Accident Recovery: Underestimated Safety Risk

Accident Recovery: Underestimated Safety Risk

An open helicopter door triggers a disastrous sequence of events.

By David Jack Kenny

Small errors can have grave consequences. While this fact is not exactly news in aviation and especially the rotorcraft sector, it seems to merit periodic repetition. Over time, the history of accidents shows a pattern of gradual erosion of standards arrested only after an avoidable tragedy shocks the industry back into paying attention.

The Mission

On the morning of Oct. 18, 2018, the pilot and two Department of Conservation rangers met at the Wānaka Airport (NZWF) on New Zealand’s South Island to prepare for what the Transport Accident Investigation Commission (TAIC) later described as “an airborne wildlife-culling operation.” The plan was to load a commercial operator’s MD Helicopters MD 500D with equipment and supplies, including some to be handed off to a second helicopter’s crew, and fly to a remote staging area near the Landsborough River in the Southern Alps. From there, they would make several flights with the doors off to conduct the hunt.

In addition to four rifles and 4,000 rounds of ammunition, the cargo included the crew’s cold-weather overalls, recording equipment to document the cull, a cooler containing food and drink, and two 20 L cans of jet fuel. By 10:45 am, it had all been loaded into the cabin, with most items stowed on the floor or under the left side of the rear bench seat.

Press reports indicate the operation was intended to control Himalayan tahrs, large goatlike mammals that were deliberately introduced to New Zealand as big-game trophies in 1904. In the absence of any natural predators, their ability to subsist on a wide variety of vegetation led their populations to increase to the point that their grazing inflicted extensive damage on the landscape and its plant life, threatening the survival of native species that rely on that foliage for food and cover. Tahrs were recognized as a threat to the environment as early as 1930, their numbers having doubled in the first 16 years. Hunting remains the principal method of keeping the population in check, and while their eradication from New Zealand is believed feasible, it hasn’t been pursued due to their popularity with recreational hunters and the income those hunts provide to landowners.

The Flight

Images from two digital camera systems on the airport grounds showed that by 10:45, the helicopter had been pulled from its hangar, refueled to capacity, given its preflight inspection, and loaded. It lifted off at 10:53 with one of the sharpshooters in the right front seat and the other on the right side of the rear bench. The pilot air-taxied to the approach end of Runway 11 and then climbed to 300 ft. above the runway centerline. The pilot advised a Robinson helicopter in the traffic pattern of his intention to depart early before turning left and climbing to 500 ft. on a northerly heading.

Witnesses at the airport recalled seeing the helicopter rotating as it descended “near vertically, with items trailing behind it” until the aircraft disappeared from sight behind the escarpment north of the field. Two experienced flight instructors were in the Robinson, watching the MD 500D to maintain separation. One saw “items exiting the helicopter toward the tail rotor.”

Moments later, the tail boom bent upward and separated from the cabin and the helicopter spun to the ground in a flat attitude “with several items being flung out.” The other instructor described “items being ejected from the cabin that looked like confetti” as the aircraft spun. It took about five seconds for the helicopter to hit the ground and catch on fire.

The Robinson pilots flew to the scene and orbited, making Mayday calls and summoning emergency services, then landed just southwest of the main wreckage. “Light debris” was still falling as they climbed out. Firefighters, police, and ambulances reached the scene about five minutes later. The fire was brought under control, but all three occupants of the helicopter had been killed. Because the operator had received threats from opponents of the cull, the police initially treated the debris field as a crime scene.

Impressions from the pilot’s black overalls appear on the tail-rotor blade (above) and tail boom (below). The garment had snagged on the blade, breaking it and ultimately shattering the tail-rotor gearbox. (Transport Accident Investigation Commission Photo)

The Aircraft

The MD 500D (variously known as the Hughes 369D and Hughes 500D) is powered by a 420–shaft horsepower Rolls-Royce M250-C20B turboshaft engine driving a five-blade fully articulated main rotor and a semirigid two-blade tail rotor. The operator had leased the 1979 model aircraft on Aug. 31, 2018, to fill a gap in its fleet until two newly ordered helicopters arrived. As of Oct. 15, 2018, its total time in service had reached 19,469.25 hours, while its engine, built in 1977, had operated for 18,569.85 hours. Its most recent 100-hour inspection had been completed on Jun. 25, 2018, not quite four months before the accident, at 19,430.50 hours of operation.

The Pilot

The 38-year-old pilot earned his commercial license in 2007 and had accumulated about 5,500 hours of rotorcraft flight time in addition to 314 hours in single-engine airplanes, for which he held a private pilot rating. He held current approvals for sling loads, agricultural application, and Part 135 passenger operations. His most recent Part 135 flight test was completed about three months before the accident with an October 2019 expiration date. He also held ratings in the Robinson R22 and R44 and Airbus AS350. He had flown 67 hours in the preceding 90 days, including 35 in the MD 500D, in which he’d logged 1,138 hours of career experience.

He was also the son of the company founder and the youngest brother of a pilot killed just three months earlier when his R44 crashed into Lake Wānaka, an accident attributed to mast bumping. Their two older brothers, also pilots, made a tribute flight over his memorial service.

The Investigation

The debris field began more than 150 m (492 ft.) before the main wreckage and continued at least as far beyond, to the far side of the Clutha River, while spreading almost as far to either side. Data recovered from a Garmin GPSMap 296 and an iPhone allowed reconstruction of the helicopter’s flight path. Moving along that track from south to north, the first pieces of wreckage were one tail-rotor blade, the tip of another, the tip of one main-rotor blade, and the tail boom, all slightly to the left of the flight path, while the tail-rotor bell crank was farther off to the right.

Another main-rotor blade was just behind the main wreckage, which was largely consumed by fire; the tips of two other blades were found about 200 m to the right. The tail-rotor driveshaft and left rear door were just ahead on the left, while the tail-rotor gearbox was well off to the right, about 50 m ahead of the second main-rotor blade tip. Five ammunition boxes and the two fuel containers were found another 50 m to 100 m north. A few fragments of the acrylic windshield made it to the far side of the river; about 40% of the windshield presumably fell into the river and was not recovered.

The distribution of the fragments corroborated witness accounts of an in-flight breakup. TAIC investigators determined that “impact marks on the tail-rotor blade and tail-rotor gearbox matched the profile of the leading edge or a main-rotor blade” and that the tail boom had also been severed by the main rotor. A torque twist in the tail-rotor drive­shaft “was consistent with the engine having driven it against a solid resistance at the tail-rotor end.”

The left rear door was free of burn marks, showing that it had detached from the cabin before the post-impact fire. The fact that heavy items such as the ammunition boxes had been carried far ahead despite the helicopter’s near-vertical descent indicated they “had been flung out of the rear cabin” as the aircraft spun.

Crucially, the first large item in the debris field was the pilot’s black cold-weather overalls, which had snagged on one tail-rotor blade and “flailed around until the tail-rotor blade broke off.”

This imposed loads that twisted the tail-rotor driveshaft; at 3,200 rpm, the resulting imbalance shattered the tail-rotor gearbox.

The overalls had been slashed, and paint transfer marks on one leg “matched the color and profile of the tail-rotor blades,” one of which bore witness marks matching the overalls’ zipper and snap fastener. Similar witness marks were found on the left side of the tail boom. These proved to be the clues that enabled the TAIC to reconstruct the accident sequence, though the commission’s report acknowledges some uncertainty about the exact order of some events.

The accident sequence was triggered when the left rear door opened about two minutes after takeoff. The TAIC listed seven possible reasons this might have happened, ranging from the plausible—failure to latch the door properly before takeoff, or a mechanism that was worn and out of adjustment—to the highly unlikely (such as someone had opened the door deliberately). In any case, unsecured items immediately began leaving the cabin.

The remnants of the tail-rotor assembly pitched forward into the main-rotor disc, snapping the outermost 500 mm (20 in.) off two blades. This tilted the main-rotor disc out of its normal plane until the main rotor severed the tail boom, rendering the aircraft uncontrollable. The left rear door was wrenched from its hinges as the aircraft spun and was also struck by the remaining main-rotor blades. As the helicopter slowed, the remaining cargo was flung from the opening the door left behind. The entire chain of events, from door opening to final impact, lasted barely 20 seconds.

The Response

After the accident, the TAIC was informed that doors on the same helicopter had opened on four other flights in the preceding two weeks. One involved the left rear door, the other three the right front. None were reported via the operator’s safety management system or recorded in the ship’s technical logs. All were resolved safely after precautionary landings.

In an interim report in December 2018, the commission issued safety recommendations that included a reminder of the importance of reporting accidents and incidents. Nationwide, reports of doors opening increased thereafter but quickly tailed off again, dropping from 42 in 2019 to just 14 in 2022.

Interviews with maintenance staff found that they were unfamiliar with the manual chapter that detailed procedures for inspecting door seals, latches, and hinges—perhaps because that chapter was listed as specific to three related models but not the MD 500D. Routine checks during 100-hour inspections largely consisted of latching the doors, then trying to push them open from inside.

The manufacturer stated that all parts eligible for replacement on condition—that is, without service-time limits—had a minimum life of 20,000 hours. The door latch assemblies in the accident helicopter were original to the aircraft, which had flown almost 19,500 hours.

The mechanism in the left rear door, which largely escaped damage, and those in the other three doors (intact aside from fire damage) all showed enough wear in the various latches and linkages to create significant “slop” in their operation.

In response, MD Helicopters revised its maintenance manual to clarify and detail procedures for checking the “proper operation of latching and locking mechanisms.” The TAIC found that this adequately addressed the safety risk and declined to issue further recommendations.

The 2018 interim report also called attention to the risks posed by keeping loose items in the cabin. The operator generally didn’t secure cargo in the MD 500D when it was flown with the doors on, instead trying to pack items tightly enough to prevent them from moving in flight. They had previously experimented with cargo nets but found that they created other hazards (not specified in the report). Following the accident, they fitted the replacement helicopters with cargo pods mounted between the skids with their contents packed in heavy plastic zippered bags.

New Zealand’s civil aviation authority (CAA) issued a safety message in November 2018 reminding operators to secure loose items in helicopter cabins, a response the TAIC found sufficient to address the immediate safety risk.

Finally, to guard against “risk normalization of helicopter doors opening in flight,” the commission made a safety recommendation to the CAA on Dec. 12, 2018, urging the authority to remind operators of their obligation under Civil Aviation Rules (CAR) Part 12 to report accidents and incidents. The CAA accepted this recommendation and issued a series of related publications in 2019 and 2022. In addition to detailing the regulatory requirements, the CAA assured operators that their reports would not serve as the basis for any enforcement actions unless “reporting is patently incomplete or reveals reckless or repeated unsafe behavior.”

The TAIC also recommended that the CAA “revise the rules, notes, and guidance” to CAR Part 12 “to make it clear that a door opening in flight is a safety issue and to take steps to address occurrences that are not being promptly reported to the CAA.” The CAA agreed to revise the notes and guidance but considered a rules change to be beyond its jurisdiction, referring the commission to the secretary for transport. Accordingly, on Jun. 12, 2024, the TAIC forwarded its recommendation to the secretary.

The Takeaway

“The trouble with getting away with something,” it’s been said, “is that it makes you think you’ll get away with it.” Door latches aren’t the most critical systems of a turbine helicopter, but their failure still carries potential for mayhem. An open door can usually be handled without much drama … usually.

Cargo wedged against the cabin structure ought to stay put unless turbulence shakes something loose or that structure suddenly changes. And incremental increases in multiple risks can ratchet up the overall level of hazard to an extent that may be difficult to appreciate at the time. 

David Jack Kenny is a fixed-wing ATP with commercial privileges for helicopter.