance inspection checklist did not specifically refer to the door-latching system functional checks in the maintenance manual; it left it up to maintenance engineers to determine how to check the ‘proper operation of latching and locking mechanisms’. This increased the risk of the door-latch mechanism not being maintained correctly and a door opening in flight.

Safety action taken:

1. As a result of the consultation on a draft of this report, MDH acknowledged the potential lack of clarity in its maintenance instructions and revised the 100-hour maintenance schedule and maintenance practice in Chapter 52 of the maintenance manual. The schedule now refers directly to the relevant section in the maintenance manual for maintenance guidance.
2. The Commission welcomes this safety action and considers it has addressed the safety risk. It therefore has not issued a recommendation.

Loose items in the helicopter

Safety issue: Loose items can exit a helicopter and compromise its safety. They can contact the tail rotor and affect the controllability and airworthiness of the helicopter. This can increase the risk of an accident occurring.

Safety action taken:

1. The operator called a meeting soon after the accident and invited all local MD 500 helicopter operators to attend. The operator described the facts of this accident as they had available at the time, and impressed on all present the importance of securing loose items in cabins and not relying on doors remaining secure.
2. The operator now requires pilots to secure loose items in specially manufactured, zipped, heavy plastic carry bags that are secured under the seats or in underslung cargo pods.
3. The CAA issued a Safety Message (See Appendix 6) to all operators on 14 November 2018 to remind them about securing loose items in helicopters.
4. The Commission welcomes these safety actions and considers that existing industry precautions in place to prevent items becoming loose in helicopter cabins are clear and effective. The operator has addressed the immediate safety risk and therefore the Commission has not issued a recommendation.

Risk normalisation of helicopter doors opening in flight

Safety issue: A helicopter door opening in flight can create a potentially hazardous situation. Pilots who do not fully appreciate this risk may consider situations where doors open in flight to be normal. This can lead to an under-reporting of such events, inadequate investigations of the causes and an increase in the risk of accidents occurring.

1. The Commission approved an interim report on this accident on 12 December 2018 and it was published later that month. A safety recommendation (035/18) was made at the time to the Director of the Civil Aviation Authority.

   On 12 December 2018 the Commission recommended that the Director of Civil Aviation urgently remind aviation participants of the importance of incident notification in accordance with Part 12 of the Civil Aviation Rules (035/18).

   On 12 December 2018, the Civil Aviation Authority replied:

   The Director accepts the final recommendation 035/18. The CAA will implement the recommendation by the end of January 2019. The Commission will be advised on completion.

2. The CAA updated the Commission in November 2023 on its subsequent actions on this recommendation to date. The CAA stated in part that:

• On 13 December 2019, a safety message titled ‘Double-check your doors!’ was published on the CAA website.

• An article from Spring 2022 called ‘Busting the myths’ had a section on [Civil Aviation Rules] Part 12 about the importance on reporting safety-related incidents or concerns. We revised, and published, a new version of the ‘How to report occurrences’ GAP booklet in August 2022.

• We would also like to emphasise that reporting of safety-related incidents or concerns is a legislative requirement under Rule Part 12, participants are obligated to report such incidents.

  Any participants worried about such information being used by the Authority to take enforcement action should not be alarmed. To build trust with participants, we prefer not to take enforcement action against those who fully report details of incidents and accidents, although we will consider doing so in circumstances in which reporting is patently incomplete or reveals reckless or repeated unsafe behaviour.

  Also, Rule Part 12.63 specifically addresses the issue of non-prosecution due to statutory reporting.

1. The CAA reviewed the second draft report distributed in February 2024 and commented on this recommendation on 2 April 2024. The CAA stated in part that: 

   The Authority has again reviewed the current rule and associated notes and guidance, and considers that these are sufficient.

   As mentioned in the CAA’s letter of 15 December 2021, in terms of flight safety, the critical aspect of the accident where loose articles exited an open door has been, and continues to be, addressed.

   Furthermore, the publicity at the conclusion of the prosecution of the operator concerned has significantly helped in raising awareness. As noted in the CAA media statement dated 11 October 2022:

   “Prior to this prosecution there was a low reporting rate of door opening incidents but now these are recognised as a real risk and we have seen reporting increase dramatically”.

   Accordingly, the Authority does not consider that this recommendation is necessary.

2. The Commission acknowledges this action to date and appreciates that this operator is aware of this safety issue. However, it believes that the safety risk is applicable to the whole commercial helicopter sector and more action needs to be taken by the CAA on a long-term basis to ensure that every barrier to reporting door opening occurrences is removed.
3. The Commission has made a recommendation in Section 6 to address this issue.

Crew member or passenger status

Safety issue: The New Zealand helicopter sector and the CAA differ in their interpretations of the CARs for when a person is a ‘crew member’ or a ‘passenger’ performing a task, and this has resulted in ambiguity in the application of certain safety rules and regulations.

Safety action taken:

1. The CAA recognises that there is a long-standing problem with the defined terms in the CARs for passengers and crew. In response to the draft recommendation at 6.6, the CAA provided this update on 15 December 2021:

   The Authority can advise that the Minister of Transport has approved a Rules project, to be undertaken by the Authority, that would seek to address this issue. The definition of ‘Crew Member’ in Civil Aviation Rules (CAR) will be reviewed as part of an Assorted Issues Rule project, which will commence in the second half of the 2022 calendar year. The project will seek to amend CAR Part 1 Definitions and Abbreviations to recognise a new type of crew member onboard an aircraft conducting a commercial transport or hire or reward operation.

   Below is an extract from the Regulatory Impact Assessment setting out the policy objectives and desired outcomes:

   Recommendation

   1. To resolve these longstanding problems, it is recommended that Part 1 be amended to include a new type of person on board an aircraft. This person would be recognised as an ‘additional crew member’ who is carrying out safety-critical tasks onboard the aircraft. Under the status quo, this person would be considered a ‘passenger’.

   2. As part of this amendment, it is recommended that the CAA creates new guidance material to support the changes to the definition of a crew member, and revoke or amend LIB4 (CAA Legal information bulletin No.4) following the above Rule amendments.

   3. This recommendation will allow a more risk-based approach to assessing what level of protection and safety operators need to provide to people on board an aircraft for specific operations. It shifts the focus to the purpose of the operation, and from the narrower status quo based on the operation of the aircraft. Whilst their role is not related directly to control or operation of the aircraft, their actions if poorly conducted, could impact the overall safety of the operation and aircraft. It also recognises the variable nature of the possible risks associated with different types of operations, the roles people carry out within those operations, and the level of risk posed to the travelling public. An acceptable level of safety will continue to protect the public to ensure that risk associated with different types of operations is managed appropriately.

   4. The concept of hire or reward would remain undefined and will continue to be considered on a case-by-case basis by the CAA. However, it is recommended that the CAA do more to articulate the concept and produce clear, external-facing operational guidance that includes different examples of its broad guidelines. This would allow the sector to better understand the CAA’s expectations and interpretation of what is, or is not, hire or reward. This would likely mitigate some of the risks with not having a specific hire or reward definition.

2. While this planned action is acknowledged, no change had yet been made available to the industry by February 2024.
3. The Commission has made a recommendation in Section 6 to address this issue.

General

1. The Commission may issue, or give notice of, recommendations to any person or organisation that it considers the most appropriate to address the identified safety issues, depending on whether these safety issues are applicable to a single operator only or to the wider transport sector.
2. In the interests of transport safety, it is important that recommendations are implemented without delay to help prevent similar accidents or incidents occurring in the future.

Previous recommendations

1. On 12 December 2018 the Commission recommended that the Director of Civil Aviation urgently remind aviation participants of the importance of incident notification in accordance with CAR Part 12 (035/18).

2. On 12 December 2018, the Civil Aviation Authority replied:

   The Director accepts the final recommendation 035/18. The CAA will implement the recommendation by end of January 2019. The Commission will be advised on completion (see 5.10 for this update).

New recommendations

1. On 15 May 2024, the Commission recommended that the Director of Civil Aviation revise the rule, notes and guidance provided for CAR Part 12: Accidents, Incidents, and Statistics to make it clear that a door opening in flight is a safety issue and to take steps to address door-opening-in-flight occurrences that are not being promptly reported to the CAA. (015/24)

2. On 4 June 2024, the CAA replied:

   A rules revision is outside of the Authority’s statutory functions and duties, so the Authority cannot accept the recommendation regarding a revision of CAR Part 12. Any recommendation regarding a revision of the rules, would best be directed to the Secretary for Transport.

   The Authority accepts the aspects of the recommendation relating to the revision of notes and guidance associated with CAR Part 12 and will commence work on adding aircraft ‘doors opening in flight’ to appendix A of AC12-11.

See paragraph 3.136 of TAIC report

1. On 7 June 2024, as a result of this response, the Commission gave notice to the Secretary for Transport: that it had made recommendation 015/24 to the Director of Civil Aviation that may require revision to CAR Part 12.
2. On 15 May 2024, the Commission recommended that the Secretary for Transport and the Director of Civil Aviation resolve the ambiguity in the definition of ‘crew members’ in commercial transport operations and take steps to clarify the use of the term in associated rules and Advisory Circulars. (016/24)

3. On 4 June 2024, the CAA replied:

   The CAA does not believe recommendation 016/24 is necessary in light of the Authority Rules project underway in respect to, in part, the definition of crew member in Part 1 of the Civil Aviation Rules. However, the CAA accepts the recommendation and will continue to address this issue as part of the Rules project. For your information, a Notice of Proposed Rulemaking has been issued but submissions have yet to be considered. The final decision to amend the rule is, of course, the Minister of Transport’s decision.

4. On 4 June 2024, the Secretary for Transport replied:

   As outlined in my letter to you of 19 March, this recommendation is currently being addressed by the Civil Aviation Authority (CAA) as part of the Assorted Issues set of rules. The CAA will undertake a second round of consultation on the Notice of Proposed Rule Making in July 2024. Once submissions have been received, the Ministry will work with the CAA to make recommendations to the Minister of Transport.

    

1. A helicopter door opening in flight presents a significant risk to the helicopter and its occupants. Pilots should report all unintended incidents of doors opening in flight. These records may identify trends and will assist in thorough investigations of the causes and enable appropriate rectification.
2. All unsecured items in a helicopter cabin can have fatal consequences. All items in a cabin should be appropriately secured before flight.
3. A Standard loading plan can provide a simple check that an aircraft is being operated within the manufacturer’s weight and balance limitations. To be effective, the conditions specified in the plan must be clear and be met.
4. Aircraft manufacturers should clearly describe how maintenance tasks are to be conducted and what to expect when equipment is performing correctly.
5. Aircraft engineers and general aviation maintenance organisations must ensure maintenance is conducted in accordance with aircraft manufacturers’ approved repair and maintenance procedures.
6. When Civil Aviation Rules are clear and unambiguous, it is more likely that aviation participants will comply with them.
7. Cockpit video recorders, where fitted, can provide valuable information on the causes of accidents and help avoid recurrences.

1. On 18 October 2018, the CAA notified the Commission of the occurrence. The Commission subsequently opened an inquiry under section 13(1) of the Transport Accident Investigation Commission Act 1990 and appointed an investigator in charge.
2. Three investigators and a communications advisor were deployed to the site and arrived later that night. They started the site inspection the next day.
3. The Police secured the accident site and managed site activities in co-ordination with the Commission’s investigator in charge. Police were treating the accident scene as a crime scene at that point.
4. Police resources for their operation included: sworn officers to conduct witness identifications and interviews; a specialist site-search team; a police photographer and drone operator; evidence collection; and victim identification and removal personnel. Police had control of the accident site until the victims had been removed.
5. Police identified eyewitnesses and conducted preliminary interviews. The Commission obtained copies of the Police interview statements and separately interviewed some of the eyewitnesses again. The Commission conducted interviews with the operator, other operators, DOC, families and aerodrome personnel.
6. The wreck was transported to the Commission’s technical facility in Wellington for a detailed examination.
7. After the site had been cleared on 20 October 2018, the operator and members of the public assisted the investigation team by searching outside the cordoned area for missing parts of the main rotor blades and the tail rotor. These were located and handed to the investigators.
8. Copies of documents and other information were obtained from the operator and other relevant parties for later analysis.
9. An Evidence Protection order for the accident site was issued on 1 November 2018 and distributed with the assistance of the operator, Police, local DOC staff and local newspapers. This was revoked on 28 June 2019.
10. A USA National Transportation Safety Board accredited representative was appointed and they appointed technical advisors from MDH and Tech-Tool Plastics Incorporated.
11. An interim report was approved by the Commission for publication in December 2018.
12. On 13 December 2018 the Commission recommended that the Director of Civil Aviation urgently remind aviation participants of the importance of incident notification in accordance with Part 12 of the Civil Aviation Rules (035/18). The Director accepted the final recommendation and stated that the CAA would implement the recommendation by the end of January 2019.
13. On 24 March 2021 the Commission considered a draft report. This was revised and resubmitted on 25 August 2021, when it was approved for circulation to 10 interested persons in New Zealand and four overseas for their comment. Submissions closed on 14 December 2021. All 14 interested persons responded and the Commission received 10 submissions.
14. The Commission consented to the operator examining the wreckage. This was conducted under supervision on 2 February 2022.
15. The submissions on the draft report were considered, and a summary document was provided for Commission consideration on 22 February 2022.
16. New evidence was submitted on 27 June 2022. This led to a second ground search being conducted by the Commission on 3 November 2022. The new evidence was examined and considered, and further analysis conducted.
17. On 16 October 2023 at an extraordinary meeting, the Commission considered the second draft report and the submissions from interested persons received on 14 December 2021. This draft report was revised with Commissioners’ comments and resubmitted for Commission consideration on 14 December 2023.
18. On 21 February 2024 the Commission approved a further revised draft report for circulation to 15 interested persons for their comment.
19. Eight interested persons provided detailed submissions and seven interested persons replied that they had no comment. All interested persons responded. Any changes as a result of the submissions have been included in this final report.
20. On 6 June 2024, the Commission approved the final report for publication.

Avers, K. E. (2011). Prioritizing maintenance human factors challenges and solutions: Workshop proceedings. (Report No. DOT/FAA/AM-11/11). Federal Aviation Administration, Office of Aerospace Medicine.

CAA. (2009, August). Legal notices and information bulletins. Retrieved from Civil Aviation Authority: https://www.aviation.govt.nz/assets/about-us/legal-information-bulletin-004.pdf

Drury, C. B. (2017). Why do we STILL not Follow Procedures? Proceedings of the Human Factors and Ergonomics Society 2017 Annual Meeting.

Drury, C. G. (2013). Writing aviation maintenance procedures that people can / will follow.

Proceedings of the Human Factors and Ergonomics Society Annual Meeting. Santa Barbara, CA: Sage Publications.

Drury, C. G. (2017). Failure to follow written procedures (Report No. DOT/FAA/AM-17/17).

Federal Aviation Administration, Office of Aerospace Medicine.

FAA. (1998, 09 07). AC 43.13-1B, Acceptable methods, techniques, and practices - Aircraft inspection and repair. Retrieved from Federal Aviation Administration - Advisory Circulars: https://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.i nformation/documentID/99861

Fogarty, G. (2004). The role of organizational and individual differences variables in aircraft maintenance performance. International Journal of Applied Aviation Studies, 4 (3), 73-90.

Fogarty, G. J. (2003). Modelling errors and violations in high-risk industries. Proceedings of the 38th Australian Psychological Society Annual Conference (pp. 65-69). Melbourne, Australia: Australian Psychological Society.

Hobbs, A. &. (2000). Aircraft maintenance survey results. Canberra: Australian Transport Safety Bureau.

Hobbs, A. &. (2003). Associations between errors and contributing factors in aircraft maintenance. Human Factors: The Journal of the Human Factors and Ergonomics Society, 45, 186-201.

Hobbs, A. &. (2008). Patterns of error in confidential maintenance incident reports. The International Journal of Aviation Psychology, 10(1), 5-16.

J.D Stachiw, J. S. (1989). Crazing and degradation of flexure strength in acrylic plates as a function of time. San Diego: Naval Oceans Systems Center, Technical report 1303.

Johnson, W. B. (2001). Installation Error in Airline Maintenance. Washington, DC: Federal Aviation Administration Office of Aviation Medicine.

Key, K. S. (2022). Procedural compliance in aviation maintenance. Handbook of best practices and recommendations. . Federal Aviation Administration, Office of Aerospace Medicine.

NTSB. (1988). National Transportation Safety Board Aviation accident final report, Accident number NYC88LA083. Waterfall.

NTSB. (1989). National Transportation Safety Board Aviation accident final report, Accident number SEA90LA010. Neah Bay.

NTSB. (1993). Accident report LAX93LA323. Chico: National Transportation Safety Board, USA.

NTSB. (1995,1). Accident report LAX95FA225. Highland: National Transportation Safety Board,USA.

NTSB. (1995,2). Accident report LAX95TA328. Pearl City, Honolulu: National Transportation Safety Board, USA.

NTSB. (1997,1). Accident report LAX97FA107. Milolii, Hawaii: National Transportation Safety Board.

NTSB. (1997,2). Accident report FTW97LA347. Brinkley: National Transportation Safety Board.

NTSB. (1998). Accident report SEA98LA160. Oso: National Transportation Safety Board, USA. NTSB. (2000). Accident report LAX01FA006. Kernville: National Transportation Safety Board, USA.

NTSB. (2003). Accident report LAX03TA150. Pan Tak, Arizona: National Transportation Safety Board, USA.

NTSB. (2012). Accident report WPR13CA071. Pasadena: National Transportation Safety Board, USA.

NTSB. (2014). Accident report WPR14CA363. Willows: National Transportation Safety Board, USA.

Rankin, W. (2008). Safety management systems and Boeing-related safety activities.

Presented November 6-7 at the Safety Management System (SMS) Workshop for Air Transport Industry. Air Transport Industry.

Simula Inc. (1989). Aircraft crash survival design guide, Vol II - Aircraft design crash impact conditions and human tolerance. US Army Aviation Systems Command, AVSCOM. Phoenix: AVSCOM.

TAIC. (2010). Aviation inquiry AO-2010-009, Loss of control, Fox Glacier. Retrieved from Transport Accident Investigation Commission: www.taic.org.nz

TAIC. (2011). Aviation inquiry AO-2011-006, Runway excursion Pauanui Beach Aerodrome.

Retrieved from Transport Accident Investigation Commission: www.taic.org.nz

TAIC. (2014). Aviation Inquiry AO-2014-005, Collision with terrain, Mt Alta. Retrieved from Transport Accident Investigation Commission: www.taic.org.nz

TAIC. (2015). Aviation inquiry AO-2015-007, Collision with terrain, Fox Glacier. Retrieved from Transport Accident Investigation Commission: www.taic.org.nz

TAIC. (2017). Aviation Inquiry AO-2017-004, Loss of control, Porirua Harbour. Retrieved from Transport Accident Investigation Commission: www.taic.org.nz

TAIC. (2018). Interim report AO-2018-009: MDHI (Hughes) 369D, Registration ZK-HOJ, Wanaka, 18 October 2018. Wellington: Transport Accident Investigation Commission.

TAIC. (2019). AO-2019-005, BK117-C1, ZK-IMX Controlled flight into terrain (water), Auckland Islands.

US Federal Government. (2021). Electronic Code of Federal Regulation. Retrieved from https://ecfr.federalregister.gov

These images are of the left-rear door-latching system to demonstrate the wear, the general condition and the free slack movement in the door-latch mechanism.

A4.1 MDH changed the type of latch block at the time this helicopter went through the production line. The Change Order had a transition period that included this helicopter. Subsequent ‘D’ models after the transition period and the later ‘E’ models are fitted with a different style latch block called the hook and pin.

A4.2 The hook and pin style latch bolt has a hook, instead of the wedge shown above, that wraps around a pin fitted on the door frame. As the latch is shifted into safe lock, the hook grips the pin and pulls the door against the door frame.

Note that the green tags and strips of black tape are not relevant. The percentage value represents the estimated amount of that windshield that was recovered.

A7.1     Under Civil Aviation Rules Part 135 – Air Operations – Helicopters and Small Aeroplanes, air operations are categorised as being either Air Transport Operations (ATOs) or Commercial Transport Operations (CTOs). An ATO is an operation for the carriage of passengers or goods by air for hire or reward, except, among other reasons, where that operation is a CTO. A common example of an ATO is a scheduled flight between two airports. A CTO is an operation for the carriage of passengers or goods by air for hire or reward and includes where a passenger is performing a task or duty associated with the operation of an aircraft, or the passengers or goods are carried to or from a remote aerodrome. All parts of the CTO definition were applicable to the operator for the accident flight.

A7.2    A passenger is defined in Civil Aviation Rules Part 1 as any person carried by the aircraft, other than a crew member.

A7.3    The current definition of a crew member is provided in Part 1:

A ‘crew member’ means a person carried by an aircraft who is—

(1) assigned by the operator—

(i) as a flight crew member or flight attendant to perform a duty associated with the operation of the flight; or

(ii) to perform a duty associated with the operation of the aircraft during flight time; or

(2) carried for the sole purpose of—

(i) undergoing or giving instruction in the control and navigation of the aircraft; or\

(ii) undergoing instruction as a flight engineer or flight attendant; or

(3) authorised by the Director to exercise a function associated with the operation of the aircraft during flight time; or

(4) a flight examiner:

A7.4    The CAA gave notice of the proposed introduction of Civil Aviation Rules Part 135 on 13 December 1995 and revised the definition of a crew member in 1998 (Civil Aviation Rules Part 1 amendment 13) and again in 2002 (Part 1 amendment 27). The 2002 change also added a new term of ‘flight crew member’.

A7.5    There appears to be a difference between how some operators and the CAA interpret ‘crew member’, including whether an operator can assign a passenger as a crew member, and what constitutes the ‘operation of a flight’.

A7.6    In 2007 and 2008 these issues were considered in two District Court decisions (see details in CAA Legal Interpretation Bulletin No.4). While neither decision created a binding precedent, the interpretation in one case was consistent with the CAA’s position.

A7.7    By 2008 the CAA was becoming increasingly concerned that some CTO activities were being carried out under Civil Aviation Rules Part 91 rather than Part 135, and that some passengers were being incorrectly regarded as crew members.

A7.8    In response it issued Legal Information Bulletin No.4 in 2009, to clarify to operators the CAA’s interpretation of the terms ‘crew member’ and ‘CTO’ for the purpose of determining what was a Part 135 air operation. In that document the CAA states, “the legal requirement to hold an Air Operator Certificate is based on the fundamental policy that operations involving the carriage of passengers and goods for hire or reward should require a higher level of safety regulation and CAA oversight than other air activities” (CAA, 2009) (CAA Legal Information Bulletin No.4 (LIB4)).

A7.9    In drafting the bulletin, the CAA met with industry participants. The addition of a ‘supplementary crew member’ was considered for occupants who carried out specific duties or tasks integral to flight operations (for example, shooters, police observers, fire crews and search-and-rescue workers). The logic was that these occupants were typically extensively trained and integral to the operations.

A7.10 While the CAA agreed with the logic, it remained of the opinion that those occupants should still be afforded the higher regulatory level of protection as fare-paying passengers. As such, the CAA would have labelled these occupants as ‘passengers performing duties or tasks’ within the definition of CTO.

A7.11  It is the position of the CAA that for a person to be assigned to duty as a crew member within clause (1) of that definition, the ‘duty’ must be one that relates to the safe operation of the flight or aircraft during flight, and one in which the operator has a responsibility to ensure the assigned person is appropriately qualified or approved to perform, in accordance with the prescribed requirements of the Civil Aviation Rules. The existence of an employment or contractual relationship with an operator, while relevant, is not determinative on its own of whether a person is carried as a crew member.

A7.12 The version of Civil Aviation Rules Part 135 current at the time (Amendment 23, effective 30 October 2017) used both ‘crew member’ and ‘flight crew member’ but not the phrase ‘passenger performing a task or duty’. For example, Part 135, Subpart B, Flight Operations, 135.55 requires crew members to have a common language with at least one flight crew member. In Subpart E – Weight and Balance, crew member weights must be allowed for as distinct from those of passengers. Subpart H – Crew Member Requirements goes on to describe the requirements for flight crew only.

According to Subpart I – Training, crew members must be trained, and Subpart J – Crew Member Competency Requirements states that crew members must be competent as distinct from flight crew.

A7.13 A person reading Part 135 could conclude that there are two distinct roles defined for Part 135 air operations: flight crew, and crew members who are not flight crew but who perform tasks during a flight.

A7.14 ‘Crew member’ is also commonly used by Civil Aviation Rules Part 119/135 operators in their expositions for their respective Air Operator Certificates to describe shooters, police observers, fire controllers, winch operators and paramedics when carried on board for particular helicopter tasks.