DCA16FA199

A severe vibration of the helicopter that led to the crew's inability to maintain sufficient rotor rotation speed (Nr), leading to excessive main rotor blade flapping, subsequent main rotor blade contact with the tail boom, and the resultant in-flight breakup. Contributing to the severity and sustainment of the vibration, which was not predicted during development, were (1) the collective biomechanical feedback and (2) the attitude and heading reference system response, both of which occurred due to the lack of protections in the flight control laws against the sustainment and growth of adverse feedback loops when the 6-hertz airframe vibration initiated. Contributing to the crew's inability to maintain sufficient Nr in the severe vibration environment were (1) the lack of an automated safeguard in the modified one-engine-inoperative software used during flight testing to exit at a critical Nr threshold and (2) the lack of distinct and unambiguous cues for low Nr.

The experimental research and development helicopter was undergoing developmental flight tests before type certification. On the day of the accident, the helicopter test crew was performing a series of one-engine-inoperative (OEI) tests at increasing airspeeds with a heavy, forward center-of-gravity configuration. (For the OEI tests, the pilots used OEI special training mode software to reduce the power of both engines to a level that simulated the loss of one engine.) The crew initiated the final planned OEI test at a speed of 185 knots. After the crew engaged OEI special training mode, rotor rotation speed (Nr) decayed from 100% to about 91%, and the crew began lowering the collective to stop Nr decay and increase Nr to 103% (the target Nr for recovery). About 5.5 seconds into the test, the crew stopped lowering the collective, and Nr only recovered to about 92%. About 6 to 7 seconds into the test, the helicopter began vibrating at a frequency of 6 hertz (Hz). The vibration was evident in both rotor systems, the airframe, the pilot seats, and the control inputs; the vertical vibration amplitude at the pilot seat peaked about 3 G. (G is a unit of measurement of acceleration; 1 G is equivalent to the acceleration caused by the earth's gravity [about 32.2 ft/sec2].) Nr remained between about 90% and 92% until about 12 to 13 seconds into the test, then began fluctuating consistent with collective control inputs; subsequent collective control input increases led to further decay in Nr. Nr decayed to about 80% as the collective was raised, and the main rotor blades began to flap out of plane. About 21 seconds into the test, the main rotor blades flapped low enough to impact the tail boom, severing it and causing the in-flight breakup of the helicopter.  The main rotor, tail rotor, flight controls, powerplants, and rotor drive systems exhibited no evidence of preexisting malfunction before the vibrations began. The structural wreckage did not exhibit evidence that the oscillations themselves resulted in a structural failure leading to the in-flight breakup. Examination of the wreckage revealed no indications that the helicopter had been improperly maintained.  Helicopter Performance After Stop in Nr Recovery During previous OEI tests, the crew lowered the collective input to near or below 50% to allow Nr to recover. As airspeed increased during each test, the crew took longer to recover Nr to 103%. (At 102 knots, recovery time was 3.4 seconds, and at 175 knots, recovery time was 13 seconds.) However, after initiating the final OEI test at 185 knots, the crew only lowered the collective to 58% and subsequently only recovered Nr to 92%. While at 92%, the main rotor scissors mode was excited. (The main rotor scissors mode occurs when the lead-lag motions of the blades act in such a way that adjacent blades move together and apart in a scissoring motion. See the factual report for more information about the scissors mode.) The main rotor scissors mode excitation resulted in the 6-Hz airframe vertical vibration, which was transmitted to the crew seats and created a biomechanical feedback loop through the pilot-held collective control. A second feedback system, driven by the attitude and heading reference system (AHRS) inputs to the main rotor swashplate, also continued to drive the scissors mode and its resultant 6-Hz airframe vibration. Biomechanical Feedback Biomechanical feedback in the aircraft design industry refers to unintentional control inputs resulting from involuntary pilot limb motions caused by vehicle accelerations. The gain between the vertical acceleration and 6-Hz collective stick movement can be calculated by dividing stick movement by vertical acceleration. (If no biomechanical feedback existed, there would be no gain [0 inch per G].) During the accident, the collective stick moved, on average, 0.2 inch per every G of seat acceleration. The "nonzero" relationship between the control stick amplitude and the seat vibration illustrates that biomechanical feedback contributed to the helicopter's vibration. Further, a positive value of pilot gain occurred near 6 Hz, which indicates instability in the system (meaning that any input to the system will amplify as opposed to dampen). Thus, biomechanical feedback contributed to increases in vibration amplitude during this accident.  Although the helicopter manufacturer's design process for biomechanical feedback included software filters in the cyclic control laws to reduce certain types of oscillatory cyclic control inputs by the pilot, no filter was designed for the collective. Thus, the 6-Hz oscillatory collective inputs by the pilot were not filtered. As a result, a control feedback loop began when the pilot-held collective stick commanded an oscillatory collective pitch input (about 6 Hz) into the main rotor, increasing the 6-Hz vibration, which in turn increased the magnitude of the oscillatory (6-Hz) collective pitch input. In addition, the gain between the pilot movement and the collective control stick movement in the vertical axis was never tested on a shake table before the accident. For the cyclic control, lateral vibration was introduced on a shake table. This test was conducted specifically for the helicopter model's side-stick cyclic since the manufacturer expected a different transfer function from that of a traditional cyclic. For the collective control, no such test was conducted despite this being the first helicopter with a side-stick collective control. While it is possible that the decision to not shake test in the vertical axis to inform the pilot model could have been influenced by schedule pressure, interviews did not suggest that decisions would have been different given the lack of anticipation of scissors mode and resulting aerodynamic effect. Attitude and Heading Reference System The AHRS is designed to detect uncommanded accelerations (such as the helicopter's reaction to a gust of wind) and reduce their effects by automatically providing corrective inputs to the main rotor swashplate. The AHRS detected and responded to the 6-Hz airframe vertical vibration in a manner that sustained the main rotor scissors mode and its resultant 6-Hz vibration. Specifically, analysis of the telemetry data revealed that the AHRS responded to the 6-Hz vibration with inputs to the main rotor swashplate analogous to a "cyclic stir" (when the cyclic control stick is moved in a stirring motion). The helicopter manufacturer's assessment of the AHRS-induced cyclic stir swashplate motion was that it would exacerbate the main rotor scissors mode. The AHRS is intended to respond primarily to lower-frequency uncommanded accelerations. Because the helicopter manufacturer did not predict an excitement of the scissors mode in the accident test flight conditions, the filter design of the AHRS allowed it to respond to the 6-Hz airframe vibration. Thus, the AHRS detected and attempted to attenuate the 6-Hz airframe vertical vibration, but its response instead exacerbated the main rotor scissors mode and its resultant 6-Hz vibration, closing the AHRS feedback loop. Reasons for Crew Stop in Nr Recovery Investigators explored possible reasons why the crewmembers stopped their recovery from the initial Nr droop, including a reaction to an abnormal condition on the helicopter, distraction from the recovery task, or a conservative response due to the high airspeed. Telemetry data does not indicate the existence of an abnormal condition when the crewmembers stopped their recovery. In addition, the chase helicopter crewmembers reported seeing no distractions or abnormalities outside of the helicopter (for example, birds). Therefore, investigators focused on the crew's increasingly conservative response as the airspeed increased during the tests. During the previous OEI tests, as airspeed increased, the crew recoveries took more time to reach 103% Nr and collective r

The accident helicopter was equipped to carry a pilot and copilot with no passengers and was not required to be equipped with either a flight data recorder (FDR) or cockpit voice recorder (CVR) under the provisions of 14 CFR 91.609. A combination CVR and FDR (CVFDR) was installed but was not operational at the time of the accident. (When certified as a transport-category rotorcraft under 14 CFR Part 29, the Bell 525 will be equipped with both CVR and FDR recording capabilities.) The accident helicopter was heavily instrumented with several aircraft- and ground-based recording systems, both production and flight-test based, including a streaming telemetry system, helicopter monitoring unit (HMU), avionics recorders, and PFD/MFD recording capability. The National Transportation Safety Board (NTSB) received the following components with flight data recording and storage capabilities: Simmonds Precision Products Vigor HMU (serial number [S/N] 0006); CVFDR (S/N 009-01029); 128 gigabyte (GB) solid-state drive (SSD) from aircraft high-speed avionics bus (S/N TW-032GYJ-55085); 4 SD memory cards (S/N unknown); and Zodiac Aerospace remote storage module (RSM) 128 GB (S/N 052405-112012). Regarding the HMU and 4 SD memory cards, all the data was available from other sources. Regarding the CVFDR, the data download file was determined to be blank; the FDR may not have been receiving data or been fully configured in the helicopter. Regarding the SSD, due to the extent of the damage, no data could be recovered. Zodiac Aerospace RSM 128 GB The Zodiac Aerospace RSM, the data storage medium of the flight test recorder system installed on N525TA, is a solid-state hard drive with 128 GB capacity and an integrated E-SATA download interface. The data recorded on this drive, which was typically downloaded after each test flight, was the primary data source for Bell's flight test analysis team and was sourced from the following sensors and aircraft systems: Flight test strain gauges in the fuselage, main rotor, tail rotor, engine, and engine mounts. Production accelerometers in the drive system, rotors, and engine/APU. Flight controls data bus including ARINC-429/1553/RS-232/RS-485. Hydraulic system temperatures, pressures, and flows. Production and flight test air data systems, including temperatures and pressures. Both engines, all engine control channels of temperatures, pressures, speeds, gearboxes, and shafts. Flight test temperature readings in the aircraft skin. Avionics and flight displays systems. The data stream recorded by the RSM was also transmitted via a telemetry stream to a ground station at Bell's flight-test facility for real-time analysis and recording. The RSM, which was ejected from the helicopter during the crash sequence and was found apart from the main wreckage, was in good condition, with no apparent impact or thermal damage. Bell extracted the data under the NTSB's supervision. The RSM recording contained about 1 hour 26 minutes of data, including preflight and flight activities; the event flight was the only flight recorded on the drive. Once processed, the data was segregated into "prime" data (data taken during a test) and "non-prime" data (data taken at all other times). There were 41 periods of prime data in the recording, including the period up to and including the end of the recording. The RSM engine data showed that the engines were operating as commanded throughout the flight. (More information about test 51 can be found in the Tests and Research section.) The Bell 525 program consisted of the conceptual design phase, preliminary design review, critical design review, flight readiness review (FRR), developmental flight testing, and certification flight testing. Investigators interviewed Bell design and test engineers who described the pace of the Bell 525 program at the time of the accident as fast but not unreasonably so. Personnel described specific pressure felt during the time of the first flight test in Amarillo, Texas, in mid-2015. When personnel were supporting the first flight, they commonly worked 7 days per week and logged between 60 and 70 hours of work per week. Many described morale to be low during the first flight. Once the flight test program moved back to Arlington, Texas, in September 2015, the pace slowed, and many reported improved morale. Original certification for the Bell 525 was scheduled for mid-2016, but the program faced various setbacks during initial design. Most engineers interviewed stated that they had not received undue pressure from management to complete tasks. No monetary incentives (outside of overtime pay) were provided to employees, and employees were not concerned about negative consequences when raising concerns. Employees described Bell's safety culture as "good." At the time of the accident, design and test engineers reported working about 10 hours of overtime per week on average. The chief engineer for the Bell 525 program was responsible for all 525 testing, certification activity, and structures (drive, rotor, and airframe). Six discipline areas reported to the chief engineer: airframe engineering, systems engineering and certification, rotors engineering and component test, drive systems, flight technology, and flight test/experimental test and evaluation. The 525 program flight test integrated product team (IPT) consisted of 12 flight test engineers and 3 instrumentation engineers. Six of the 12 flight test pilots in Bell's experimental test and evaluation department were assigned to support the 525 program. The chief engineer worked closely with the air vehicle IPT; the air vehicle lead was responsible for flight control system and software, control laws, avionics, electrical system, propulsion, hydraulic system, fuel system, and environmental controls. According to a Bell avionics engineer, before the FRR, the avionics group developed a spreadsheet of all the CAS functions and whether they were designated as critical or not critical for flight safety; they tested the safety-of-flight functions using scripts or a CAS manual test. The results for each function were "passed," "passed with exception," "failed," or "safe." A "failed" state indicated that the alert did not annunciate or annunciate in time. According to the Bell 525 lead test pilot, if no pilot action was required, then the alert would be an advisory or would only be available on the maintenance page. If pilot action was required, they referred to the following CAS philosophy: for anything requiring pilot action immediately, it was a warning; if it required action, but not immediately, it would be a caution; or, if action was required much later, it would be advisory information. The Bell 525 lead test pilot described the difference between caution and advisory as a gray area. "Safety critical" referred to messages for which if nothing was done, it would "break the helicopter, or cause the helicopter not to be flown right, or it would exceed a limit." All the warnings counted as safety critical, as did some cautions. He stated that the decision for what was critical came from the cockpit working group, which worked with other systems groups, pilots, a safety representative, and the individual who conducted design safety analysis, and all the decisions were documented. The cockpit working group created the list of safety-critical items. The list was then vetted and sent to the avionics group for implementation. According to Bell Helicopter, test pilot duties included planning and conducting experimental flight tests in helicopters and tiltrotor aircraft; conducting other flight test operations; maintaining flight currency and traveling in support of Bell Helicopter flight operations; completing flight analysis and flight evaluations of aircraft, test planning, and flight test reports; planning and executing engineering and experimental test flights of new aircraft and/or s