AIRCRAFT ACCIDENT REPORT 1/2023

AAIB
Air Accidents Investigation Branch

Report on the accident to

Leonardo AW169, G-VSKP
at King Power Stadium, Leicester
on 27 October 2018
Unless otherwise indicated, recommendations
in this report are addressed to the appropriate
regulatory authorities having responsibility for
the matters with which the recommendation is
concerned. It is for those authorities to decide
what action is taken. In the United Kingdom the
responsible authority is the Civil Aviation Authority,
CAA House, 45-49 Kingsway, London WC2B 6TE.
 AIRCRAFT ACCIDENT REPORT 1/2023

Air Accidents Investigation Branch

Report on the accident to

Leonardo AW169, registration G-VSKP
at King Power Stadium, Leicester
on 27 October 2018

This investigation has been conducted in accordance with

Annex 13 to the ICAO Convention on International Civil Aviation,
EU Regulation No 996/2010 and
The Civil Aviation (Investigation of Air Accidents and Incidents) Regulations 2018.

The sole objective of the investigation of an accident or incident under these Regulations
is the prevention of future accidents and incidents. It is not the purpose of such
an investigation to apportion blame or liability.

Accordingly, it is inappropriate that AAIB reports should be used to assign fault or blame
or determine liability, since neither the investigation nor the reporting process has been
undertaken for that purpose.
© Crown Copyright 2023

This report contains facts which have been determined up to the time of publication. This
information is published to inform the aviation industry and the public of the general
circumstances of accidents and serious incidents.

Extracts may be published without specific permission providing that the source is duly
acknowledged, the material is reproduced accurately and it is not used in a derogatory manner
or in a misleading context.

Cover picture courtesy of JML.

Published: 6 September 2023.

Printed in the United Kingdom for the Air Accidents Investigation Branch

ii
Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Contents

Contents
Introduction....................................................................................................................... 1

Summary........................................................................................................................... 2

1 Factual information................................................................................................. 5
1.1 History of the flight........................................................................................... 5
1.1.1 Background........................................................................................ 5
1.1.2 Previous flights on 27 October 2018.................................................. 5
1.1.3 Accident flight..................................................................................... 7
1.2 Injuries to persons............................................................................................ 9
1.3 Damage to the aircraft..................................................................................... 9
1.4 Other damage................................................................................................ 10
1.5 Personnel information.................................................................................... 10
1.5.1 Pilot.................................................................................................. 10
1.5.2 Background information................................................................... 10
1.5.2.1 Pilot............................................................................... 10
1.5.2.2 Front seat passenger.....................................................11
1.5.3 Training and checking.......................................................................11
1.6 Aircraft information......................................................................................... 12
1.6.1 Maintenance and bearing manufacturing process review................ 12
1.6.2 Aircraft description........................................................................... 13
1.6.3 Tail rotor duplex bearing development history................................. 23
1.6.4 AW169 and AW189 tail rotor design and certification ..................... 25
1.6.5 Duplex bearing design and load analysis........................................ 27
1.6.5.1 Factors contributing to tail rotor control loads............... 27
1.6.5.2 Factors affecting the demand for tail rotor lift................ 28
1.6.5.3 Duplex bearing specification and load spectrum
development.................................................................. 30
1.6.5.4 Control of bearing discard life and inspection tasks...... 34
1.6.6 AW189 and AW169 flight test load surveys..................................... 37
1.6.7 Tail rotor certification testing............................................................ 40
1.6.7.1 Tie down helicopter rig endurance test.......................... 40
1.6.7.2 Flight test programme................................................... 42
1.6.7.3 Tail rotor actuator certification testing............................ 43
1.6.8 Tail rotor system failure emergency procedures.............................. 44
1.6.9 Helicopter performance.................................................................... 45
1.6.10 Bird strike protection........................................................................ 48
1.6.11 Fuel tanks........................................................................................ 49

© Crown Copyright 2023 iii Contents

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.6.12 Cabin configuration.......................................................................... 49

1.6.13 Health and Usage Monitoring System (HUMS)............................... 49
1.6.14 Air-Data Attitude Heading Reference System (ADAHRS) –
Contents

data bus limits................................................................................. 53

1.6.15 Flight Control Computer (FCC)........................................................ 54
1.6.16 Crew alerting system....................................................................... 54
1.7 Meteorological information............................................................................. 54
1.8 Aids to navigation........................................................................................... 54
1.9 Communications............................................................................................ 54
1.10 Aerodrome information.................................................................................. 55
1.10.1 Aerodrome....................................................................................... 55
1.10.2 LCFC training ground....................................................................... 55
1.10.3 King Power Stadium........................................................................ 55
1.11 Recorded information..................................................................................... 55
1.11.1 Flight recorder.................................................................................. 56
1.11.2 Avionics............................................................................................ 57
1.11.3 Witness videos and imagery............................................................ 59
1.11.4 Personal electronic devices............................................................. 60
1.11.5 Radar and air traffic control radio transmissions ............................. 60
1.11.6 Accident flight................................................................................... 60
1.11.7 Previous flights................................................................................. 66
1.11.8 HUMS.............................................................................................. 68
1.11.9 Comparison of recorded data with published limitations.................. 70
1.12 Wreckage and impact information................................................................. 71
1.12.1 Initial site inspection......................................................................... 71
1.12.2 Results of the initial forensic laboratory investigation ..................... 73
1.12.3 Results of the in-depth forensic laboratory investigation ................ 78
1.12.4 Post-accident continued airworthiness response ............................ 86
1.12.5 Investigation of other failed bearings identified by emergency
checks ............................................................................................. 88
1.13 Medical and pathological information........................................................... 100
1.14 Fire............................................................................................................... 101
1.15 Survival aspects........................................................................................... 101
1.15.1 Certification requirements.............................................................. 101
1.15.2 AW169 crashworthiness................................................................ 103
1.15.3 Examination of wreckage related to crashworthiness ................... 104
1.16 Tests and research....................................................................................... 106
1.16.1 Engineering tests and trials............................................................ 106
1.16.1.1 Post-accident bearing tests......................................... 106

© Crown Copyright 2023 iv Contents

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.16.1.2 Investigation requested endurance rig test................. 107

1.16.1.3 Manufacturer’s subsequent rig test............................. 109

Contents
1.16.1.4 Review of AW169 flight test and rig test bearing
contact pressures ....................................................... 120
1.16.2 Impact assessment........................................................................ 126
1.16.3 Flight simulator trials...................................................................... 128
1.16.4 Manufacturer’s additional flight mechanics analysis...................... 129
1.17 Organisational and management information.............................................. 130
1.17.1 Requirements for non-commercial operations with complex
aircraft............................................................................................ 130
1.17.1.1 Complex helicopters.................................................... 130
1.17.1.2 Part-NCC Operator requirements................................ 130
1.17.2 Congested area operations............................................................ 131
1.17.3 Operational oversight..................................................................... 132
1.18 Additional information.................................................................................. 132
1.18.1 AW109 Cat A profile....................................................................... 132
1.18.2 Reported drone sightings............................................................... 133
1.18.3 Research regarding pilot response to helicopter tail rotor
emergencies................................................................................. 133
1.18.4 Startle and surprise........................................................................ 134
1.18.5 Critical Part ................................................................................... 134
1.18.6 Rolling Contact Fatigue (RCF)....................................................... 135
1.18.7 Grease lubrication.......................................................................... 137
1.18.8 Dark Etched Region....................................................................... 142
1.18.9 Avionics simulator – yaw rate effects............................................. 142
1.18.10 Flight mechanics simulation........................................................... 143
1.18.11 Vibration monitoring of the duplex bearing.................................... 143
1.18.12 Previous accidents......................................................................... 146
1.18.13 Rule Making Tasks (RMT) 128 and 712......................................... 149
1.18.14 Certification Specifications for Engines (CS-E).............................. 150

2 Analysis............................................................................................................... 151
2.1 General........................................................................................................ 151
2.2 Helicopter operation..................................................................................... 151
2.3 Stadium departure....................................................................................... 152
2.4 Emergency handling.................................................................................... 153
2.5 External operational factors......................................................................... 157
2.6 Accident flight recorded data....................................................................... 157
2.7 Loss of tail rotor control ............................................................................... 158

© Crown Copyright 2023 v Contents

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

2.8 Crashworthiness and survivability................................................................ 160

2.9 Duplex Bearing failure ................................................................................. 162
Contents

2.9.1 Investigation-requested endurance rig test ................................... 165

2.9.2 Manufacturer’s subsequent rig test................................................ 165
2.9.3 Conclusions from the bearing investigation................................... 167
2.9.4 Associated factors.......................................................................... 184
2.10 Safety Actions.............................................................................................. 193
2.11 Operational oversight................................................................................... 195
2.12 HUMS.......................................................................................................... 195

3 Conclusions......................................................................................................... 197
3.1 Findings....................................................................................................... 197
3.2 Causal Factors............................................................................................. 204
3.3 Contributory Factors.................................................................................... 204

4 Safety Recommendations and Actions............................................................. 205

4.1 Safety Recommendations............................................................................ 205
4.2 Safety action................................................................................................ 207

APPENDICES

Appendix A - Summary of the accident pilot’s flying experience.................................... 211

Appendix B - AW169 flight simulator trials.....................................................................212

Appendix C - Summary of pilot response times from previous accidents......................220

Appendix D - Flight recorder issues...............................................................................221

Appendix E - AW169 flight test load survey and contact pressure analysis...................231

Appendix F - Certification Specification E.515 - Engine Critical Parts..........................234

Appendix G - Notice of proposed Amendment 2022/01.................................................249

Appendix H - Extracts from EASA Certification Specification 29 Amendment 2............255

Appendix I - Changes to Certification Specification 29 Amendment 11.......................271

Appendix J - Flight mechanics analysis information provided by the helicopter

manufacturer............................................................................................277

Appendix K - Comments of the ANSV representing the State of Design and

Manufacture..............................................................................................280

© Crown Copyright 2023 vi Contents

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT

Abbreviations
Glossary of
AAIB Air Accidents Investigation CIVP Continued Integrity Verification
Branch Programme
Accrep Accredited Representative CIVPP Continued Integrity Verification
agl above ground level Programme Plan
AC Advisory Circular (FAA) CIVPR Continued Integrity Verification
AD Airworthiness Directive Programme Report
ADAHRS Air-Data Attitude Heading CMR Critical Maintenance
Reference System Requirements
ADAHRU Air-Data Attitude Heading CRD Comment Response
Reference System Units Document
AEH Airborne Electronic Hardware CS Certification Specification
AFCS Automatic Flight Control CS-E Certification Specifications for
System Engines
AHRS Attitude Heading Reference CT Computed Tomography
System CTO Continued Takeoff Speed
ALS Airworthiness Limitations DAFR Data Acquisition Flight
Section Recorder
AMC Acceptable Means of daN Decanewton
Compliance daNm Decanewton metre
AMMC Aircraft and Mission DER Dark Etched Region
Management Computers DSN Download Sequence Number
AMPI Approved Maintenance DTD Data Transfer Device
Planning Information EASA European Union Aviation
ANSV Agenzia Nazionale per la Safety Agency
Sicurezza del Volo – Italy ED EUROCAE Document
AoA Angle of Attack EDAX Energy-Dispersive Analysis of
AOC Air Operator’s Certificate X-rays
AP Autopilot EHL Elastohydrodynamic
ASB Alert Service Bulletin Lubrication
ATC Air Traffic Control EMI Electromagnetic Inteference
ATD Anthropomorphic Test Dummy ES Engineering Simulator
ATPL(H) Airline Transport Pilot’s ESUM Reference to continuously
Licence (Helicopters) recorded flight parameters in
ATS Above the Takeoff Surface the DTD
ATT ‘Attitude hold’ autopilot mode EUROCAE European Organisation for
AUW All-up Weight Civil Aviation Equipment
AVSR Adaptive Variable Speed Fa Axial load
Rotor FAA Federal Aviation
BBJ Boeing Business Jet Administration
BEA Bureau d’Enquêtes et FCC Flight Control Computer
d’Analyses pour la sécurité de FDM Flight Data Monitoring
l’aviation civile FDR Flight Data Recorder
CAA Civil Aviation Authority FFS Full Flight Simulator
CAM Cockpit Area Microphone FMEA Failure Modes and Effects
Cat A or B Category A or Category B Analysis
CCTV Closed Circuit Television FSTD Flight Simulation Training
CCU Cockpit Control Unit Device
CG Centre of Gravity ft Feet

© Crown Copyright 2023 vii Glossary of abbreviations

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT cont

Abbreviations
Glossary of

ft/min Feet per minute NTSB National Transportation Safety

FY Radial load Board
FZ Axial load NVM Non-volatile Memory
g Acceleration due to gravity OEI One Engine Inoperative
GM Guidance Material OTL Operating Time Limit
GPS Global Positioning System PC Performance Class
HEMS Helicopter Emergency Medical PIC Pilot in Command
Services PFD Primary Flight Display
HI Health Index or Health p/n Part number
Indicator POD Probability of Detection
HIC Head Injury Criteria PSE Principal Structural Elements
hrs Hours PV Reference indicator of bearing
HQ Headquarters duress
HTL High Temperature Limit PVmax Highest value of PV
HTPL High Temperature QPD Qualified Products Database
Performance Limit RCF Rolling Contact Fatigue
HUMS Health and Usage Monitoring RIPS Recorder Independent Power
System Supply
KEAS Knots Equivalent Airspeed RFM Rotorcraft Flight Manual
kg Kilograms RT Radio Transmission
kHz Kilohertz rpm Revolutions per minute
KIAS Knots Indicated Airspeed RMT Rule Making Task
kN Kilonewtons SB Service Bulletin
lbs Pounds sec Second(s)
LCF Low-cycle Fatigue SEM Scanning Electron Microscope
LCFC Leicester City Football Club SFE(A) Simulator Flying Examiner
LTE Loss of Tail Rotor (Aircraft)
Effectiveness SFI(A) Simulator Flying Instructor
LTL Low Temperature Limit (Aircraft)
LTPL Low Temperature SMS Safety Management System
Performance Limit s/n Serial number
m Metres SUSA Small Unmanned Surveillance
M Moment Aircraft
mm Millimetres TAS True Airspeed
MRB Maintenance Review Board TCAS Traffic Alert and Collision
ms Milliseconds Avoidance System
MSG Maintenance Steering Group TCDS Type Certificate Data Sheet
MTOW Maximum Takeoff Weight TDH Tie Down Helicopter
N Newtons TDP Takeoff Decision Point
NCC Non-commercial operations TC Type Certificate
with complex motor-powered TGB Tail Rotor Gearbox
aircraft TP Test Pilot
Ng Rotational speed - gas TQ Torque
generator stage TRA Tail Rotor Actuator
Nm Newton metres TRE Type Rating Examiner
NPA Notice of Proposed TRI Type Rating Instructor
Amendment TSB Transportation Safety Board
NR Rotational speed - rotor of Canada

© Crown Copyright 2023 viii Glossary of abbreviations

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

GLOSSARY OF ABBREVIATIONS USED IN THIS REPORT

Abbreviations
Glossary of
TVM Transmission Vibration °/s Degrees per second
Monitoring °M Degrees Magnetic
UTC Coordinated Universal Time ηoil Grease base oil viscosity
VNE Never-exceed speed hR Grease thickener boundary
VTOSS Takeoff safety speed layer thickness
VY Speed for best rate of climb hEHL Grease base oil
VDAM Vibration Data Acquisition elastohydrodynamic
Module lubrication boundary layer
VIP Very Important Person thickness
VHM Vibration Health Monitoring hT Grease total film thickness

© Crown Copyright 2023 ix Glossary of abbreviations

Intentionally left blank
Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Air Accidents Investigation Branch

Introduction and
Summary
Aircraft Accident Report No: 1/2023 (AAIB-25398)

Registered Owner: Foxborough Limited (Isle of Man)

Registered Operator: Starspeed Limited

Aircraft Type: Leonardo AW169

Nationality: British

Registration: G-VSKP

Place of Accident: King Power Stadium, Leicester

Date and Time: 27 October 2018 at 1937 hrs

(All times in this report are UTC)

Introduction

The Air Accidents Investigation Branch (AAIB) became aware of this accident during the
evening of 27 October 2018. In exercise of his powers, the Chief Inspector of Air Accidents
ordered an investigation to be carried out in accordance with the provisions of Regulation
(EU) 996/2010 and the UK Civil Aviation (Investigation of Air Accidents and Incidents)
Regulations 2018.

The sole objective of the investigation of an accident or incident under these regulations
is the prevention of future accidents and incidents. It shall not be the purpose of such an
investigation to apportion blame or liability.

In accordance with established international arrangements, the Agenzia Nazionale per la

Sicurezza del Volo (ANSV) of Italy, representing the State of Design and Manufacture
of the helicopter, appointed an Accredited Representative (Accrep) to participate in the
investigation. The Transportation Safety Board (TSB) of Canada, representing the State
of Design and Manufacture for the helicopter’s engines, the National Transportation Safety
Board (NTSB) of the USA, representing the State of Design and Manufacture of the tail
rotor actuator and the Bureau d’Enquêtes et d’Analyses pour la sécurité de l’aviation civile
(BEA) of France representing the State of Design and Manufacture of the tail rotor duplex
bearing, also appointed Accreps.

© Crown Copyright 2023 1 Introduction and Summary

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Experts1 were appointed by the Aircraft Accident Investigation Committee of Thailand and
Introduction and

the State Commission on Aircraft Accidents Investigation of Poland.

Summary

The helicopter, bearing, tail rotor actuator and grease manufacturers, the operator, the
European Union Aviation Safety Agency (EASA), and the UK Civil Aviation Authority (CAA)
also assisted the AAIB investigation.

Summary

At 1937 hrs the helicopter, carrying the pilot and four passengers, lifted off from the centre
spot of the pitch at the King Power Stadium. The helicopter moved forward and then began
to climb out of the stadium on a rearward flightpath while maintaining a northerly heading
and with an average rate of climb of between 600 and 700 ft/min. Passing through a
height of approximately 250 ft, the pilot began the transition to forward flight by pitching
the helicopter nosedown and the landing gear was retracted. The helicopter was briefly
established in a right turn before an increasing right yaw rapidly developed, despite the
immediate application of corrective control inputs from the pilot. The helicopter reached a
radio altimeter height of approximately 430 ft before descending with a high rotation rate. At
approximately 75 ft from the ground the collective was fully raised to cushion the touchdown.

The helicopter struck the ground on a stepped concrete surface, coming to rest on its left
side. The impact, which likely exceeded the helicopter’s design requirements, damaged
the lower fuselage and the helicopter’s fuel tanks which resulted in a significant fuel leak.
The fuel ignited shortly after the helicopter came to rest and an intense post-impact fire
rapidly engulfed the fuselage.

The investigation found the following causal factors for this accident:

1. Seizure of the tail rotor duplex bearing initiated a sequence of failures in the
tail rotor pitch control mechanism which culminated in the unrecoverable
loss of control of the tail rotor blade pitch angle and the blades moving to
their physical limit of travel.
2. The unopposed main rotor torque couple and negative tail rotor blade
pitch angle resulted in an increasing rate of rotation of the helicopter in
yaw, which induced pitch and roll deviations and made effective control
of the helicopter’s flightpath impossible.
3. The tail rotor duplex bearing likely experienced a combination of dynamic
axial and bending moment loads which generated internal contact
pressures sufficient to result in lubrication breakdown and the balls sliding
across the race surface. This caused premature, surface initiated rolling
contact fatigue damage to accumulate until the bearing seized.

1 Representing States which suffered fatalities to its citizens in the accident.

© Crown Copyright 2023 2 Introduction and Summary

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The investigation found the following contributory factors for this accident:

Introduction and
1. The load survey flight test results were not shared by the helicopter

Summary
manufacturer with the bearing manufacturer in order to validate the
original analysis of the theoretical load spectrum and assess the continued
suitability of the bearing for this application, nor were they required to be
by the regulatory requirements and guidance.

2. There were no design or test requirements in Certification Specification 29

which explicitly addressed rolling contact fatigue in bearings identified as
critical parts; while the certification testing of the duplex bearing met the
airworthiness authority’s acceptable means of compliance, it was not
sufficiently representative of operational demands to identify the failure
mode.

3. The manufacturer of the helicopter did not implement a routine inspection

requirement for critical part bearings removed from service to review
their condition against original design and certification assumptions, nor
were they required to by the regulatory requirements and guidance.

4. Although the failure of the duplex bearing was classified as catastrophic

in the certification failure analysis, the various failure sequences and
possible risk reduction and mitigation measures within the wider tail rotor
control system were not fully considered in the certification process; the
regulatory guidance stated that this was not required.

AAIB Special Bulletin S1/2018, published on 14 November 2018 and AAIB Special
Bulletin S2/2018, published on 6 December 2018, provided initial information on the
circumstances of this accident.

During the course of this investigation and as a result of the findings made, the
helicopter manufacturer has issued sixteen Service Bulletins and EASA has published
nine Airworthiness Directives for the continued airworthiness of the AW169 and AW189
helicopter types.

Eight Safety Recommendations have been made in this report. These have been made to
EASA to address weaknesses or omissions identified in the regulations for the certification
of large helicopters - Certification Specification 29. The recommendations address the
main findings of the investigation and include: validation of design data by suppliers
post‑test; premature rolling contact fatigue in bearings; life limits, load spectrum safety
margin and inspection programmes for critical parts; and assessment and mitigation of
catastrophic failure modes in systems.

© Crown Copyright 2023 3 Introduction and Summary

Intentionally left blank
Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1 Factual information

1.1 History of the flight

1.1.1 Background

G-VSKP was a corporately owned Leonardo AW169 helicopter operated out of

Fairoaks Airport, Surrey, UK.

The helicopter was used to support the business and personal transportation

Information
requirements of the staff of one of the corporate owner’s sister companies. It

Factual
was operated in the single-pilot role under the requirements for non-commercial
operations with complex motor-powered aircraft1.

A regular task undertaken by the helicopter was to convey corporate personnel

and guests to football matches and business meetings in Leicester. Two
landing sites routinely used for flights to the city were Leicester City Football
Club’s (LCFC) training ground and the King Power Stadium (Figure 1), both
under the control of the helicopter’s owner. G-VSKP’s operations at these two
sites were within the scope of the helicopter operator’s delegated congested
areas permission, granted by the CAA.

The pilot was the primary pilot for G-VSKP and conducted most of its flights but
was not directly employed by the owner of the helicopter. While not a regulatory
requirement, G-VSKP was regularly operated with a second person, who was a
pilot but not necessarily qualified to fly a helicopter, in the cockpit. This second
pilot was classified as a passenger but assisted with lookout and VIP passenger
handling. The second pilot2 for the accident flight was a commercially licensed
fixed wing pilot and regularly flew the owner’s corporate aircraft.

1.1.2 Previous flights on 27 October 2018

Fairoaks to Leicester training ground

On 27 October 2018, G-VSKP was scheduled to fly corporate personnel to

and from Leicester to allow them to attend a football match at the King Power
Stadium.

The pilot, accompanied by the front seat passenger, arrived at the airfield
approximately 40 minutes before departure. Air Traffic Control records show
that the helicopter took off from Fairoaks at 1342 hrs with two people on board
and flew to London Heliport.

1 Established in Annex VI (Part-NCC) of Commission Regulation (EU) No 965/2012.

2 Hereinafter called the ‘front seat passenger’.

© Crown Copyright 2023 5 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 1
G-VSKP landing sites in Leicester (image ©2018 Google)

G-VSKP arrived at London Heliport at 1402 hrs and picked up three corporate
passengers, before departing for Leicester at 1415 hrs. It landed at the LCFC
training ground at 1459 hrs and all five occupants travelled onward to the King
Power Stadium by car.

Training ground to stadium

6
While the pilot was at the stadium, he was observed checking weather and
planning the onward flights. He and the front seat passenger left the stadium
before the end of the match and returned to the helicopter. CCTV footage
showed that they passed through the training ground security post at 1835 hrs
and walked the short distance to where the helicopter was parked.

© Crown Copyright 2023 6 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The match ended at 1815 hrs and by 1835 hrs the stadium had been declared
clear of spectators. The match-day coordinator liaised with the police operations
team to ensure that their small, unmanned surveillance aircraft (SUSA)3 was
clear of the area. They then gave permission for the flight into the stadium. A
football club official relayed the flight clearance to the pilot by mobile phone at
1837 hrs.

At 1844 hrs the helicopter lifted off for the short flight to the King Power Stadium,
1 mile to the north. The approach into the stadium was made at 1847 hrs. After
landing, the helicopter was parked on the centre spot facing the north-easterly

Information
Factual
goal. The pilot and front seat passenger both left the helicopter.

1.1.3 Accident flight

The onward flight was planned to London Stansted Airport, where a corporate
aircraft was waiting for the three rear-cabin passengers. Between 1900 hrs
and 1933 hrs the original five occupants returned to and boarded G-VSKP. No
other persons were seen to have approached close to the helicopter.

In conversations captured on cockpit voice recordings prior to departure, the

pilot sounded relaxed and unhurried during cockpit preparation and engine
start.

At 1935 hrs, the main rotor started to turn and at 1937 hrs the helicopter lifted
from the centre spot of the pitch. The helicopter moved forward and then began
a climb on a rearward flightpath while maintaining a northerly heading and with
an average rate of climb of between 600 and 700 ft/min. Passing through a
height of approximately 250 ft the pilot began pitching the helicopter nose-down
through 15° over a period of six seconds. During the pitch down he called “gear
up please” and shortly afterwards the landing gear began retracting. Roll and
yaw changes consistent with entry to a gently banked right turn were observed
as the helicopter climbed through approximately 300 ft. The helicopter briefly
stabilised in the turn before an increasing right yaw rapidly developed (Figure 2).
The pilot immediately started to apply left pedal and full deflection was reached
after about one second. At that point an exclamation of “hey, hey, hey” came
from the rear cabin, after which the pilot said, “i’ve no idea what’s going on”.
Four seconds after the onset of the uncommanded yaw, the pilot uttered an
exclamation. A rotor low warning occurred. The pilot began to lower the
collective lever about five seconds after full left pedal was applied and it was
fully lowered over a two second period. The helicopter reached a radio altimeter
height of approximately 430 ft before descending with a high rotation rate which
peaked at 209°/s. Pitch and roll oscillations accompanied the high yaw rate. At
approximately 75 ft the collective was fully raised to cushion the impact.

3 Commonly referred to as a ‘drone’.

© Crown Copyright 2023 7 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The helicopter struck the ground on a stepped concrete surface, while still
rotating and with the landing gear retracted (Figure 2). It came to a stop and
then rolled onto its left side and was rapidly engulfed in an intense post-impact
fire. Stadium staff and emergency services were quickly at the scene but were
not able to gain access to the helicopter because of the intensity of the fire.
Information
Factual

Figure 2
Approximate trajectory of G-VSKP on the accident flight
Map data © 2021 Google

© Crown Copyright 2023 8 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.2 Injuries to persons

Injuries Crew Passengers Others

Fatal 1 4 0

Serious 0 0 0

Minor/None 0 0 4*
(*heat injuries sustained by first-responders)

Information
Factual
1.3 Damage to the aircraft

The helicopter was severely damaged both in the initial impact with the ground
and the subsequent fire.

Impact damage

The tail section separated from the main wreckage at the end of the tail boom
during the impact. The main rotor blades were damaged and sections of
individual blades had separated at differing lengths; from the whole blade to
approximately two thirds of the blade length. The sections of released blade
were distributed some distance from the main wreckage location. The tail rotor
blades were also damaged. This ranged from tip removal to loss of the full
blade from close to the blade root.

The four doors had been ejected from the fuselage. The cabin windows
had also been broken in various places, but the cockpit windscreen initially
remained intact. The fuselage structure around the fuel tank was damaged and
the integrity of the fuel tank was compromised.4

Fire damage

The carbon fibre fuselage was largely destroyed by the post-impact fire. Most
of the cockpit structure had been completely consumed including both the
carbon fibre and aluminium elements. The passenger cabin and rear fuselage
retained more of its structural shape, but most of the resin within the carbon
fibre had been consumed resulting in a loss of structural rigidity.

The metallic components and structure, particularly the high strength materials
used in the landing gear, engines, gearboxes and transmission system, main
and tail rotor hubs, hydraulic flight control actuators and the engine deck
survived the fire largely intact. The avionics boxes and wiring were severely
heat damaged but remained identifiable.
4 See ‘survival aspects’, section 1.15.3 for a more detailed description.

© Crown Copyright 2023 9 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.4 Other damage

There was some structural damage to the small wall which formed the edge of
the step which the aircraft struck. There was also extensive contamination of
the ground with fuel and products of combustion.

1.5 Personnel information

1.5.1 Pilot
Information
Factual

Age: 53 years
Licences: Airline Transport Pilot’s Licence
(Helicopters)
Airline Transport Pilot’s Licence
(Aeroplanes)
Licence expiry date: Valid for life
Pilot proficiency check: Valid until 31 October 2019 (AW169)
Class 1 medical examination: 14 March 2018
Flying experience: Total on all types: 12,947 hours
Total on helicopters: 4,784 hours
Total on type: 177 hours
Last 90 days: 41 hours
Last 28 days: 7 hours
Last 24 hours: 2 hours
Previous rest period: The pilot had not flown during the week prior
to the accident.

1.5.2 Background information

1.5.2.1 Pilot

The pilot was the primary pilot for G-VSKP and conducted most of its flights but
was not directly employed by the owner of the helicopter. He was qualified on,
and regularly flew, the owner’s AW109 helicopter and their Boeing B737‑7EI
Business Jet (BBJ). During 2018 he had flown 55 hours in G-VSKP, 17 hours
in AW109 helicopters as well as 74 hours in the BBJ and other Boeing 737
aircraft. The pilot was a type rating instructor (TRI) on AW109 and AW169
helicopters and was a type rating examiner (TRE) for the Boeing 737 family
of aircraft, which included the BBJ. A summary of the accident pilot’s flying
experience and instructor ratings is included at Appendix A.

© Crown Copyright 2023 10 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.5.2.2 Front seat passenger

The front seat passenger was a pilot who flew the helicopter owner’s fixed wing
aircraft and, with the accident pilot as her instructor, she had completed over
55 hours of Private Pilot’s Licence training on Robinson R22 helicopters. It was
planned that she would become qualified on the AW169 in due course but had
yet to begin formal training on type. Cockpit voice recordings indicated that,
under the pilot’s supervision, on the day of the accident she flew the departure
from Fairoaks and from the training ground. On both these flights there were
no others on board the helicopter and the pilot took control for the approach

Information
and landing. The investigation was not able to determine if she had flown

Factual
G-VSKP on previous occasions.

1.5.3 Training and checking

The pilot undertook initial type conversion training on the AW169 in

October 2016. This training was conducted at the helicopter manufacturer’s
facility in Italy. The course syllabus included discussion, demonstration and
practise of the Loss of Tail Rotor Effectiveness (LTE) emergency procedure.
The pilot’s training report form showed that he achieved a ‘Very Good’ standard
when practising the LTE and autorotation drills. Because it was not a certification
requirement, the course did not include training for the specific mode of failure
experienced on the accident flight.

Training for the Category A (Cat A) ‘Ground and Elevated Heliport/Helideck

Variable Takeoff Decision Point (TDP) Procedure’5 takeoff profile required for
operations from the stadium was also not included in the pilot’s AW169 type
rating course syllabus.

In October 2017 the pilot successfully completed the manufacturer’s TRI course
conducted on G-VSKP. His AW169 TRI rating was valid until 31 October 2020.

The pilot completed a proficiency check with an examiner for the revalidation of his
AW169 type rating eight days before the accident flight. The examiner reported
that during the revalidation they discussed and practised Cat A departure profiles
as appropriate for the King Power Stadium. The recorded flight data from the
check flight revealed that three rearward climb profiles were carried out. The first
profile showed a maximum rate of climb of 400 ft/min and a level-off at 130 ft agl.
The second and third profiles showed a maximum rate of climb of 300 ft/min and
were levelled-off at 120 ft agl. All three profiles were terminated with a return to
the takeoff surface; transition to forward flight was not practised. A simulated tail
rotor control malfunction, with tail rotor at fixed pitch, was also practised. The
helicopter was landed successfully following this simulated emergency.

5 See section 1.6.7 Helicopter performance.

© Crown Copyright 2023 11 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.6 Aircraft information

General

Manufacturer: Leonardo S.p.A.6

Type: AW169
Engines: 2 Pratt & Whitney PW210A turboshaft
engines
Manufacturer’s serial number: 69018
Year of manufacture: 11 July 2016
Information
Factual

Certificate of Airworthiness: Issued 11 July 2016

Certificate of Registration: Issued 20 July 2016
Airworthiness Review Certificate: Expiry date 10 July 2019
Last maintenance check: Bi-weekly check 22 October 2018
Total airframe hours: 330.9 hours
Total airframe landings: 1,034 landings

Two voyage reports were identified which recorded the takeoff weight for two
earlier stadium departures as 4,550 kg, with 410 kg fuel, and 4,580 kg, with
510 kg of fuel respectively. The aircraft system recorded a total fuel mass of
510 kg for the accident flight. Based on these figures the helicopter’s all-up
weight for the accident flight was estimated as being between 4,500 kg and
4,600 kg.

1.6.1 Maintenance and bearing manufacturing process review

The helicopter was compliant with all applicable airworthiness requirements, had
been correctly maintained and was appropriately certified for release to service
prior to the accident flight. The records showed that on 6 July 2017 G-VSKP
had been modified, in accordance with Leonardo Technical Bulletin 169-024, to
operate at a higher maximum takeoff weight of 4,800 kg.

The tail rotor duplex bearing manufacturing process was also reviewed to assess
the implications of findings from a quality audit conducted by the helicopter
manufacturer after the accident and to consider the potential for contamination
of the bearing during manufacture. The audit findings were reviewed and found
to be administrative in nature. They were rectified by administrative updates,
with no material change to the manufacturing process. No evidence was found
that contamination was a significant risk during manufacture, with various
precautionary safeguards taken to prevent this.

6 The helicopter manufacturer was called AgustaWestland at the time of the AW169 type certificate issue
and the manufacture date of the accident helicopter. On 28 July 2016 AgustaWestland S.p.A. was
renamed Leonardo S.p.A. which was the name of the company at the time of the accident.

© Crown Copyright 2023 12 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.6.2 Aircraft description

The AW169 is the most recently certified model in the AW family of helicopters,
which includes the AW139 and AW189. It formally started development in
February 2011 and was granted a type design certificate in July 2015.

The helicopter is 14.65 m long, 2.53 m wide, 4.5 m high and has a normal
maximum gross weight of 4,600 kg. It is certified for a maximum of 11 passengers
and one or two crew operation, but in executive passenger configuration the
cabin is more typically equipped to carry six or seven passengers, as was the

Information
case with the accident aircraft. It has an endurance of 4 hours 20 minutes and

Factual
a range of 440 nm.

The helicopter has a predominantly carbon fibre fuselage, with a retractable

tricycle landing gear and hydraulically powered flight controls, with mechanical
control linkages. It has a glass cockpit and a four-axis digital Automatic Flight
Control System (AFCS).

The helicopter is twin-engined and has a conventional main gearbox which

drives a five blade main rotor, and a three blade tail rotor via a tail rotor gearbox.

The AW189 has the same tail rotor control system as the AW169 but uses a
larger four blade tail rotor that operates at a different rotational speed. The
AW139 has a similar tail rotor to the AW189, with four tail rotor blades, but has
small differences in the design of the control system compared to the AW169
and AW189.

The AW139 was the first of the three models to be introduced. Formally starting
development in March 1999 and being granted a type design by ENAC7 in
June 2003. The subsequent EASA type certification approval date was
September 2003. The AW139 has a certified Maximum Takeoff Weight (MTOW) of
6,400 kg, which can be increased to either 6,800 or 7,000 kg when the helicopter
is operated in accordance with the relevant Rotorcraft Flight Manual (RFM)
supplement, and the appropriate mod kit is embodied. It has an operating
ceiling of 20,000 ft.

The AW189 was the second of the three models to be introduced into service.
It was initially developed as the military AW149, before a civilian version was
launched in May 2011 for EASA certification under the AW189 name. It was
granted a type design certificate in February 2014. The AW189 has a certified
maximum takeoff weight of 8,300 kg, which can be increased to 8,600 kg when
operating to RFM Supplement 2. It has an operating ceiling of 15,000 ft.

7 Ente Nazionale per l’Aviazione Civile – Italian national airworthiness authority.

© Crown Copyright 2023 13 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The AW169 has a certified maximum takeoff weight of 4,600 kg, which can
be increased to 4,800 kg when the helicopter is modified in accordance with
Technical Bulletin 169-024. It has an operating ceiling of 15,000 ft.

The Type Certificate Data Sheet for the AW169, No EASA.R.5098, states that
the AW169 helicopter type was certified in accordance with EASA Certification
Specification (CS) 29 Amendment 29, dated 17 November 2008. CS 29 details
the design and test requirements for certification of large helicopters.
Information

Description of the yaw control system

Factual

Helicopters can manoeuvre in three axes: pitch, roll and yaw. The yaw axis
runs through the axis of rotation of the main rotor blades, with yaw rotation
occurring around it. Movement about this axis is controlled by a set of opposing
foot pedals, which change the tail rotor blade pitch. Pressing the right pedal
forward pushes the left pedal back and rotates the nose to the right, pressing
the left pedal forward, pushes the right pedal back and rotates the nose to the
left (Figure 3).

Figure 3
Helicopter yaw axis

In helicopters such as the AW169, with a single main rotor system that turns
anti-clockwise (looking down from above), a torque couple is created when the
rotor blades rotate under power from the engines, this causes the nose of the
helicopter to yaw to the right.

8 https://www.easa.europa.eu/sites/default/files/dfu/AW169-TCDS%20R-509%20Issue1.pdf (Accessed
3 July 2023).
9 https://www.easa.europa.eu/document-library/certification-specifications/cs-29-amendment-2
(Accessed 3 July 2023).

© Crown Copyright 2023 14 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

To resist this tendency, for example when the pilot wishes to keep the helicopter
straight or to yaw to the left, a smaller rotor system is fitted to the tail of the helicopter.
This tail rotor generates a torque around the yaw axis which can match the
torque couple from the main rotor, thus keeping the helicopter pointing forward
or if required exceed it, resulting in the helicopter yawing to the left. The tail
rotor blades rotate at a relatively constant speed. To increase or decrease the
force generated by the tail rotor system, the angle at which the rotor blades
travel through the air relative to their path of rotation (pitch), is adjusted on all
the blades at the same time. Increasing the angle increases the force, reducing
the angle reduces the force. The normal range of blade pitch angle is +25° to

Information
Factual
-10°10 and is limited by the primary yaw stops. The control input load required
to change the angle of the blades on large helicopters such as the AW169, is
too large for a pilot to achieve by moving a simple direct mechanical linkage. A
hydraulic system is therefore used to translate the pilot’s control inputs on the
pedals into changes in the tail rotor blade pitch angle.

On the AW169, the yaw pedals in the cockpit are connected to the tail rotor
control system by a flexible cable running on ball bearings within an outer
sheath, whereas the AW189 uses a mechanical rod to achieve this. The cable
on the AW169 is routed along the length of the fuselage to the tail, where it
connects to a control rod and a bellcrank. The range of movement of the
bellcrank is limited in each direction by the primary control stops for the yaw
system (Figure 4). The bellcrank is then connected to a longer rigid control rod.

Figure 4
AW169/AW189 tail rotor control yaw stops11
(original image courtesy of the manufacturer)

10 Measured at the 75% tail rotor blade radius.

11 Note the AW189 does not have the flexible cable used on the AW169.

© Crown Copyright 2023 15 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The other end of the control rod is connected to one end of a lever mechanism
which forms part of the tail rotor servo actuator, this is the same arrangement
of components on both the AW169 and AW189. The middle of the lever is
connected via rods and a lay shaft to the hydraulic servo main control valve (not
visible in Figure 5), and the other end of the lever is connected to the tail rotor
actuator control shaft by a connecting pin and pin carrier.

The pin carrier is secured to the shaft by a castellated lock nut which, at the time
of the accident, attached to a threaded section on the end of the shaft using a
Information

conventional right hand thread. The nut has a torque load applied before a split
Factual

pin is fitted between the castellations of the nut and through a hole in the shaft.
It is also wire locked in place (Figure 5 & 6).

Figure 5
Tail rotor actuator control input mechanism

Figure 6
Reverse view of actuator system showing pin carrier and lock nut

© Crown Copyright 2023 16

19 Section 1 - Factual information
19
Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The AW139 has the same basic arrangement, but rather than a separate pin
carrier and nut, the connection to the actuator uses a one-piece pin carrier and
nut arrangement. This is secured to the shaft using a left-hand thread. Although
similar in design and function, the actuator is a different component from the
AW169/AW189, produced by a different manufacturer.

The control shaft passes through an outer shaft, which forms part of the tail rotor
hydraulic actuator piston, continues through a tunnel in the tail rotor gearbox
and passes through the inner race of a duplex bearing installed in the tail rotor
slider/spider assembly (Figures 7 and 8). The inner race of the bearing is

Information
Factual
locked in place on the control shaft by a spacer and a second, larger castellated
nut and split pin.

Figure 7
AW169/AW189 tail rotor actuator and duplex bearing
(Original image courtesy of the manufacturer)

The spider is a rotating hub which holds the slider and duplex bearing. The
slider guides the movement of the spider as it is extended and retracted by the
control shaft. Each of the three arms of the spider is connected by a rod (pitch
link) to the rear of a tail rotor blade. The spider/slider assembly is attached to
the tail rotor hub by the scissor assemblies and rotates with the outer race of
the duplex bearing, while the control shaft attached to the inner race remains
stationary (Figure 8).

© Crown Copyright 2023 17 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 8
Tail rotor spider and pitch link assembly
(Original image courtesy of the manufacturer)

Tail rotor control operation

When the pilot applies a yaw pedal input, it moves the control cable rotating
the bellcrank. The movement is transferred to the tail rotor hydraulic actuator
lever mechanism by the control rod. The lever mechanism pivots around the
pin and carrier connection at the control shaft end and creates a demand on the
hydraulic system via the main control valve. The hydraulic piston and control
shaft of the actuator then move in the demanded direction under hydraulic
pressure. Movement of the control shaft is transmitted to the tail rotor blades
via the spider/slider assembly and the pitch links, which alter the tail rotor blade
pitch (angle) to meet the pilot’s demand. As the control shaft moves, it also
moves the lever mechanism connected to it, which now pivots around the
connection to the control rod attached to the bellcrank. This action closes the
main control valve and stops movement of the actuator when the tail rotor blade
pitch matches the control input demand from the pilot.

Adaptive Variable Speed Rotor (AVSR)

During original development the AW16912 was equipped with a variable speed
main rotor system which allowed the pilot to select the algorithm used to control
the main rotor speed (NR). This was intended to improve the fuel economy of
the helicopter by reducing the required torque from the engines during periods

12 This system is not fitted to the AW189.

© Crown Copyright 2023 18 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

where the demand for lift from the main rotor blades is reduced, whilst still
providing full lift from the rotor when required during low-speed manoeuvres or
at high forward speeds.

The design of the AVSR system had two normal modes ‘ECO’ and ‘PLUS’ and a
fixed speed ‘BACKUP’ mode which the system will revert to if it detects a fault.
The intention was that the pilot could alternate between ECO and PLUS mode
using the ‘NR MODE’ push button on the collective grip. The selected mode and
the NR maximum and minimum limits are then displayed. The selected mode is
also annunciated when changed (Figure 9).

Information
Factual
Figure 9
AVSR controls and primary flight display as anticipated during development
(Original image courtesy of the manufacturer)

Depending on the airspeed and altitude, the selected mode would have varied
the NR between 94% and 103%. The graph shown in Figure 10 shows how the
NR was intended to vary in each mode. In BACKUP mode the system reverts
to the blue line giving a fixed NR of 103%.

© Crown Copyright 2023 19 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 10
Intended AVSR variation in NR with true airspeed and altitude in each mode
during original development
(Original image courtesy of the manufacturer)

The main rotor is driven by the helicopter main gearbox. This gearbox also
drives the tail rotor, which means there is a fixed ratio between main rotor speed
and tail rotor speed. At 100% NR the tail rotor rotates at 1,586 revolutions per
minute (rpm). At 103% NR this increases to 1,633 rpm.

Although used for some flight testing, the ECO mode of the AVSR system
was never certified for operation under the type design approval granted for
entry into service of the AW169. As such, this mode is disabled on production
helicopters and only PLUS and BACKUP modes are operational. As a result,
only the blue and green lines shown in Figure 10 are possible giving a variation
in NR of between 96 and 103% with both engines operating normally13.

Duplex bearing

The duplex bearing is required to connect the rotating slider and spider
assembly (outer race) to the static tail rotor actuator control shaft (inner race).
As the shaft moves in two directions (in/out), the bearing is required to have
two rows positioned back-to-back to support the axial load in each direction.
In order to support loads in both the axial (FZ) and radial (FY) directions, the
running surfaces of each row are angled at approximately 30°. The control
13 Normal operation is limited to the range 96%-103% NR, but this limit automatically increases to 105%
with one engine inoperative. NR is permitted to drop to 94% or rise to 107%, providing this is only
transitory.

© Crown Copyright 2023 20 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

shaft also experiences a bending moment (M) which is transferred to the

bearing (Figure 11).

Information
Factual
M

Figure 11
Diagram (with control shaft removed) showing two halves of the bearing
(inboard and outboard) and the 30° orientation.
(Original image courtesy of the manufacturer)

The two halves of the bearing are referred to as the inboard and outboard
rows based on their relative position to the helicopter centreline. The inner
races are clamped together on the control shaft by the castellated nut. The
internal design of the bearing in combination with the torque setting on the
nut ensures the correct preload is applied to the bearing. The correct preload
gives a consistent baseline contact pressure which is necessary so that the ball
bearings roll rather than skid along the running surfaces. By applying a constant
installed load, it also reduces the amount of deflection within the bearing when
external operational loads are applied.

The bearing consists of a steel one-piece outer housing, which forms the two
outer races (running surfaces) of each half of the bearing, two steel inner races,
two sets of nine silicon nitride ceramic ball bearings and two bronze alloy cages.
The cages sit between the inner and outer races of the bearing to locate the ball
bearings, ensuring the balls are in contact with the races in the correct position.
An elastomeric seal on each end of the bearing prevents entry of contaminants
and debris.

The AW169/AW189 bearing internal free space is completely filled with grease
which weighs 6 g in total. The bearing manufacturer stated they typically fill
25 to 35% of the free space on sealed bearings, but a 100% fill was specified

© Crown Copyright 2023 21 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

for this bearing. The AW139 bearing drawing has recently been amended
from requiring 100% to specifying a minimum 33% fill, which equates to 2 g of
grease in total.
Information
Factual

Figure 12
Bearing in new condition - (A) Housing and outer race, (B) inner race, cage
and balls assembled, (C) cage, seal and inner race disassembled

Figure 12 shows the housing and the outboard row, outer race in image A. Image
B shows the inner race, cage and balls as they have been removed from the
housing in image A and turned over (the top surface in view is normally located
in the middle of the bearing). Image C shows the inner race, cage and seal
after they have been disassembled and the balls removed. The other row of the
bearing is identical but is installed the opposite way around (mirror image).

The combination of steel races with ceramic ball bearings is referred to as a

hybrid bearing. Use of ceramic ball bearings provides several benefits over
traditional all steel bearings.

These include weight reduction, a wider operating temperature range, allowing

higher rotational speeds, better resistance to corrosion and they are electrically
isolating. However, as the silicon nitride material is exceptionally hard, it is also
more brittle and can be susceptible to shock loads. The relative hardness of
the ceramic ball compared to a steel ball bearing also reduces the contact
area with the races, resulting in approximately 12% higher contact pressure14
applied to the race material under the same load.

14 The figure of 12% is quoted by a number of research papers including: Lorösch, H.K., Vay, J.,
Weigand, R., Gugel, E., Kessel, H., (1980). Fatigue Strength of silicon nitride for high-speed rolling
bearings, Transactions of ASME, J. of Engineering for Power, vol. 102, 128-131.), A figure of 12.8% is
also quoted by NASA paper NASA/TM-2005-213061.

© Crown Copyright 2023 22 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.6.3 Tail rotor duplex bearing development history

Hybrid bearings have been used in various industry applications for around
40 years but are less common in aerospace applications, particularly in critical
safety functions.

The helicopter manufacturer first introduced the hybrid duplex bearing

design on the AW139 tail rotor control system as p/n 3G6430V00151. This
was subsequently modified in 2006 by a minor modification to facilitate
assembly, which changed the part number to 3G6430V00153. The bearing

Information
is manufactured and delivered as a sealed unit by the bearing manufacturer,

Factual
and is then assembled onto the tail rotor actuator control shaft by the helicopter
manufacturer. The AW139 bearing has accumulated 3,699,82615 hours in
service across both part numbers.

Dimensionally and functionally, the p/n 3G6430V00153 bearing is identical to

the bearing which was subsequently used in the AW169 and AW189 tail rotor
system. However, the original steel specification for the race material was
changed to CHROMEX 40 on the AW189/AW169 bearing to address corrosion
issues experienced in service on the AW139 bearing.

Original certification of the bearing on the AW139 considered it to be an ‘on

condition’ part. This meant it had no scheduled removal time and remained
operating in service until it required replacement due to deterioration of its
performance.

The condition of the bearing in operation was assessed by a tactile check of

the bearing’s rotational smoothness, achieved by disconnecting the spider
from the rotor blades and rotating it by hand. This check was scheduled every
600 flying hours or one calendar year, whichever came first. At 2,400 flying
hours or four calendar years the bearing was removed from the spider, and the
spider assembly visually inspected, before the bearing was refitted. If bearings
were rejected due to roughness during these routine maintenance checks, they
were disposed of by the operator and a new bearing fitted. Data provided to
the investigation from a retrospective assessment of UK and Italian AW139
operators’ records by the UK and EU airworthiness authorities has confirmed
that a number of bearings were being rejected across a range of operating
hours for roughness and axial play, as a result of these inspections.

15 As of March 2023.

© Crown Copyright 2023 23 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

2012 AW139 bearing serious incident

In 2012 an operator based in Qatar suffered a loss of yaw control incident on

an AW139. This was found to have been caused by a failure of the duplex
bearing (p/n 3G6430V00151). Evidence of rotation of the tail rotor actuator
control shaft confirmed that the bearing had seized at some point. However,
as the control shaft had a left-hand thread, the pin carrier had tightened onto
the actuator shaft, rather than unscrewing. This transferred the torque load
back into the bearing, forcing rotation until the bearing components became so
heavily worn that the bearing failed completely, to the extent that it no longer
Information
Factual

provided any resistance to the movement of the hydraulic actuator. Effectively

no longer attached to the control system, the tail rotor blades moved to, and
remained at, a positive blade pitch angle of approximately 10° with no means of
changing the blade position possible by pilot action. The helicopter started to
turn under the influence of the main rotor torque couple, but the loss of tail rotor
control occurred while the helicopter was in forward flight. The reduced engine
torque demand, the vertical tail surface aerodynamically contributing to the yaw
control and the force generated by the default blade position, were sufficient to
allow the pilot to maintain forward flight and perform a ‘run on’ landing without
any additional damage occurring to the helicopter.

Manufacturer’s response

The 2012 AW139 loss of yaw control event wasn’t subject to an independent
Annex 13 investigation, and the operator, helicopter manufacturer and local
airworthiness authority assessed that the bearing was too badly damaged to
conduct a meaningful failure analysis.

As a precautionary response to the bearing failure, the manufacturer applied

two new requirements to the AW139 bearing. The first was an amendment to
the approved maintenance manual stating bearings shall not be refitted after
removal from the spider assembly. The second was to apply a discard life of
3,000 hours. Once a bearing reached this life in service it was discarded by
the operator and a new bearing fitted16. This change was only introduced by
a Service Bulletin from the manufacturer. The airworthiness authority did not
issue an Airworthiness Directive, as such the discard life was not mandated as
an airworthiness requirement. A selection of seven bearings across a range
of service lives from 98 to 7,000 hours were removed and sent back to the
bearing manufacturer for assessment of their condition. No abnormal wear was
identified. The bearing manufacturer’s stated conclusion from this assessment
was that they supported a discard life of 2,400 hours (rather than 3,000 hours),
in addition to the 600 hour rotational inspections.
16 In practice this meant that bearings should have been discarded at 2,400 hours life due to the
maintenance requirement at this time. However, evidence collected following the second incident
suggests operators were confused by the 3,000-hour life and were routinely refitting bearings after the
2,400 hour inspection to achieve the maximum time in service.

© Crown Copyright 2023 24 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Only the AW139 was certified and in service in 2012. However, the operational
load spectrum and discard life for the AW169/189 bearing were being assessed
in the design acceptance phase for both the AW169 and AW189 helicopters
around this time. The usage and load spectrum for the AW169/189 bearing,
although different from the AW139 spectrum, was developed using experience
from the AW139 as a reference and resulted in the same recommended discard
life and inspection period from the bearing manufacturer.17

2022 AW139 bearing incident

Information
A second AW139 bearing failure was identified by a UK operator on the ground

Factual
during post-flight checks in June 2022. Although the bearing failure was found
before it resulted in an in-flight incident, the circumstances and nature of the
failure were similar to the 2012 AW139 occurrence. The bearing life at removal
was 2,750 hours. This incident is currently under investigation by the AAIB as
a separate investigation case18.

The helicopter manufacturer has taken several safety actions on the AW139
fleet following this failure event, including various inspection and replacement
requirements for installed bearings and reducing the discard life to 2,400 hours
to match the maintenance task interval requiring the bearing to be removed.
While not the stated reason for the change, this also aligned it with the bearing
manufacturer’s recommended discard life for the AW139 and AW169/AW189
bearings.

This limit is still considered a discard life rather than an airworthiness limitation,
despite removal from service of bearings over 2,39019 hours being mandated
by EASA Airworthiness Directive No 2022-0182-E.

1.6.4 AW169 and AW189 tail rotor design and certification

Up until 2023 and at the time of certification of the AW169 and AW189, there
were no requirements at all in CS 29 specifically covering bearing design or
fatigue tolerance requirements relating to any form of rolling contact fatigue
(RCF)20. As a result, bearings are not individually certified but are considered
as part of a system. The assessment of bearing performance in drivetrain or
control applications during the certification process has typically been based
on review of the condition of bearings after completion of an endurance test
specified by CS 29.923 and following development and certification flight test
campaigns.

17 See section 1.6.5.3 for more detail.

18 AAIB case reference AAIB-28373.
19 The AD allows 10 hours for implementation, giving a total limit of 2,400 hours.
20 See section 1.18.13 A new AMC has been introduced to 29.571 directing manufacturers to consider RCF
as part of their analysis.

© Crown Copyright 2023 25 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The tail rotor duplex bearing and the tail rotor actuator control shaft onto which
it fits are separated into two different systems in the design of the helicopter.
The applicable regulations quoted by the helicopter manufacturer in their
certification report for the AW169 tail rotor system, which includes the duplex
bearing, were CS 29.547 and CS 29.602. These covered the design safety
assessment and identification of critical parts. The tail rotor control actuator
was assessed against CS 29.1309 and CS 29.602 as it forms part of the tail
rotor control system. These also cover the design safety assessment and
critical parts.
Information
Factual

The design system safety assessment completed by the helicopter manufacturer

identified failures at a system level, which meant the effect of failures of the
duplex bearing and the Tail Rotor Actuator (TRA) were assessed separately
and covered in different reports.

The TRA reports were completed by the actuator manufacturer and provided to
the helicopter manufacturer. The Failure Modes and Effects Analysis (FMEA)
which the TRA manufacturer conducted, only considered the potential failure
of the component parts of the actuator itself. They stated that they were not
informed about the effect of failures within other connected components that
could adversely impact the actuator parts, for example rotation of the shaft
driven by gearbox torque. These were considered by a system level assessment
and therefore stated as being outside of the scope of the TRA manufacturer’s
analysis. As such, rotation of the nut to allow disconnection from the input/
feedback lever was not identified in the FMEA as a potential failure mode.
They informed the investigation that the thread direction was not specified for
the actuator end locking nut in the design specification, and they did not have
access to the design of the AW139 TRA at the time for comparison. However,
the TRA manufacturer did identify that loss of control of the actuator due to a
structural failure of the position feedback was catastrophic.

In a separate report the helicopter manufacturer identified that failure of the

tail rotor to provide the necessary variable thrust was catastrophic and that
this would result from seizure of the duplex bearing. It was anticipated by the
helicopter manufacturer’s analysis that in the event of a failure of the bearing,
the control shaft would fracture.

Analysis of the failure and loss of retention capability of the castellated locking
nuts at both the bearing end and the actuator end of the control shaft, were also
classed as catastrophic. Though these were also considered separately as the
actuator end nut formed part of the TRA assembly, whereas the bearing end
nut was considered part of the tail rotor assembly. The duplex bearing and both
the locking nuts were identified as critical parts21.
21 Critical parts are explained in section 1.18.5.

© Crown Copyright 2023 26 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The airworthiness authority responsible for certification of the AW169 and

AW189 confirmed that once the system safety assessment identifies the
failure of a component as catastrophic, then there is no requirement for the
manufacturer to consider the associated implications of that failure.

The locking nuts at both ends of the control shaft were also certified as compliant
with CS 29.607, which required two separate locking features for safety critical
fasteners.

1.6.5 Duplex bearing design and load analysis

Information
Factual
1.6.5.1 Factors contributing to tail rotor control loads

There are three main factors which determine the magnitude of the axial load
(FZ)22 on the tail rotor bearing. The amount each factor contributes to the overall
load varies depending on the operating conditions and the manoeuvre being
flown, but the broad ranges are:

Inertial Loads 50% - 60%

Elastomeric Loads 30% - 40%
Aerodynamic Loads 10% - 15%

Inertial Loads

These are loads which are generated by the inherent physics of a tail rotor
blade rotating at speed. As described in section 1.6.2, the tail rotor blades can
be adjusted using the control system to rotate each blade around its longitudinal
axis, this changes the pitch (angle) of the blade relative to the plane of rotation.
The centrifugal loads on the blade as it rotates circumferentially inherently drive
the blade towards a flat (0°) pitch angle; this load would be present even if the
blade was operating in a vacuum.

To change and then maintain a different pitch angle on the blades, the control
system must apply an opposing load sufficient to move the blades to the
required angle and then maintain an equal and opposite load to the inertial
load. The faster the tail rotor rotates, the greater the inertial load on the blades.

Elastomeric Loads

To allow the tail rotor blades to rotate in pitch about their longitudinal axis relative
to the fixed attachment to the tail rotor hub, they are fitted with a bearing. As the
blade is only required to rotate in a range between -10° and 25° on the AW189
and AW169, this is achieved by twisting a flexible elastomeric material, rather

22 See Figure 11 for definition of loads and directions.

© Crown Copyright 2023 27 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

than using a conventional mechanical bearing. This approach has a number of

advantages but requires a force to be applied to overcome the inherent stiffness
of the elastomer in order to deform it. The stiffness of the elastomer varies with
temperature, so the control load required to move the blade increases as the
material cools and reduces as it warms up. The force required to continue to
rotate the blade also increases the more the elastomer becomes twisted as
pitch angle increases.

Aerodynamic Loads
Information

The amount of lift generated by a rotor blade depends on several factors. Those
Factual

which can vary during operation are:

● Speed of the airflow over the blade: a combination of the

speed of the blade through the air (driven by the torque
produced by the engines), the speed of the moving helicopter
and the relative wind speed.

● Density of the air: this changes with altitude and temperature.

● Angle of attack (AOA) between the airflow and the blade: the
angle between the blade and the direction of the airflow as it
meets the blade.

As these three factors increase, the amount of lift generated also increases.

As the amount of lift increases, so too does the amount of drag. Lift and drag
are referred to as aerodynamic forces as they are generated by the blade
interacting with the surrounding air. Aerodynamic forces are lowest when the
blades have a zero angle of attack to the airflow over them. As the angle of
attack increases an increasing aerodynamic moment created by the drag force
tries to return the blade to the lowest drag attitude. To increase the amount of
lift for a given airflow, the tail rotor control system must apply an opposing load
sufficient to overcome this aerodynamic moment and must maintain an equal
and opposite load to sustain it.

1.6.5.2 Factors affecting the demand for tail rotor lift23

Main rotor blades must produce sufficient lift to overcome the weight and drag
of the helicopter to allow it to take off, hover and manoeuvre. In the hover the
helicopter is stationary, so airflow over the blades depends on the rotation of
the rotor blades and the wind speed and direction. The heavier the helicopter,
the lower the positive contribution from the wind speed or the lower the air
density, the greater the blade pitch angle required to generate sufficient lift to
maintain the hover.
23 This section references information contained in the FAA Helicopter Flying Handbook FAA-H-8083-21B.

© Crown Copyright 2023 28 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

At low altitude the helicopter benefits from ‘ground effect’. This is caused by the
interaction with the ground of the downwash generated by the main rotor. For
most helicopters, it occurs up to a height of approximately one rotor diameter
(measured from the ground to the rotor disk). It has the effect of making the
rotor system more efficient by decreasing the downward airflow velocity. This
increases the blade AOA without changing the pitch angle, thereby reducing
the drag for the same amount of lift. Above this height, the effect is lost, and the
required AOA must be achieved by increasing the blade pitch angle.

The greater the blade pitch angle, the more drag the blades create and the

Information
Factual
greater the torque which must be generated by the engines to overcome it. Any
increase in the torque required to rotate the main rotor blades creates a larger
torque couple, which must then be countered by an increase in lift24 generated
by the tail rotor blades.

The direction of the wind can also increase the amount of force required from
the tail rotor. Tailwinds and crosswinds will attempt to weathervane the nose
of the aircraft into the relative wind by acting on the fuselage and vertical fin,
requiring greater tail rotor control inputs to counter them.

Further complications can occur in the hover and when the wind direction
relative to the tail rotor blades comes from an adverse direction, as this can
reduce the aerodynamic effectiveness of the blades, for example:

● Airflow and downwash generated by the main rotor blades

can interfere with the airflow entering the tail rotor.

● A high main rotor pitch angle demand can induce considerable

main rotor blade downwash and hence more turbulence.

● Main rotor blade tip vortices can enter the tail rotor causing it
to operate in an extremely turbulent environment.

● Wind at velocities of about 10 to 30 kt from the left front will

cause the main rotor vortices to be blown into the tail rotor.

● During a turn, the tail rotor will experience a reduction in control

force as it comes into the area affected by the main rotor blade
tip vortices.

● Turbulent air from the surroundings and other natural

phenomena can affect the airflow around the tail rotor,
particularly during a confined area takeoff.

24 Given the orientation of the tail rotor, lift generated by the blades acts as a horizontal force rather than
vertical and may also be referred to as thrust.

© Crown Copyright 2023 29 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Aerodynamically the tail rotor works in the same way as the main rotor in that a
low positive contribution from the windspeed and low air density means a higher
blade pitch angle is required to generate sufficient control force, increasing the
amount of drag. Reduced aerodynamic efficiency of the rotor due to operation
in disrupted air results in a similar increased blade pitch demand.

As a result of these factors, higher tail rotor control loads can be experienced
when operating at high gross weight, hovering out of ground effect, at
high altitude or high ambient temperatures, in still air or with the wind from
Information

unfavourable directions, in turbulent air and from asymmetric manoeuvres

Factual

requiring large and prolonged control inputs.

1.6.5.3 Duplex bearing specification and load spectrum development

The specification for a hybrid tail rotor duplex bearing was originally produced
by the helicopter manufacturer during development of the AW139, with the
basic load spectrum shown in Table 1. Of note are the lower axial Fz load,
and the much higher bending moment load (M) for the highest load conditions
(highlighted in yellow), compared to the subsequent AW169/AW189 spectrum
shown in Table 3 (also highlighted). The AW139 sits between the AW169 and
AW189 in terms of size and MTOW.

Condition FZ (daN) FY (daN) M (daNm)

Static limit loads
1 1,247 0 0
2 650 200 30.6
Fatigue loads
1 200 0 6.2
2 80 0 6.2
3 240 0 13.2
4 -80 0 5

Table 1
AW139 load spectrum

The tail rotor bearing specification for the AW14925 was developed in
December 2008. This was passed to the bearing manufacturer who selected
a bearing against the axial (Fz)26 load spectrum provided by the manufacturer,
shown in Table 2. This work assumed a bearing preload of 129 daN in operation,
a nominal operating speed of 1,410 rpm and a maximum speed of 1,438 rpm.

25 The AW149 was a prototype developed as a derivative of the AW139 for use in military applications. It
was never subject to civilian certification requirements.
26 See Figure 11 for definition of load directions.

© Crown Copyright 2023 30 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Occur. Fz Static Fz Dynamic Fz Total

Condition27
(%) (daN) (daN) (daN)

1 0.95 -781.6 190.7 -972.3

2 4.25 -458.2 237.2 -695.4
3 11 -324.8 290.0 -614.8
4 50 -166.8 217.5 -384.3
5 11 152.3 111.4 263.7

Information
6 12 261.0 215.5 476.5

Factual
7 4 362.5 172.3 534.8
8 2 546.7 285.7 832.4
9 4.6 635.1 142.1 777.2
10 0.2 785.0 145.0 930.0

Table 2
Original development load spectrum for the AW149

In February 2009, the bearing manufacturer issued a design document for a

bearing based on the one used in the AW139, using 100C6 steel for the bearing
races. The design estimated a fatigue life (L10)28 of 25,530 hours using the
loads provided. In December 2009 the bearing race material was changed to
CROMEX 40 to give it better corrosion resistance. This was done to address
in-service problems experienced on the AW139 bearing. The bearing was given
the part number 4F6430V00551 and assessment of the new material using the
same loads resulted in a reduction in the L10 life by the bearing manufacturer
to 16,791 hours.

Further analysis of the tail rotor component parts determined that the loads
generated by the stiffness of the elastomeric bearings used on the tail rotor
blade pitch mechanism were higher than originally expected, these were
anticipated to increase further in cold weather. In October 2010 the bearing
was fitted to the instrumented AW149 Tie Down Helicopter rig for initial load
assessment trials. The testing confirmed that the tail rotor control loads
were higher than anticipated by the original load spectrum. The AW149 was
a military rather than civil programme, so it was not necessary to meet civil
certification requirements. As such, the loads analysis conducted at this stage
was only required to validate the safety case for conducting prototype flight
test trials.

27 ‘Condition’ is the manufacturer’s terminology for the reference points used to define the load spectrum.
28 Bearing L10 life is explained in section 1.18.6.

© Crown Copyright 2023 31 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Coinciding with this work, in 2010 a specification document was issued for
a tail rotor duplex bearing for the AW169. The load spectrum supplied to the
bearing manufacturer to design the bearing is shown in Table 3. This assumed
a bearing preload of 113 daN in operation, a nominal operating speed of
1,586 rpm and a maximum speed of 1,666 rpm.

M (daNM)
Occur. Fz Static Fz Dynamic Fz Total
Condition
(%) (daN) (daN) (daN)
Information

1 0.5 -1,080 250 -1,330 3.43

Factual

2 2 -890 150 -1,040 3.94

3 11 -700 100 -800 3.73
4 25 -510 110 -620 4.24
5 57 -320 110 -430 4.19
6 4 130 110 240 3.41
7 0.5 250 110 360 3.67

Table 3
Original development load spectrum for the AW169

As the stiffness of elastomeric material is affected by temperature, and based

on the AW149 experience, the helicopter manufacturer elected to apply a
conservative ‘stiffening factor’ to the elastomer components to anticipate
operation at very low temperatures. This stiffening factor contributed between
18% and 25% of the axial Fz total load, resulting in higher loads in the AW169
spectrum than in the AW149 spectrum, despite the AW169 being a smaller
helicopter. The actual loads would be assessed by cold temperature trials
during the flight test programme and use of a conservative factor was intended
to avoid the need for disruptive redesigns at a later stage in the development
process. A bearing, part number 6F6430V00351, was then developed by the
bearing manufacturer to meet this specification.

In May 2011, the helicopter manufacturer applied to the European Union

airworthiness authority for type certification of the AW189 to begin.
The AW189 was essentially the same helicopter as the AW149 but certified to
CS 29 standards for civil use. By 2012, it was identified that the higher bearing
loads measured on the AW189 would likely be enveloped by the load spectrum
being used for the AW169 bearing development. In July 2012 the helicopter
manufacturer requested that the bearing manufacturer assess the AW149/189
bearing (part number 4F6430V00551) against the AW169 load spectrum, with a
view to using this bearing in both applications. In September 2012, the bearing
manufacturer issued a design document summarising the conclusion of this work.

© Crown Copyright 2023 32 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Using a preload of 120 daN and a rotational speed of 1,586 rpm, they
determined that the bearing (p/n 4F6430V00551) as defined for the AW189
application was also acceptable for operation with the AW169 load spectrum,
though this resulted in a reduced L10 life of 12,882 hours.

In the bearing manufacturer’s design document, the summary stated:

‘Hertz stress29: Hertz stress values for dynamic conditions are quite
high, out of the range in which bearing life could be assumed as

Information
infinite. Under overload conditions, the Hertz stress values are up

Factual
to 3795 MPa, what is acceptable, but very close to the maximum
allowable stress for this kind of conditions, i.e. close to plastic
deformation of the bearing raceways.

Hertz stress under overload condition is acceptable, bellow[sic] the

maximum allowable limit.

Hertz stress under ultimate load is above current limits for standard
conditions, but no problem of bearing destruction is to be expected.
The bearing will be submitted to slight plastic deformation, what is
acceptable for an ultimate load.

Ball excursion values are within acceptable range.

Hoop stress values are within acceptable range.

In order to contain the contact ellipsis within the shoulder and avoid
truncation30, the cage design is on “Z” shape.

The calculated life (12882h) is a pure cyclic fatigue life of the material
and doesn’t account for bearing environment (grease, pollution…)

The investigations after operating tests on similar bearings show

with confidence an operating time limit (OTL) at 2400 hours.

To verify that the bearing works properly and to guarantee the

continuous airworthiness, we advice[sic] to make a roughness
check after every 600 hours operating.’

29 Hertz stress is explained in section 1.18.6.

30 Truncation occurs when the whole of the normal contact area between the ball and the race is no longer
supported within the running surface of the race, for example if the ball is running partially over the
shoulder at the edge of the running surface where the geometry changes. This can result in significantly
increased stress on the ball where it contacts the corner edge of the race.

© Crown Copyright 2023 33 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The percentage of operating time at the various load levels shown in the design
load spectrum was estimated based on experience with other helicopters and the
various role profiles that the helicopter was designed to be used for. These were
then combined into an overall usage spectrum. The spectrum assumed most
of the flight time is spent in the cruise, where engine torque demand is reduced
and the aerodynamic force generated by the vertical fin offsets some of the force
required from the tail rotor to maintain a heading. Conversely, the highest axial
load case is anticipated to be experienced for only 0.5% of the life of the bearing.
Information

The L10 life for the bearing of 12,882 hours was based on theoretical optimised
Factual

conditions which would allow the bearing to reach its maximum fatigue
life, it did not, for example, account for any degradation of the grease. A
recommended discard time for the bearing of 2,400 hours was then proposed
to account for any adverse conditions and the inherent variability within the L10
life calculation. Finally, a repetitive 600 hours in situ rotation check of the tail
rotor was recommended by the bearing manufacturer. This was subsequently
reduced to 400 hours by the helicopter manufacturer, in line with the AW169
Maintenance Review Board report.

The full load spectrum used to confirm acceptability of the bearing in both
applications, as stated in the bearing manufacturer’s design report, is shown
below in Table 4. The highlighted values indicate the highest considered values
for dynamic axial load, bending moment and Hertz Stress (contact pressure) in
normal operation.

1.6.5.4 Control of bearing discard life and inspection tasks

The manufacturer published an Approved Maintenance Planning Information

(AMPI) manual for the helicopter to comply with the continued airworthiness
instructions requirement CS 29.1529. For the AW189 and AW169 a process
was used called a Maintenance Review Board (MRB). This is a standardised
process accepted by EASA, the FAA and Transport Canada as an acceptable
means of compliance for the regulation. It involved a review board comprised
of representatives from the manufacturer, certifying airworthiness authorities
and operators. They used the latest Maintenance Steering Group (MSG-3)
methodology31 as a tool to assess what scheduled maintenance was required
to maintain the airworthiness of the AW169 in service, based on candidate
tasks submitted by the helicopter manufacturer. The output of this review
process was an MRB report which contained the recommended minimum
initial scheduled maintenance requirements. This report was then considered
in combination with the output of the regulatory compliance activity by the
helicopter manufacturer to determine the final content of the AMPI.

31 MSG-3 logic is owned by A4A. It is reviewed and updated by a Maintenance Programs Industry Group
and approved by the International MRB Policy Board.

© Crown Copyright 2023 34 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

PRELOAD UNDER OPERATING CONDITIONS

Preload [N]: 1200

Preload [mm]: 0.033

OPERATING LOADS

Flight Cycle

Outer ring Mean Cubic Power Max

Cond. % Time Speed
[rpm] Fz [N] M [N.m] Fz [N] M [N.m]
1 0.5 1,586 -11,080 22.34 -13,300 34.3
2 2 1,586 -9,020 25.88 -10,400 39.4
3 11 1,586 -7,070 24.21 -8,000 37.3

Information
4 25 1,586 -5,216 27.51 -6,200 42.4
5 57 1,586 -3,378 27.33 -4,300 41.9

Factual
6 4 1,586 1,658 22.35 2,400 34.1
7 0.5 1,586 2,722 23.9 3,600 36.7

Overload

Outer ring
Cond. % Time Speed Fz [N] M [N.m]
[rpm]
Overload - - 24,000 0
Ultimate - - 36,000 0

HERTZ STRESS* & CONTACT GEOMETRY*

Max Power - Loaded Row

Hertz Stress Contact Ellipse

Ball Trip
Cond. Inner Ring Outer Ring Inner Ring Outer Ring
(mm)
(MPa) (MPa) (deg) (deg)
1 3340 3160 7.7 72.2 17.2 62.7 0.22
2 3170 2990 8.4 69.2 17.3 60.3 0.21
3 2980 2800 9.1 65.7 17.4 57.4 0.20
4 2850 2670 9.5 63.3 17.3 55.5 0.18
5 2655 2475 10.0 59.8 17.2 52.6 0.15
6 1960 1795 9.7 45.5 14.8 40.4 <0.1
7 2030 1855 8.0 45.2 13.4 39.9 <0.1

Overload and Ultimate Load - Loaded Row

Hertz Stress Contact Ellipse

Ball Trip
Cond. Inner Ring Outer Ring Inner Ring Outer Ring
(mm)
(MPa) (MPa) (deg) (deg)
Overload 3795 3595 2.9 77.6 14.2 66.3 -
Ultimate 4250 4060 0 85.8 13.2 72.45 -
* On the most loaded ball

Table 4
Certification load spectrum for the tail rotor duplex bearing

CS 29.1529 also directs manufacturers to include a separate Airworthiness

Limitations Section (ALS) in their instructions for continued airworthiness. This
section must be formally approved by EASA at certification and again each time
it is subsequently amended.

CS 29.571 and CS 29.573 which address fatigue and damage tolerance

require mandatory latent failure inspections and component replacement times

© Crown Copyright 2023 35 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

identified as necessary for continued airworthiness of Principal Structural

Elements (PSE) to be specifically listed in the ALS. There are currently no
other regulations in CS 29 which explicitly direct component life limitations to
be listed in the ALS as airworthiness limitations.

The AMPI produced by the manufacturer has two chapters relating to replacement
of components at specific service intervals. Chapter Four listed components
were assessed to comply with CS 29.571, where inspection and/or replacement
of PSE at a specific service life was considered an airworthiness requirement.
Information

These lives were agreed with the airworthiness authority and cannot be changed
Factual

without their approval. They are based on a defined helicopter usage profile
and variation in service will result in penalty life reductions. This chapter met
the regulatory requirement for an ALS. The limitations listed within Chapter Four
were not subject to review under the MRB process.

Chapter Five of the AMPI dealt with scheduled maintenance. While

these tasks are also necessary to ensure the continued airworthiness
of the helicopter, they do not have the same status as the airworthiness
limitations in the Chapter Four ALS32. Chapter Five contained a section
entitled ‘Time Limits’. The introduction for this section stated, ‘This section
gives the recommended time limits requirements for the components of the
helicopter’. Within this was a sub-section entitled ‘Discard Time Schedule’,
which stated, ‘This sub-section gives the indication of the number of hours/
months/years at which the component must be discarded.’

The tail rotor duplex bearing Operating Time Limit (OTL) and inspection
interval were recommended by the bearing manufacturer33. These were then
used by the helicopter manufacturer in the output of the design assessment
process completed by them to comply with CS 29.547 and raised as candidate
preventative maintenance tasks. These candidate tasks were then discussed
and agreed with EASA. The conclusion of this process was that the OTL would
be included in Chapter Five of the AMPI as a discard time of 2,400 flight hours.

The MRB process operates independently of the regulatory compliance

process. The manufacturer then compared the output from both processes
to determine the final content of the AMPI. This resulted in a variation of the
bearing inspection interval from the bearing manufacturer’s recommended
600 hours to 400 hours.

The method by which the AMPI for the AW139 was developed differed slightly
from the AW189/169, as it did not use the MRB process. However, the results
32 Scheduled maintenance task intervals are typically permitted to be extended by the Continuing
Airworthiness Maintenance Organisation (CAMO) within limits set by the manufacturer and detailed in
the approved maintenance programme.
33 Refer to section 1.6.5.3.

© Crown Copyright 2023 36 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

gave the same approach of applying a Chapter Five discard life rather than a
Chapter Four airworthiness limitation34.

1.6.6 AW189 and AW169 flight test load surveys

The AW189 flight loads were measured during a load survey campaign,
performed using two flight test prototypes and spanning 47 flights between
19 September 2012 and 20 June 2013. The AW169 load survey was conducted
over 47 flights between April 2013 and November 2015.

Information
The AW169 and AW189 flight test campaigns were designed to measure the

Factual
loads on a large number of the helicopter’s components when flown in routine
configurations and to the limits, or corner points, of the operating envelope with
respect to gross weight, longitudinal and lateral CG positions and altitude. For
the AW169, tests were conducted at two main airfield elevations, sea level and
5,000 ft, and up to 15,000 ft inflight. Some near ground manoeuvre testing was
also done at airfield altitudes of 10,000 ft, 12,000 ft and 14,000 ft, though gross
weight was limited to 4,600 kg at 10,000 ft and above, and 4,200 kg at 14,000 ft.

Some additional cargo hook testing was done at an airfield elevation of 7,000 ft on
the AW169. For the AW189, testing was done at airfield elevations of sea level and
8,000 ft. In-flight altitudes up to 20,000 ft were also tested. Not all test manoeuvres
were repeated at every variation of altitude and gross weight and the shape of the
CG envelope meant the forward CG limit moved further aft at higher gross weights.
Some of the test points were repeated to explore aspects such as the variable
rotor rpm system on the AW169, cabin strengthening modifications on the
AW189 and the vibration control systems on both helicopters. Comparison
of loads at extreme hot and cold air temperatures was conducted. Load
assessments for specialist role equipment were also carried out, including
rescue hoists for search and rescue and a cargo hook for underslung loads.
All the test points were flown to a defined and repeatable procedure and the
static and dynamic loads were recorded by the installed instrumentation on the
prototype airframes. The test points were typically short in duration, commonly
with a 20 seconds ‘entry’ to achieve the required test criteria, 20 sec at the
‘steady’ state test point and 20 sec to ‘exit’ back to the pre-test condition.

This data was assessed post-test primarily for fatigue purposes using alternating
fatigue loads, which were typically lower than the maximum and minimum loads
recorded for each test point. Some assessment was done regarding absolute
load figures, but this was primarily a sample assessment of a select number of
key parameters to determine how critical the variations in altitude, CG location
and air temperature were to the loads encountered.

34 Refer to section 1.6.3

© Crown Copyright 2023 37 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

For the AW169, the summary of findings from the flight test load survey activity
was documented in the helicopter manufacturer’s report 169F0290T001/2/01.
With regard to altitude variations, it concluded:

‘Flight loads measured at 5,000 ft are generally higher than those

measured above 5,000 ft for all considered components and
parameters.’

For loads specifically related to airfield manoeuvres, it reported:

Information
Factual

‘The flight loads registered on AW169P3 helicopter during flight at

field altitude 5,000 ft are lower or at least similar to those recorded at
sea level (0 ft). For the key parameters loads recorded at sea level
(Core Load Survey) are in several cases higher or at least similar
to those gathered at 10,000 ft HD. Flight loads at 12,000 ft HD are
generally less critical than those coming from lower field altitudes.
Plots show that the weight limitation applicable at 14,000 ft HD it is
sufficient to obtain loads similar to what[sic] measured previously.’

For the loads related to use of the rescue hoist, it stated:

‘The investigation of the effects of the lateral CG, typical of

the Rescue Hoist configuration, on the flight loads is done by
comparison between Basic data and Rescue Hoist data. From the
analysed flight conditions and key parameters it can be concluded
that there is no significant difference between Basic and Rescue
Hoist configurations from an aerodynamic point of view.’

For comparison of internal vs external load carrying using the cargo hook, it
concluded:

‘No significant differences are shown confirming that helicopter

flight loads depend only on the total weight of the aircraft. For
conditions performed at field sea level and field high altitude the
data show no significant differences between Basic and Cargo
Hook configurations.’

The two key parameters relevant to validation of the bearing load spectrum
were axial load (FZ), which was measured using strain gauges at a single point
on the tail rotor actuator control shaft, labelled TH1. The other was bending
moment. As it was not possible to measure this at the bearing itself, it was
measured at two points on the actuator control shaft labelled 'BB1' and 'BB2',
and in two planes at 90° to each other labelled ‘PRL’ and ‘NRL’, using arrays of
strain gauges (Figures 13 and 14).

© Crown Copyright 2023 38 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Figure 13

Information
AW169 flight test instrumentation location of sensors to measure axial load

Factual
and bending moment
(Original image courtesy of the manufacturer)

Figure 14
AW169 flight test instrumentation to measure axial load and bending moment
(Original image courtesy of the manufacturer)

A sign convention was used by the helicopter manufacturer to identify load

direction. For axial load, extension of the control shaft away from the hydraulic
pack was negative and retraction towards the pack was positive35. For bending
moment, right to left (looking vertically down) was positive for ‘PRL’ and top to
bottom was positive for ‘NRL’.

The load surveys carried out during the AW169 flight testing recorded highest
tail rotor axial loads that were lower than the development load spectrum
(Table 3) had predicted. The manufacturer stated that they considered this
was due to the conservatism used in the elastomer stiffening factor, which cold
temperature trials confirmed was not as severe as originally anticipated. The
AW189 uses different elastomer materials than the AW169 and the loads were
similar to those in the spectrum.

35 The annotation for TH1 in Figure 14 shows both directions as positive in error. The right arrow should
indicate negative load direction.

© Crown Copyright 2023 39 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The results of the flight test load survey were not shared with the bearing
manufacturer to validate the original bearing suitability assessment.

The test data was requested by and provided to the investigation for detailed
assessment.

1.6.7 Tail rotor certification testing

The assessment of bearing performance in drivetrain applications during the

certification process for the AW169 and the AW189 was, with the agreement
Information

of the certification authority, based on review of the condition of bearings after

Factual

completion of an endurance test and following development and certification

flight test campaigns.

1.6.7.1 Tie down helicopter rig endurance test

For both the AW169 and AW189 an endurance test was carried out in accordance
with CS 29.923, using a test rig called the Tie Down Helicopter (TDH). As the
name suggests, this was a fully functional helicopter airframe restrained to the
ground to prevent it from moving during testing. The test schedule, specified by
CS 29.92336, included 20 equal duration cycles of 10 hours or more at various
power settings used in normal operating conditions, plus a number of abnormal
condition operating periods such as main rotor overspeed and overtorque,
with the torque from both engines or with one inoperative. One phase of the
test included three hours of operation at main rotor maximum continuous
torque and speed. During this period the yaw controls had to be cycled at
least 15 times each hour through maximum left turn, neutral, to maximum
right turn. The full yaw pedal input was held for 10 seconds at each extreme.
During the rest of the test the control inputs in yaw replicated the following
scenarios in sequence:

● Max vertical thrust (20% of time)

● Max forward thrust (50% of time)

● Max left thrust (10% of time)

● Max right thrust (10% of time)

● Max rearward thrust (10% of time)

The manufacturer confirmed that the airframe was fully instrumented during
the test. Whilst the test specification was primarily intended to endurance test
the main mechanical components of the drivetrain system, the instrumentation
also recorded the tail rotor actuator loads during these simulated manoeuvres.

36 The full text of the requirement can be found in Appendix H.

© Crown Copyright 2023 40 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

As such, the tail rotor loads achieved were a product of the test, rather than the
test being intended to achieve specified tail rotor load targets.

Given the high sampling rate and the large volume of data this generated,
it was not practical for the investigation to obtain all the data recorded or to
analyse the bearing bending moments. However, representative samples for
axial load from each phase of the test were provided by the manufacturer and
were reviewed. The sampling rate of 1 kHz meant that extremely transient
short duration loads were captured. Although absolute load magnitudes are

Information
quoted these may have only occurred for fractions of a second. The load data

Factual
showed significant variation in the absolute values over the 20 second duration
of the samples provided, which the manufacturer confirmed was partly due to
‘noise’ within the data. This was particularly evident on the AW189 dataset.

From the data provided, the highest absolute tail rotor axial loads on the AW169
test were generated during the maximum continuous power test, at 100% NR
when full left yaw pedal was applied, and an axial load of 9,738 N was recorded.
This load was reasonably consistent and repeatable for the four 10 second
periods that this pedal position was held in the data sample provided. A total
of 45 pedal applications were made during this phase of the test, resulting in
the load being applied for 7.5 minutes. The highest consistent axial load in any
other test phase was during the 6 minute overspeed power test ‘right flight’ at
105% NR, when an average load of 6,836 N was recorded. All the other loads
in the data provided were lower than this.

On the AW189 the highest load was recorded during the overspeed power test
‘left flight’ at 105% NR, when a transient figure of 18,488 N was recorded.

However, the peak-to-peak values recorded in this 20 second sample gave a

range of 11,225 N and the manufacturer stated this maximum figure was likely
to have just been noise in the data rather than a genuine load. Given the noise
limitations in several of the recorded data samples it was difficult to determine
with precision the highest consistent load for the AW189. A 20 second sample
from the 12 minute long ‘hover’ section of the maximum continuous power one
engine inoperative test phase at 104% NR was reasonably consistent and gave
an average of 9,127 N but most of the average loads where the magnitude
range was more consistent were below 5,000 N.

The tests ran for 383 hours on the AW169 and 334 hours on the AW189. At
the end of the respective tests each tail rotor bearing, along with all the other
drivetrain components, was disassembled and in this case inspected by the
bearing manufacturer. No visual evidence of RCF damage was identified in
either case, allowing the bearings to pass the certification test. No laboratory
investigations to assess the material microstructure were carried out, as these

© Crown Copyright 2023 41 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

were not required by CS 29.923. The inspection did confirm that for the AW169
test, the bearing contained 3.62 g of grease when disassembled compared to
the original 6 g when new. There was no evidence of damage or displacement
of the bearing seals. On the AW189, 3.14 g of grease remained from the
original 6 g: no damage to the seals was noted.

1.6.7.2 Flight test programme

Tail rotor bearings were fitted to nine helicopters used during the certification
flight test programmes of the AW189 and AW169. A snapshot of the record
Information
Factual

of flight hours performed on each bearing was quoted by the manufacturer in

email correspondence (Table 5)37 up to the point when the new post-accident
modified bearings38 were installed.

The columns should be read vertically, with the five-digit numbers in row two
referring to the individual flight test helicopter serial numbers. The duplex
bearings fitted to each airframe during its life are indicated by the serial number
in brackets. The last two rows report the amount of flight hours performed
pre-certification and post-certification.

The original duplex bearing part number shown in column one was
4F6430V00551. MM6430V00151 is the part number for the new bearing
introduced following the accident, which has been fitted to a number of flight
test helicopters as shown.

The manufacturer advised that only two duplex bearings, fitted during the
original certification flight testing, were removed for reasons relevant to the
investigation.

For helicopter s/n 69004, bearing s/n 12112 was removed on 22 November
2013, as a slight roughness in operation was detected during a scheduled
25 flight hour inspection39. The roughness was not confirmed once an axial force
was applied to the races while rotating the bearing and no further investigation
was carried out.

For helicopter s/n 69004, bearing s/n 13108 was removed on 19 June 2014
due to the presence of grease on the bearing face during visual inspection. The
bearing was considered serviceable after removal and no further investigation
was carried out.

37 Flight hours accrued as of 5 April 2021.

38 In response to this accident the helicopter manufacturer replaced the existing bearing with a new bearing
type. See section 1.12.4 for details of the modification.
39 Maintenance requirements for prototypes are different from in-service maintenance requirements.

© Crown Copyright 2023 42 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

AW169 (T.C. Issued 15/07/2015) AW189 (T.C. Issued 07/02/2014)

P/N 69002 69003 69004 69005 49002 49003 49004 49005 49006

4F6430V00 (12111) (13128) (12112) (13127) (10103) (10105) (10109) (12104)

551 760h 40’ 783h 40’ 82h 45’ 553h 50’ 850h 15’ 122h 25’ -- 505h 40’

(10107)
(19121) (18122) (13108) (20175) (10106) (17115)
1128h
149h 15’ 291h 15’ 54h 05’ 28h 35' 638h 45’ 0
00’

Installed Installed Installed

P/N (14128) P/N (19154) (10109) P/N
MM6430V0 684h 10’ MM6430V0 51h 50’ 1192h 10’ MM6430
0151 0151 V00151
Installed

Information
(19268) (14110) P/N

Factual
24h 05’ 475h 05’ MM6430V0
0151
Installed Installed
P/N P/N
MM6430 MM643
V00151 0V00151

FH pre T.C. 469h 30' 307h 00' 408h 50' 277h 45' 558h 40' 561h 20' 395h 55' 235h 55' 147h 45'

FH post
440h 25' 767h 55' 436h 15' 304h 40' 291h 35' 726h 45' 796h 15' 892h 05' 357h 55'
T.C.

Table 5
Table 5
Flight hours accumulated on the tail rotor duplex bearings used in flight
Flight hours accumulated on the tail rotor duplex bearings used in flight test,
test, up to introduction of the new post-accident bearing
up to introduction of the new post-accident bearing

After type certification was granted, the respective duplex bearings remained
fitted to the flight test aircraft for continued operation on flight test duties.
No bearings were removed after pre-certification flight testing was completed
specifically to confirm their condition for certification purposes. When the new
post-accident bearing was fitted, the old standard bearings were disposed of
without being inspected.

1.6.7.3 Tail rotor actuator certification testing

The Tail Rotor Actuator (TRA) was designed to work with dual independent
hydraulic systems to provide redundancy. In normal operation both systems are
pressurised and the operating force is combined. In single hydraulic system
operation either system should still be capable of controlling the movement of
the tail rotor blades. The helicopter manufacturer’s safety assessment for the
TRA stated that in normal operation with both hydraulic systems pressurised,
the stall load in both extension and retraction was 25,780 N. For a single
hydraulic system, it was 12,760 N in both extension and retraction. It also listed
unrestricted linear movement (loss of control) of the TRA as catastrophic and
confirmed the castellated locking nut as a single point of failure.

© Crown Copyright 2023 43 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Stall load test

The tail rotor actuator was tested in extension and retraction using each of the
single hydraulic systems in turn.

For hydraulic system 1 the stall loads in extension and retraction were
1,281 kg (12,567 N) and 1,300 kg (12,753 N) respectively. For system 2, they
were 1,284 kg (12,596 N) in extension and 1,327 kg (13,017 N) in retraction.
Information

1.6.8 Tail rotor system failure emergency procedures

Factual

The AW169 RFM contains a single consolidated emergency procedure to cover

all tail rotor system failures, the LTE drill.

AW169 LTE emergency procedure

The preamble to the AW169 LTE emergency procedure states that losing tail
rotor effectiveness ‘will result in a rapid yaw to the right and a loss of yaw
control.’ It explains that the severity of the initial yaw would depend on the
helicopter’s airspeed and main rotor torque settings at the time of failure.
The aerodynamic stabilising effect of the helicopter’s fin and airframe would
increase with airspeed while increased torque settings would lead to higher
de-stabilising forces.

Guidance in the RFM is that ‘severe yaw rates will result in large yaw angles
within a very short period of time and, depending on the flight conditions at the
time of failure, it is possible that yaw angles in excess of 30° will be experienced.’
The RFM further states that ‘very high yaw rates will produce aircraft pitching
and rolling making retention of control difficult without the use of large cyclic
inputs, which are structurally undesirable.’ Due to the disorientating effects on
the pilot, the RFM recommends taking prompt action to prevent post-failure
yaw rates from reaching ‘unacceptably high levels.’

The RFM emergency procedure lists two LTE scenarios: in the hover and in
forward flight (Figure 15). In both scenarios the first required action is to reduce
the de-stabilising main rotor torque using the collective lever. With an anti-
clockwise rotating main rotor, uncommanded right yaw requires the collective
to be lowered, left yaw requires it to be raised.

For the hover scenario, if time permits, pilots should shut down both engines
to remove engine torque. In forward flight, if possible, the helicopter’s speed
should be altered to generate a balancing aerodynamic stabilising force.

© Crown Copyright 2023 44 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Lowering the collective lever reduces main rotor pitch angle, and thereby lift,
leading to a descent. With the collective fully lowered any rate of descent
would rapidly increase. The drill does not offer guidance as to how to judge at
what point the collective should be raised to arrest rates of descent generated
through application of the procedure.

Information
Factual
Figure 15
AW169 RFM LTE emergency procedure
(Courtesy of the manufacturer)

The LTE emergency procedure was not designed to address tail rotor pitch
control runaway and was not required to because this was considered, in
certification terms, a catastrophic failure40. Nonetheless, the most suitable
initial course of action for a pilot in response to a tail rotor pitch control runaway
would be to follow the RFM LTE emergency procedure guidance.

1.6.9 Helicopter performance

Under the EASA regulatory framework, helicopters operate in Performance

Classes, but they are certified according to their engine failure capability.

Performance Classes

Operational regulations are specified according to the single engine failure

capability of the helicopter in a defined area of operations. These are designated
as Performance Classes.
40 One for which it is not possible to design an RFM emergency procedure that would enable the pilot to
regain control and achieve continued safe flight and/or a safe landing.

© Crown Copyright 2023 45 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

● In areas where Performance Class 1 (PC1) operations are

planned the helicopter must be able to safely continue the
flight or land within the rejected takeoff or landing area.

● Performance Class 2 (PC2) requires that the helicopter should

be capable of either being safely flown away or executing a
forced landing during takeoff and landing.

● Performance Class 3 (PC3) operations are those where,

should an engine fail, a forced landing will be required.
Information
Factual

Note: for both PC2 and PC3 operations there must be a reasonable
expectation that no injuries would arise from a forced landing.

Due to the limited availability of alternative emergency landing sites,

PC1‑compliant procedures were applicable when operating at the King Power
Stadium.

Certification categories

Helicopters certified to CS 29 are either in performance Category A, Category

B or both. The two categories are:

● Category A (Cat A). To be certificated in Category A helicopters

must have critical engine failure performance capability
sufficient for continued flight or a safe rejected takeoff.
Certification in Category A requires that the helicopter has
the capability, performance data and procedures necessary
to conduct PC1 and PC2 operations.

● Category B (Cat B). Category B helicopters are not required

to have a guaranteed capability to continue safe flight in the
event of an engine failure.

The AW169 was certificated in performance Categories A and B.

King Power Stadium departure profile

To comply with the regulatory requirement for a PC1-compliant departure from

the King Power Stadium an approved Cat A procedure was required. The
appropriate profile to be flown was the ‘Ground and elevated heliport/helideck
variable TDP41 procedure’ (Figure 16) as specified in the RFM.

41 The takeoff decision point (TDP), is defined in the AW169 RFM as ‘The first point in the takeoff path from
which a continued takeoff (CTO) capability is assured and the last point from which a rejected takeoff
(RTO) is assured, within the rejected take off distance.’ The TDP value represents a height above the
takeoff surface.

© Crown Copyright 2023 46 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The Cat A profile is designed such that should one engine fail between lifting-off
and reaching the TDP the helicopter can safely return to the takeoff position.
Once above TDP height a rejected takeoff is no longer assured and the pilot is
required to continue the takeoff by lowering the helicopter’s nose to commence
an accelerating transition to climbing forward flight with due regard to obstacles
on the planned departure track.

RFM performance data used for calculating TDPs assume a minimum 80 ft

height loss during a continued takeoff after an engine failure at TDP and require
a minimum planned obstacle clearance of 35 ft. The maximum permitted

Information
Factual
crosswind for the departure was 10 kt. The Cat A procedure performance data
also includes a table which allows pilots to calculate the effect on one-engine
climb performance of turns undertaken when above 200 ft ATS42 and climbing
to 1,000 ft ATS at the speed for best rate of climb (VY).

Turns at speeds below VY are not explicitly prohibited by the RFM but could
adversely affect climb performance following an engine failure. Specifically,
turns below the takeoff safety speed (VTOSS) could compromise the helicopter’s
ability to achieve the required 35 ft minimum obstacle clearance height during
a single-engine continued takeoff (CTO) manoeuvre. The manufacturer’s
expectation is that turns will not be flown below VY and it does not publish
performance data to support them.

The RFM contains the following caution related to the variable TDP procedure:

‘If this procedure is modified, it may not be possible, if an engine

fails in the Take-Off path, to carry out a safe OEI[43] landing or
achieve the scheduled OEI performance.’

The investigation found that the performance analysis44 used to support the
initial application for G-VSKP to use the King Power Stadium as a landing site
had assumed an incorrect maximum relevant obstacle height of 70 ft ATS.
Documents provided to the investigation showed that, while the stadium canopy
was 70 ft above the pitch, the roof support structure was approximately 95 ft
high. The performance analysis dated back to 2016 and, using an assumed
height loss of 85 ft and taking 35 ft as the minimum obstacle clearance height,
calculated a TDP of 190 ft, which was then rounded up to 200 ft.

42 Above the takeoff surface.

43 One Engine Inoperative.
44 Undertaken by a previous Operator.

© Crown Copyright 2023 47 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 16
Overview of variable TDP procedure for the AW169

The investigation found evidence to indicate that the pilot had measured the
support posts’ height when he re-surveyed the site in October 201745, but did
not find a subsequently updated version of the performance analysis. Using the
assumptions from the original performance analysis, but based on the height of
the roof support structure, the minimum TDP height for the stadium would have
been 215 ft. The investigation was not able to confirm what TDP height the pilot
was using on the accident flight.

1.6.10 Bird strike protection

The AW169 is certified as a Category A large rotorcraft. The Certification

Standards for bird strike protection, CS 29.631, state that a helicopter in this
category must be capable of continued safe flight and landing after an impact
with a 1 kg bird at VNE46 which, for the AW169, is 165 kt.

45 To satisfy the NCC operator’s requirement for site survey periodicity, see section 1.17.3 regarding
operational oversight.
46 The published never-exceed speed for the helicopter.

© Crown Copyright 2023 48 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.6.11 Fuel tanks

The AW169 is fitted with two 1,130 litre capacity fuel tanks in the rear of the
passenger cabin. Each fuel tank consists of an internal bladder made from
tear and abrasion resistant rubber impregnated fabric, which is encased
in a composite structure (Figure 17). The bladders are positioned within
the supporting structure by fuel resistant high-density foam, to prevent liner
abrasion of the bladder material. A pipe connects the two fuel tanks allowing
fuel to flow between both tanks.

Information
Factual
Figure 17
AW169 fuel tank arrangement
(original image courtesy of the manufacturer)

1.6.12 Cabin configuration

In order to allow the AW169 to meet different role requirements it can be

fitted with several alternative cockpit and cabin configurations. G-VSKP had
been fitted with a VIP interior during manufacture, which allowed up to seven
passengers to be carried in the passenger cabin, four in rearward facing seats
located at the forward cabin bulkhead and three in forward facing seats to the
rear of the cabin.

1.6.13 Health and Usage Monitoring System (HUMS)

The maintenance of a helicopter can be enhanced by analysing occurrences

such as system faults and looking for changes in the vibration levels of the
rotating components. This is done using helicopter systems to gather data,
the manufacturer’s on-line system to process the HUMS data (Heliwise), and

© Crown Copyright 2023 49 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

personnel to review the results and take action where necessary. This description
focuses on the aspects of the system associated with vibration monitoring.

As vibration monitoring systems are not developed or certified to meet the

requirements of a primary safety warning system, the manufacturer must
demonstrate that the helicopter still meets the airworthiness requirements for
reliability and risk mitigation, without relying on vibration monitoring to achieve
this. As G-VSKP was used for Non-Commercial Complex (NCC) operations
HUMS usage was not an operational requirement.
Information
Factual

General system overview

Two Aircraft and Mission Management Computers (AMMCs) form the core of
the data gathering system. These receive data from the other onboard systems
and incorporate the vibration monitoring system. Vibrations are sensed using
accelerometers distributed around the helicopter, and partially processed in the
AMMCs.

Some of the data, such as the raw vibration data, is stored in the Data Transfer
Device (DTD) and other data is stored in the AMMCs. When required, the
AMMC data is transferred to the DTD and then the data is transferred from the
helicopter to the Heliwise system. Each transfer of data to Heliwise is given
a Download Sequence Number (DSN) for that helicopter. As well as other
HUMS tasks Heliwise compares the vibration data with previously downloaded
results to assess trends. Heliwise provides feedback which can be used for
maintenance purposes.

Different levels of manufacturer support are available for analysing the Heliwise
results. G-VSKP was supported under a ‘Standard Support’ arrangement
which meant that the customer was responsible for reviewing the results of the
Heliwise processes which highlight issues, such as increasing vibration trends
and recorded faults. The helicopter manufacturer’s HUMS support team would
then reply to queries raised by the customer.

Heliwise was only used during maintenance inputs for this helicopter. More
regular transfers of data to Heliwise during normal operations, such as at the
end of a day of flying, can add a further layer of health monitoring such as
identifying increased vibration levels associated with specific components.
This was not a requirement for NCC operations.

Occurrence logging

The AMMCs record a log of when significant events occur. These include
cautions and warnings issued to the crew, system faults and torque limits being
exceeded.

© Crown Copyright 2023 50 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Usage monitoring

HUMS can generate summaries of how the helicopter and its systems are being
used. Engine usage and helicopter utilisation as well as more detailed aspects
of the operation can then be assessed to influence maintenance decisions.

Vibration Health Monitoring (VHM)

Rotating parts such as bearings and meshing gears generate vibrations.

Degradation in these parts leads to changes to the vibration characteristics.

Information
Factual
The vibrations can be monitored over time to identify trends that indicate a
developing problem with a component. These trends can be used to trigger
corrective maintenance.

The vibrations are sensed using accelerometers located to detect vibrations

of targeted components. The accelerometer outputs are not recorded or
monitored all the time as their vibration levels will vary under different power or
flight conditions. In order to allow for accurate comparison of vibration levels,
data is only collected when certain conditions are met. The sample rate for the
accelerometers and the types of signal processing carried out on the collected
data must also be tuned to the particular component they are monitoring.
The component type and specific design details affect the optimal monitoring
configuration. In the case of bearings, the frequencies of interest are governed
by how fast the parts are rotating and the dimensions of key bearing parts.

Different methods for processing the data are used to identify different types of
degradation. The result of this process is called a Health Index or Health Indicator
(HI). It is changes in these HI values over time that trigger corrective action.

Figure 18 illustrates the A13 accelerometer mounted on the tail rotor gearbox
for vibration monitoring.

There is also a biaxial accelerometer on the tail rotor gear box for the purpose
of monitoring the rotor track and balance. None of these were positioned to
monitor for problems in the duplex bearing as there was no requirement to do
so. The location of the accelerometer meant that vibrations generated by the
duplex bearing were obscured by the vibration of other components between
the bearing and accelerometer.

© Crown Copyright 2023 51 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 18
Simple schematic of the tail rotor gearbox showing the relative locations
(viewed from forward looking aft) of the vibration sensing accelerometer and
the failed critical duplex bearing. Not to scale.

Figure 19 provides an overview of how the Transmission Vibration Monitoring

(TVM) data passes through the helicopter systems. Vibration is sensed using
accelerometers in various locations around the transmission system. Vibration
data is gathered and partially processed by the two Vibration Data Acquisition
Module (VDAM) boards in the AMMCs.

The AMMCs store some of the results in their Non-Volatile Memory (NVM) but
other results and the raw vibration data itself are stored in the Data Transfer
Device. Some of the transfer of data from the AMMC to the DTD is automatic
and some requires manual action.

The AMMCs store some of the results in their Non-Volatile Memory (NVM) but
other results and the raw vibration data itself are stored in the Data Transfer
Device. Some of the transfer of data from the AMMC to the DTD is automatic
and some requires manual action.

A continuous recording of a number of flight parameters, referred to as ‘ESUM’

data, is also recorded in the61
DTD.

The transfer of data from the DTD to the Heliwise system is not an automatic
process and must be manually initiated.

© Crown Copyright 2023 52 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 19
Transmission vibration monitoring data flow
(original image courtesy of the manufacturer)

1.6.14 Air-Data Attitude Heading Reference System (ADAHRS) – data bus limits

The two ADAHR Units (ADAHRUs) use various internal and external sensors to
generate location, motion and orientation data for the cockpit instruments and
the AFCS. The data is communicated over data buses. The format of the data
buses is such that yaw rates above 128°/s cannot be represented so, if a higher
yaw rate is sensed, the ADAHRU flags the yaw rate data as invalid.

The ADAHRUs store fault data in NVM associated with internal ADAHRU
issues. They do not store faults relating to the ADAHRS function of providing
data to the aircraft systems. For example, if the yaw rate exceeds 128°/s the

© Crown Copyright 2023 53 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

ADAHRUs would not log a fault because they are capable of managing yaw
rates greater than 128°/s. The ADAHRUs would however flag the data as
invalid due to the limitations of other systems.

Crew alert messages relating to the attitude data use the abbreviation AHRS.

1.6.15 Flight Control Computer (FCC)

The FCC is the core of the AFCS. The FCC is located in the nose of the
helicopter. It contains processing boards which are functionally split into two
Information
Factual

channels, one for each autopilot. Each channel has two lane modules that
carry out the same autopilot functions but are of a different design to each other
to add robust redundancy and independence.

Each lane module stores data relating to the health of the module hardware
and equipment software. It does not store health data relating to the autopilot
software it is running or other hardware within the AFCS. An example of this is
how the system handles invalid yaw rate information from the ADAHRS. The
AFCS software generates a caution to the crew which is logged in the AMMC
NVM and recorded by the Data Acquisition Flight Recorder (DAFR). However,
it would not be logged into the FCC NVM because it only records faults with its
own internal systems and these would be operating normally.

1.6.16 Crew alerting system

Warnings and cautions trigger visual indicators above each pilot’s Primary
Flight Display (PFD). They also add to the list of alerts on the PFDs in a
prioritised order. Some alerts also have an audible sound and/or message.
The triggering of all the alerts are recorded in the AMMC NVM, and many are
recorded by the DAFR.

1.7 Meteorological information

The accident occurred at night. At the time of the accident the weather was
clear with a surface wind of 10 to 12 kt from a north to north-westerly direction
in the vicinity of the King Power Stadium. There was no significant cloud below
2,500 ft.

1.8 Aids to navigation

No relevant information.

1.9 Communications

No relevant information.

© Crown Copyright 2023 54 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.10 Aerodrome information

1.10.1 Aerodrome

No relevant aerodrome information.

1.10.2 LCFC training ground

The LCFC training ground, located 1 mile south of the King Power Stadium, is
owned by the club and was regularly used as a landing site for G-VSKP. It is a

Information
secure access-controlled facility with motion-activated CCTV coverage.

Factual
1.10.3 King Power Stadium

The King Power football stadium is of an enclosed design with covered seating
and an open roof. It is situated in the south of Leicester.

Helicopter flights into the stadium began after the owner of G-VSKP bought
the football club. The operation originally used an AW109 before switching to
G-VSKP in 2016. Flights in and out of the stadium were coordinated through
the LCFC match-day control room.

LCFC had developed their own risk assessment for the helicopter operation
which considered ground-based risks to the aircraft as well as risks posed to
personnel on the ground.

1.11 Recorded information

The helicopter was fitted with a flight recorder and other avionics equipment
that stored data in Non-Volatile Memory (NVM). External sources of recorded
information considered by the investigation included radar recordings,
Air Traffic Control (ATC) Radio Transmission (RT) recordings and image
recordings. The imagery came from CCTV cameras, witness mobile phones,
body worn cameras, car mounted cameras and a camcorder. Historical data
from the helicopter previously uploaded to the helicopter manufacturer’s
Heliwise system was also reviewed.

The following sections describe the information recovered from the above
sources where pertinent, followed by an amalgamated description of the
accident flight and a review of the available HUMS data.

© Crown Copyright 2023 55 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.11.1 Flight recorder

The helicopter was fitted with a Data Acquisition Flight Recorder (DAFR).
This had suffered heat damage, but the memory module was intact and was
successfully downloaded at the AAIB. This recorded two hours of audio and
25 hours of data. The recordings continued for a period after impact, powered
by its Recorder Independent Power Supply (RIPS).

The audio recording captured most of the flight from Fairoaks to London Heliport
on the day of the accident. It recorded the subsequent flights to the training
Information
Factual

ground, the stadium and finally the accident flight. Four channels of audio were
recorded, one from each of the two cockpit headsets, one from the Cockpit
Area Microphone (CAM) and one from the cabin intercom system.

The CAM channel suffered from periodic brief dropouts throughout most of the
recording with a significant amount of disruption during the accident sequence.
This is discussed further in the ‘Cockpit Area Microphone channel audio quality’
section of Appendix D.

Spectrum analysis of the CAM did not find any anomalies across the broad
spectrum generally or specifically in the tail rotor signatures before the departure
from controlled flight. Tail rotor signatures did not show anomalies after the
departure from controlled flight; though the analysis was compromised in this
period due to the quality issues discussed above and in Appendix D.

Spectrum analysis enables identification of rotating parts that create vibrations

with sufficient energy to affect the audio recorded by the area microphone in
the cockpit. Gear meshing and fan blade motion transfer large amounts of
energy and create larger vibrations than smaller, less energetic sources such
as bearings. Fluctuations in the spectrum at the frequencies associated with
the tail rotor duplex bearing were observed with extreme spectrum analysis
configurations but they were not distinguishable from other seemingly random
fluctuations at other frequencies. The CAM and recording system are not
designed for the purpose of tracking the conditions of bearings in the tail rotor;
finely tuned monitoring of an accelerometer in the tail section is required for that.

The recorded data captured the accident flight and the previous 34 flights dating
back to 1 September 2018.

The main source of data recorded by the DAFR in this installation design were
the two AMMCs. As well as the aircraft parameters, each provided time data
from their own internal clocks. Due to issues with the sampling method for the
data, the AMMC2 timeline included repeated timestamps. The time recordings
from both AMMCs were not stable in the middle of the accident sequence,

© Crown Copyright 2023 56 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

starting at approximately 1937:52 hrs. For the purpose of the investigation, a

stable timeline was extrapolated from the stable AMMC1 timestamps for the
initial climb out of the stadium, based on the assumption that the recording rate
remained consistent.

The yaw rate parameter saturated at the 128°/s limit of the databus carrying
the data. This not only affected the recorded yaw rate parameter but also
generated a failure in the ADHRS system. Recorded magnetic heading data
was used to derive the yaw rate past this limit. However, the time between the
heading samples is subject to jitter (Section 1.18.12.1) so some smoothing of

Information
Factual
the parameter was carried out to show the general trend.

As the yaw rate increased, the longitudinal acceleration parameter reached

and remained above its 1 g limit because the accelerometer was located some
distance from the centre of rotation and so was subjected to a large centrifugal
acceleration.

The GPS position parameters had become highly inaccurate by the end of the
accident sequence so there was no accurate source of flightpath data.

1.11.2 Avionics

A number of avionics units were identified as potentially containing useful

recordings in NVM. These suffered various degrees of heat damage.

The DTD would have contained raw vibration sensor data from the accident
flight and more comprehensive data from previous flights not yet downloaded
from the helicopter. However, it suffered unrecoverable damage to the memory
chips of the solid-state hard drive.

Data was recovered from the two AMMCs, the FCC and the two ADAHRUs by
chip removal and download at the AAIB.

Further decoding of the downloaded data was carried out by the manufacturers
and further detail about how the units store data was provided to the AAIB to
corroborate the processes.

The two AMMCs recorded HUMS related information, the results of the onboard
vibration analysis activities and logs of different aspects of the operation
including faults, exceedances and crew alerts. The FCC and ADHRS record
less useful information but were downloaded due to the faults flagged with
these systems during the accident sequence.

Some of these logged events could be correlated to the timeline by the GPS
timestamps recorded. However, the source of GPS time data became unreliable

© Crown Copyright 2023 57 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

during the accident sequence. This was corrected for using the DAFR recording
of the GPS time. Some of the times recorded in the avionics were elapsed
times since power was applied to the unit. The helicopter systems are not
designed to enable the DAFR to capture the time when power is applied to the
downloaded units, but analysis of previous flights along with power-up timing
information from the manufacturers of the various units enabled correlation of
the recorded elapsed times with the accident timeline.

AMMCs
Information
Factual

Three files were recovered from the data from each of the two AMMCs, relating
to logged issues/events, transmission vibration results and helicopter usage.

The first of these contained logged faults, exceedances, alarms and events
against timestamps. The data recovered from the accident AMMCs contained
many logged entries associated with the accident as well as many nuisance
log entries. Nuisance records are those that reflect an expected system status
at the time of logging rather than a problem. An example of this would be
logging a system as failed when it has not yet had time to boot-up during flight
preparations.

The AMMC software is continually being developed. Nuisance logs are

designed out of the system at each successive software revision.

The AMMCs fitted to G-VSKP were operating on Phase 3 software. Downloads

from other helicopters with the same software revisions were reviewed and all
faults considered by the manufacturer as nuisance were found in some if not
all other recordings.

The AMMC logged data corroborated the DAFR recordings in terms of crew
alerts and flagged issues during the accident sequence.

The information in the recovered files relating to usage and vibration were also
analysed and are discussed in section 1.11.7.

Flight Control Computer (FCC)

The FCC NVM was investigated to establish the health of at least part of the
flight control system. The fault logs were downloaded. They contained a mixture
of nuisance faults associated with many flights and genuine faults associated
with the accident flight. Considering power-up times and aligning the logs to
each other and to the DAFR recording, the genuine faults occurred at or after
the initial impact. No faults were associated with the helicopter whilst in flight.
Air-Data Attitude Heading Reference System (ADAHRS).

© Crown Copyright 2023 58 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The AMMC and DAFR recorded in-flight issues associated with the two
ADAHRS, so data was recovered from the two ADAHRUs.

The units were installed in the nose electronics bay, however this had suffered
significant heat damage such that the components were no longer in a
structure. The ADAHRUs were recovered from locations that indicated which
was ADAHRU1 and which was ADAHRU2.

The NVM of both ADAHRUs contained faults relating to the accident flight. The

Information
ADAHRU timings indicate that the first faults in each occurred approximately

Factual
one second apart, ADAHRU2 followed by ADAHRU1. The uncertainty in timing
indicates that the ADAHRU2 failure could have been triggered at any time in
the two seconds leading up to and including the impact.

The DAFR recorded a failure from ADHARS1 approximately two seconds

before impact and from ADAHRS2 slightly after impact.

The NVM and DAFR timings appear to contradict each other, however, the
NVM is linked to internal errors, and the DAFR recording is triggered by the
application software interacting with the aircraft systems. It is therefore possible
that the DAFR recorded issues were not linked to the ADAHRU NVM data.
It is also possible the position they were found in at the accident site was not
indicative of where they were fitted.

1.11.3 Witness videos and imagery

The stadium CCTV camera system captured the aircraft’s arrival, most of the
time the helicopter was on the ground in the stadium, and the departure of
the accident flight whilst within the confines of the stadium but not above the
stadium roof height. The recording was not continuous but triggered by motion
within the camera’s field of view.

Other sources of CCTV captured the helicopter after the helicopter cleared
the stadium roof but from a distance. Videos recorded on mobile phones from
the side of the pitch captured the takeoff, the start of the accident sequence
and the descent until the helicopter disappeared behind the stadium roof line.
These images corroborated recorded data and provided visual evidence of
the flightpath of the helicopter in a period when the recorded flightpath lost
accuracy.

The witness videos also showed particles such as grass swirling in the air
in the turbulent helicopter downwash. These are more prominent when the
camera view does not include the stadium lights. Such particles closer to the
camera appear larger, more prominent and move faster in the image frame

© Crown Copyright 2023 59 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

than items further away. There was some speculation regarding the possible
interaction between an object and the helicopter captured by one of the
witness videos. This object interaction was not apparent on any of the other
witness videos taken from the same general pitch-side location at the same
time. This object was indistinguishable from the many other particles visible
in the videos, in terms of its colour, shape (sometimes a dot, sometimes more
grass like) and erratic motion. The object was most likely a piece of grass, or
similar small debris, much closer to the camera than the helicopter, moving
in the turbulent air.
Information
Factual

Videos recorded on police cameras and by the fire service were also reviewed.
The police cameras had times embedded in the video. Aligning the video
content showed that the different sources of time agreed. Assuming the time
sources were correct, the blue lights of the first police car to arrive on scene
were switched on within four seconds of the impact time. Within a minute, the
accident site came into view of the police car camera. A significant fire had
already taken hold.

1.11.4 Personal electronic devices

Mobile phones, tablets and a laptop were recovered from the accident site, with
varying degrees of damage. Data was recovered from the laptop, informing the
operational aspects of the investigation. Other items were not functional or not
related to the operation of the helicopter.

1.11.5 Radar and air traffic control radio transmissions

Radar and Air Traffic Control Radio Transmissions recordings were gathered
relating to the flights of the day. They corroborated the DAFR recordings.

1.11.6 Accident flight

The majority of the data in this section is from the DAFR recording. Other
recordings corroborated or expanded on this.

Takeoff and climb

The helicopter lifted to a low hover at 1937 hrs, manoeuvred forward, stopped
and then lifted vertically out of the stadium whilst also moving slowly backwards.
The helicopter climbed at an increasing rate, reaching 500 ft/min passing a radio
altimeter height of 50 ft. The climb rate peaked at approximately 730 ft/min passing
a radio altimeter height of 225 ft. After this it reduced to approximately 650 ft/min.

Figure 20 shows the accident flight from climbing through a height of

approximately 150 ft to just after impact. The pressure altitude is approximately

© Crown Copyright 2023 60 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

the same as the radio altimeter height during the initial climb. As the helicopter
climbed out of the stadium the radio altimeter tracked stronger signal returns
from the stadium roof and possibly some of the seating, rather than the ground,
indicated by the deviation from the general pressure altitude trends.

Information
Factual

Figure 20
Pertinent extracts from the flight recorder

© Crown Copyright 2023 61 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Passing approximately 300 ft, a heading change to the right was initiated and
stopped followed by another heading change in the same direction (note 1 in
Figure 20) which carried on accelerating despite opposite pedal being applied
(note 2 in Figure 20).

The recorded GPS position was highly inaccurate by the end of the flight.
Analysis of the recorded imagery shows that at the onset of the loss of yaw
control, the recorded GPS position was relatively accurate and the helicopter
was above or close to being above the stadium roof as shown in Figure 21.
Information

The difference between the recorded radio height and barometric altitude also
Factual

indicated that there was a structure underneath the helicopter when yaw control
was lost.

After the yaw rate reached 128°/s (note 3 in Figure 20), the recorded yaw
rate became invalid. ap ahrs 1 fail, ap ahrs 2 fail (note 4 in Figure 20) and
1-2 ap off (note 5 in Figure 20) cautions were recorded.

The yaw rate derived from the magnetic heading showed that it carried on
increasing. The helicopter was not level and as the yaw rate increased, the
pitch and roll deviations increased. The recorder sample rate was not sufficient
to capture the peaks of motion in pitch and roll but the data shows a change
in pitch of more than 43° and a change in roll of more than 25° both in half a
second. The smoothed derived yaw rate peaked at 209°/s.

There was a small movement in the collective at the same time as the yaw rate
became invalid, followed by a very slight increase. At this point the yaw rate was
in excess of 160°/s and the rotor speed decayed to a recorded value of 99.75%
after previously having been holding at approximately 103% (this equates to
348 rpm or nearly 2,100˚/s). A rotor low warning was triggered (notes 6a
and 6b of Figure 20). The collective was partially lowered for approximately one
second and then fully lowered (note 7 of Figure 20). The rotor speed recovered.

Low main gearbox oil pressure alerts were triggered at approximately the same
time as the low rotor rpm warning. These were followed by engine oil pressure
warnings. Each engine has its own self-contained oil system, not connected to
the helicopter gearbox oil system.

The radio altimeter height had peaked at about 430 ft agl. The yaw rate started
to reduce and plateaued at about 150°/s (note 8 of Figure 20).

The helicopter did not pick up sufficient forward speed to create valid airspeed
information.

© Crown Copyright 2023 62 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 21
Location at the point that yaw control was lost.
The original video and CCTV images are shown cropped
Map data © 2021 Google

Descent

After the collective was lowered the helicopter started to descend. The descent
rate increased and stabilised at approximately -4,000 ft/min until the collective
was pulled up prior to impact (notes 9 and 10 of Figure 20). There was then an
associated drop in rotor speed and engine output speed with increased engine
torques.

© Crown Copyright 2023 63 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The last attitude data recorded before impact, averaged across the two sources,
indicated that the helicopter was pitched 2° nose up with a left roll of 18°, with
a heading of approximately 155°M.

These values were rapidly changing until that point, pitching up and rolling left
whilst continuing to yaw right. The sample rates of the attitude parameters are
insufficient to accurately represent the dynamic impact sequence.

The final descent rate significantly affects the impact forces. Vertical speed
Information

parameters were recorded, and the descent rate can be derived from the radio
Factual

altimeter data but these sources have issues in this instance.

The vertical speed parameters from the AMMCs were showing a reducing
trend prior to impact but they disagreed by as much as 400 ft/min during the
descent. The last recorded vertical speed from AMMC1 and AMMC2 was
-2,517 ft/min and -2,855 ft/min respectively. The vertical speed parameter is
derived by the onboard systems from sources including the static pressure.
These differences were possibly due to the high yaw rate of the aircraft affecting
the static pressure measurements.

Vertical speed can be derived from the radio altimeter data. The last two radio
altimeter heights recorded by the AMMCs for radio altimeter 1 before impact
were 35.625 ft and 17.750 ft. The recording system is designed such that the
latest values from the AMMCs are recorded every 500 ms. However, these
latest values are updated by the AMMCs every 320 ms. With this difference
in the time between updates and recording values, it is possible that there was
either one or two AMMC updates between two successive recorded values.
The last two recorded radio altimeter heights were either 320 ms or 640 ms
apart. This means that the descent rate between the last two radio altitudes was
either 3,352 ft/min or 1,676 ft/min. The values from radio altimeter 2 generate
equivalent descent rate values of 2,461 ft/min and 1,231 ft/min respectively.
Errors associated with radio altimeter readings in this location under these
conditions are also likely to result in large errors in the point-to-point derivation
of altitude rate from samples less than a second apart.

Impact

The recorded accelerometer data did not provide a clear spike associated with
the impact.

However, loss of AMMC1 data is likely associated with the impact sequence,
which occurred at approximately 1937:59 hrs (note 11, Figure 20).

© Crown Copyright 2023 64 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Post-impact

The recorder has its own independent 10-minute power supply. The recorder
carried on operating after impact, as did AMMC2 but AMMC1 stopped on
impact. The integrity of AMMC 2 and the systems supplying it with data, as well
as that of the audio related parts of the system is not known. The ensuing fire
progressively degraded these further. Therefore, the validity of the recorded
content post-impact is not robust.

The audio recording stopped 5 minutes and 28 seconds after impact. No sound

Information
Factual
attributable to an occupant was recorded post-impact. Less than a second after
initial impact, mechanical sounds likely relating to the rotors striking the ground
were briefly recorded. The pilot channels carried on recording automated
warnings for 1 minute and 19 seconds. These are directly injected into the
audio system rather than being sound sensed by a microphone.

The DAFR did not receive data from AMMC1 for approximately 60 seconds
after impact. All parameters from both AMMCs stopped updating approximately
78 seconds after impact. The DAFR stopped recording at 1943:01 hrs, just
over 5 minutes after impact.

After ground contact the helicopter rolled left (note 12, Figure 20) and pitched
up, with a peak left roll of 110° and a nose-up attitude of 13° recorded two
seconds after impact. It then rolled back to 83° of left roll and pitched to
6° nose-down in a similar time frame.

The quick roll over correlated with a recorded audio associated with the rotors
striking the ground. The small reversion of pitch and roll ceased approximately
as the sounds of the rotor strikes ceased. A sharp drop in rotor speed and
increases in engine torque values were also recorded during this period
(note 13, Figure 20).

Further gradual changes in the attitude of the helicopter were recorded until the
recording stopped but the helicopter remained on its left side.

The cockpit, cabin and baggage compartment doors were recorded as open at
the point of initial impact.

The engine Ng47 values dropped to approximately 50% until about 35 seconds
after impact when the Ng values for Engine 2 dropped off, as did the Engine 1
values 30 seconds after that.

47 Engine rotational speed gas generator stage.

© Crown Copyright 2023 65 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The data indicated the presence of smoke in the baggage bay 13 seconds
after impact. This was initially intermittent but overall lasted for one minute
before indicating normal conditions for the last five seconds before the AMMC2
parameters froze. An Engine 1 (left engine) fire was indicated approximately
58 seconds after impact. Both of the fire indication parameters had an initial
intermittent period. The only other fire detection parameter, associated with
Engine 2 (right engine), did not trigger. Engine fire detection is designed
to trigger when the temperature in an area of the engine compartment that
normally does not get excessively hot exceeds 450˚C. The integrity of these
Information

systems at that time is not known.

Factual

Forces imparted on the pilot in the descent

The yaw rate of the helicopter imparted longitudinal forces on the occupants.
These forces increase with increasing yaw rate and distance of the occupant from
the centre of rotation of the helicopter. Simplistic calculations of the longitudinal
acceleration at the pilot location due to the yaw rate show a rapidly increasing
force pushing the pilot forward in his seat. This peaked at just above 3 g.

1.11.7 Previous flights

The DAFR recording of the previous flights were reviewed to establish the
range of yaw rates experienced during normal flight operations. The recorded
yaw rates during the flights prior to the day of the accident ranged from -38.5°/s
to 32.9°/s. This provides some context for comparison to the extreme yaw
rates that occurred during the accident flight and to the 128°/s ADHARS data
bus limit.

The previous flights were also reviewed to establish how the AVSR affected the
tail rotor speed.

The AVSR mode parameter confirmed that as expected, PLUS mode was in
operation for all the flights. Figure 22 shows the relationship between the tail
rotor rpm and CAS during these flights. AVSR uses TAS rather than CAS to
drive system behaviour but the focus here is on the resultant spread of tail
rotor speeds and so the difference between CAS and TAS is not relevant.
The observed relationship matches the expected PLUS mode behaviour for
the majority of the flights. Deviations from this are associated with training
flight activity using the one-engine-inoperative training mode or the approach
to landing captured right at the start of the recording, though some transient
reversions to BACKUP mode may also have occurred.

© Crown Copyright 2023 66 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 22
Comparison of Tail Rotor rpm with Computed Airspeed when the
weight‑on‑wheels sensor was not active, for all flights captured
by the flight recorder

Figure 23 is a histogram of the same tail rotor rpm data. This shows that nearly
75% of the flying was with rotor speeds above 100% NR. 37% of the flying was
at 103% NR.

Figure 23
Histogram of the Tail Rotor rpm when the weight-on-wheels sensor
was not active, for all flights captured by the flight recorder

The previous flights were also compared to helicopter limitations

(section 1.11.9).

© Crown Copyright 2023 67 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.11.8 HUMS

The Heliwise standard service contract for this helicopter required the customer
to review the Heliwise data with the manufacturer available to answer any
queries. The manufacturer stated that no query had been raised against this
aircraft.
Information
Factual

Figure 24
Example TGB Accelerometer A13 derived HI trends.
The red box highlights the results from the accident flight

© Crown Copyright 2023 68 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The last data that was transferred to the Heliwise system was for the period
of 11 September 2018 to 28 September 2018 and tagged as DSN 173. The
laptops used for maintenance were searched for possible data from after that
period, but none was found. The AMMC recovered files contained some of the
relevant data relating to the most recent activity, including the accident flight. It
is likely that the bulk of the data from the period between 28 September 2018
and the accident was contained in the DTD, which was unrecoverable.

The manufacturer was asked to review the available historical HUMS data
along with the recovered AMMC data.

Information
Factual
Vibration

The AMMCs recorded data acquisitions targeting the Tail rotor GearBox (TGB)
components during the day of the accident, including two just prior to lift-off of
the accident flight.

The important factor is not the absolute value of these but how they change over
time. Examples of this, using different HIs acquired using the TGB A13 sensor
are shown in Figure 24.

The analysis performed on the TGB acquisition results did not highlight
behaviour outside of the fleet average. More generally, the manufacturer
stated that there were no significant TVM arisings that indicated problems that
needed addressing.

Rotor Track and Balance analysis

No anomalies were highlighted in any of the data relating to the rotor track and
balance.

Failure monitoring

Outstanding arisings were already open on the system. The manufacturer

assessed them as being triggered by obsolete triggers. They stated that
flagged issues were negligible and would have rejected them with no further
action required had they been consulted at the time.

Overall assessment of historical HUMS data for this helicopter

Outstanding issues had been flagged by Heliwise but were not showing as
being progressed. The manufacturer assessed these arisings as not genuine
issues. They were triggered before Heliwise had refined the trigger thresholds.
The last upload, DSN 173, had not triggered any new arisings.

© Crown Copyright 2023 69 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The manufacturer concluded that the historical and AMMC data would not have
flagged a need for any additional maintenance.

ESUM data

Archived ESUM data was also compared to helicopter limitations

(section 1.11.9).

1.11.9 Comparison of recorded data with published limitations

Information
Factual

Helicopter operational limitations for the helicopter, such as maximum

airspeeds, are documented in Rotorcraft Flight Manual (RFM) Document
No 169F0290X001 and Supplement 30.

The flights recorded in the flight data recorder and ESUM recordings,
recovered from the manufacturer’s Heliwise archive, enabled comparisons of
flight activities with some of the RFM limitations. The two sources recorded
different parameters at different rates. These differences meant that they
could not assess an identical subset of limitations, but both enabled some
level of assessment.

The datasets did not always allow simple comparisons of recorded parameters
with stated limitations. Layers of derivation were sometimes required, and some
of the recorded parameters on which these were based, such as windspeed,
were not robust under all conditions (such as lower speed flight). To aid in the
understanding of whether some of the exceedance activity was associated with
actual flight or issues with the data, it was useful to compare activity before and
after the Certificate of Airworthiness and Certificate of Registration were issued.

With a few exceptions, discussed below, the recorded flights were within the
limitations checked.

The flight recorder data covered 34 flights involving approximately 12 hours

of in-air activity. This was from the 1 September 2018 to the accident flight.
A review of the data found a single exceedance, an instance of a gear operation
speed being exceeded by approximately 4 kt (5%).

The ESUM data spanned the period between 1 December 2015 and
25 April 2018, just under 216 hours of which was in-flight. Some of this was
from before G-VSKP had been issued with its Certificate of Registration and
Certificate of Airworthiness.

The airspeed limitations are quoted as Indicated Air Speed (IAS) limitations but
True Air Speed (TAS) is recorded in the ESUM dataset. Equivalent Air Speed

© Crown Copyright 2023 70 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

(EAS) was derived from the ESUM data and used as a close approximately to
IAS for the purpose of the assessment. This was valid for the limited range of
altitudes and temperatures encompassed by the dataset.

The ESUM data showed 12 events above 100 % TQ (when above 90 KEAS) for
more than 10 seconds. Seven of these events occurred before the Certificate
of Airworthiness was issued and five after. The maximum transient torque limit
is 125% for a maximum duration of 10 seconds.

The maximum torque recorded was 109%, lower than the 125% TQ transient

Information
Factual
limit but for a longer duration. The RFM does not provide any intermediate
limitations between the transient limit (125% torque for 10 seconds) and the
maximum continuous limit (100% torque) above 90 KIAS. The AW169 Type
Certificate Data Sheet48 states a transmission limitation of 111% for 5 minutes
with both engines operating regardless of air speed. The Approved Maintenance
Manual for the AW169 has no unscheduled maintenance requirements for
torque excursions below 111% of any duration.

The assessment of the maximum allowable windspeed/groundspeed/airspeed

azimuth envelope requires layers of calculations based on recorded parameters
that themselves are not robust during periods of interest (eg recorded wind
data with little or no forward airspeed being sensed). The derived data crosses
limitation boundaries during dynamic flight. The majority, but not all, of these
occurrences were recorded after the issue of the Certificate of Airworthiness.

Assuming that autorotation is associated with flight with less than 10% total
TQ, exceedances of the minimum airspeed for autorotation occurred for a few
seconds on five occasions.

Two of the rotor speed data points recorded in flight fell below the minimum
transient rotor speed limitation of 90%. One occurred in the climb and one in
the flare on landing. These were marginal exceedances for very brief moments.

1.12 Wreckage and impact information

1.12.1 Initial site inspection

The main helicopter wreckage was located within an enclosed secure

compound to the southeast of the football stadium. On match days the two
gates of the compound were opened to allow foot access between the rough
ground to the east, which was used as a temporary staff car park, and the
stadium. The site consisted of a concrete surface on two levels with a 0.5 m
step between them, formed by a small brick wall.
48 https://www.easa.europa.eu/sites/default/files/dfu/AW169-TCDS%20R-509%20Issue1.pdf (Accessed
3 July 2023).

© Crown Copyright 2023 71 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The helicopter’s initial impact with the ground was diagonally across the step
with the nose of the helicopter pointing on a heading of approximately 155°49,
although it was still rotating at high speed as it struck the ground. There was
significant structural damage to the fuselage in the region where the fuel tanks
were located.50

After the rotation in yaw stopped, the helicopter rolled onto its left side and
came to rest in this attitude on a heading of approximately 050°. Sections
of the main rotor blades detached from the helicopter as they contacted the
Information

ground and were found over a wide area of the temporary staff car park and
Factual

surrounding treeline. Witnesses reported that fuel was seen to leak from the
helicopter along the ground before it ignited, resulting in an intense fire which
rapidly engulfed the whole helicopter. This resulted in significant fire damage to
the fuselage structure, with the front section almost entirely consumed.

An initial inspection of the site was conducted by the AAIB during the night
of the accident. Action to recover the victims was then initiated the following
morning. Work to recover the wreckage to the AAIB HQ at Farnborough was
eventually completed five days after the accident took place.

Tail wreckage

Initial evidence obtained from video footage of the accident, focussed attention
on the tail rotor of the helicopter. The tail section of the helicopter where the
tail rotor was located was less damaged by the fire than other sections of the
helicopter. Onsite inspection of the tail rotor control mechanism identified that
the servo actuator lever mechanism was no longer attached to the TRA control
shaft. The castellated nut and pin carrier were found bonded to each other but
detached from both the lever mechanism and the control shaft and lying in the
remains of the vertical tail carbon fibre skin panel (Figure 25).

A more detailed inspection of the tail rotor control system was conducted with
the manufacturer in attendance once the wreckage had been recovered. The
locking nut and pin carrier, tail rotor actuator control shaft, and spider/slider/
bearing assembly were removed from the tail wreckage and sent for further
forensic laboratory analysis by specialists at nC2 Engineering Consultancy
within the University of Southampton. During disassembly, the locking nut on
the bearing end of the control shaft was found to have a torque load significantly
higher than the required assembly value.

49 Based on recorded data.

50 See ‘survival aspects’, section 1.15.3 for a more detailed description.

© Crown Copyright 2023 72 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 25
Disconnected lever mechanism, TRA control shaft and detached
but fused nut and pin carrier

1.12.2 Results of the initial forensic laboratory investigation

Locking nut and pin carrier

Inspection of the thread on the nut confirmed it was undamaged.

Use of a stereo microscope to view the component, identified wear debris

between the nut and the pin carrier and deformation of the nut consistent with
softening of the material. The inspection also confirmed the presence of an
impression mark on the edge of one of the castellations on the nut, consistent
with the size and shape of a split pin. The pin carrier and nut were then
scanned using an X-ray Computed Tomography (CT) Scanner based at the
facilities of µ-VIS X-ray Imaging Centre at the University of Southampton. This
passes X-rays through components from different angles to produce multiple
cross-sectional images, which are then combined as a 3-D model. The model
allowed the interface between the two components to be ‘virtually sectioned’.
This confirmed areas of fusion and evidence of rotation (Figure 26).

© Crown Copyright 2023 73 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 26
Virtual cut through join between the nut and pin carrier

Tail rotor actuator control shaft

Initial inspection showed no evidence of the split pin which should have retained
the locking nut and pin carrier to the threaded section of the control shaft at the
actuator end. The threaded section itself had been drawn inside the outer shaft
during the extraction process and was no longer visible.

The shaft was imaged using the CT scanner, which confirmed the threaded
portion of the control shaft was inside the outer shaft and contained the remains
of the split pin. The top and bottom of the split pin had been sheared off in
rotation (Figures 27 and 28).

At the other end of the control shaft, the section adjacent to the duplex bearing
face showed evidence of burnt-on grease and was discoloured along its length
(Figure 29).

© Crown Copyright 2023 74 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 27
CT scan of threaded section of control shaft and split pin

Figure 28
CT scan through tail rotor actuator control shaft
(viewed from bearing end)

© Crown Copyright 2023 75 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Figure 29
Information

Duplex bearing location on tail rotor actuator control shaft

Factual

after removal of the bearing

Spider/slider/bearing assembly

Following removal from the control shaft, the inner races of the bearing could
only be rotated a few degrees in either direction by hand. There was also a
small build-up of black grease inside the slider unit around the inboard face of
the duplex bearing. The spider assembly was removed, and the slider/bearing
assembly was CT scanned51 (Figure 30).

Figure 30
CT scan of bearing/slider assembly

The scan of the bearing showed fractures to the bearing cages and significant
damage to the surface of the inner bearing races, the damage being worse
on the inboard inner bearing race (Figure 31) where there was evidence of
sub-surface damage.

51 The misalignment of the inboard inner race was an unavoidable consequence of the extraction process
from the wreckage.

© Crown Copyright 2023 76 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 31
CT imagery of duplex bearing inboard inner ring surface damage

The scan also showed evidence of debris accumulating in the bearing raceways
(Figure 32).

Figure 32
Scan images of duplex bearing showing debris accumulation

Duplex Bearing (s/n 14126)

The bearing was then removed from the sliding unit and disassembled,
revealing evidence of relative rotation between the sliding unit and the bearing

© Crown Copyright 2023 77 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

outer ring. The debris present on the CT scan was identified as a combination
of black dust and metallic particles. No grease, in its original form, remained in
the bearing but there was black dust in and around the bearing races and cage
(Figure 33). The seal on the inboard side of the bearing exhibited wear marks
on its inner surface from contact with the cage. Visual inspection of the surface
of the bearing races confirmed the extent of the damage seen in the CT scans.
The surface of each of the balls from both sides of the bearing was crazed and
exhibited areas of matt white surface finish, but none of the balls were spalled.
Information
Factual

Figure 33
(A) Inboard row, outer race (B) inboard row inner race and fractured cage
(C) inboard row inner race

1.12.3 Results of the in-depth forensic laboratory investigation

Non-destructive examination techniques

The duplex bearing was subjected to a sequence of detailed analysis techniques

to document its condition. Initially the surface of the inner and outer races was
scanned using a high resolution, non-contact, optical scanning technique to
record the topography of the running surfaces (Figure 34). This was combined
with higher resolution CT scans to identify the extent of the damage. The inner
races were examined further using a Scanning Electron Microscope (SEM). This
confirmed the presence of step-like features with striations, indicating that they
were formed by a cyclic failure mechanism consistent with rolling contact fatigue.

© Crown Copyright 2023 78 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 34
Optical measurement of the rolling surface of the inner race showing
heavy wear, with large pits (blue areas), but also areas raised higher than
the original surface (green/yellow)

The SEM scans confirmed several features on the inboard inner race surface
which showed consistent characteristics (Figure 35). The features:

● were orientated normal to the rolling direction;

● were edged by adhered debris;

● contained flattened debris within the feature;

● displayed large segments of material; and

● showed the presence of long shear cracks, normal to the

rolling direction and secondary cracking in the rolling direction.

Destructive examination techniques

In order to document the subsurface condition of the race material, sections

were cut out both radially and circumferentially. Of the two races the inboard
row showed the most extensive damage, and the inner race exhibited more
damage than the outer race.

The outboard row inner race was typified by repeating inclined cracks. The
cracks had a depth and angle typical of a rolling contact fatigue damage
mechanism and had initiated from the surface, with material released at the
initiation point of the cracks. (Figure 36).

© Crown Copyright 2023 79 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 35
SEM images showing the large pit with fatigue and secondary cracking

© Crown Copyright 2023 80 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 36
Optical microscopy views showing surface cracking on the circumferential
section of the inner race from the outboard row52

The sections were then polished and viewed under an optical microscope
(Figure 37). On the inboard inner race this revealed that the surface in the
centre of the race, down to a depth of approximately 0.5 mm, had a swirling,
layered structure with extensive cracks in many locations (Figure 38). The
surface of the polished sections were then etched using various reagents and
again viewed under an optical microscope.

The outboard inner race showed evidence of a heat affected zone and a Dark
Etched Region53 (DER) below the surface. A combination of the reagents used
and EDAX54 analysis confirmed that the various layers on the inboard inner
race were formed from different materials including carbon, steel and copper,
which had been deposited and compressed (Figure 39).

Below this layer of mixed material, was the original bearing steel material.
However, use of etchant on the section surface identified a heat affected zone
where the material microstructure had changed (Figure 40). Microhardness
profiling was conducted both radially and circumferentially. The results confirmed
that the steel had softened compared to a new bearing, but closest to the
surface the material had rehardened. This suggested that the temperature at

52 In all the images of bearing sections used in the report the ‘mottled’ black and grey section is a mounting
material used to hold the bearing section. The bearing section is seen as a mostly consistent block of
colour, in this example light grey.
53 For further explanation of DER see section 1.18.8.
54 EDAX is Energy-Dispersive Analysis of X-rays, using an additional sensor in scanning electron
microscopes to allow identification of component materials.

© Crown Copyright 2023 81 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

the surface of the race had reached austenitising55 temperatures of over 980°C,
reducing to temperatures of 600°C at the lowest level of the heat affected zone
which had only a tempering effect.
Information
Factual

Figure 37
Optical microscopy view of circumferential slice from inboard inner race of
bearing following polishing to show the layered surface

Figure 38
Figure 38
Magnified view of inboard inner race of bearing showing cracking of
Magnified view of inboard material. inner race of bearing
showing cracking of material

55 Changing the microstructure of the steel by heating it until it enters the austenite phase. Austenite is a
solid solution of carbon and other constituents in a particular form of iron known as γ (gamma) iron.

© Crown Copyright 2023 82 Section 1 - Factual information

Figure 39
Optical microscopy views of etched (Murakami’s reagent) radial slice
Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 39
Optical microscopy views of etched (Murakami’s reagent) radial slice from
inboard, inner race showing mix of materials in the layer

Figure 40
High magnification light microscopy views of etched (Vilella’s reagent)
radial slice of inboard inner race (left) and circumferential slice of
outboard inner race (right), showing heat affected zones, DER and
microhardness testing points

Cage damage and wear

The inboard cage had fractured across the top and bottom of two pockets,
resulting in the cage breaking into two pieces. The outboard cage had three
fractures, but remained in one piece. The inspection of the cages using CT
scanning, SEM and optical imaging showed distinctive wear patterns. These
included wear within the individual cage pockets on both inboard and outboard

© Crown Copyright 2023 83 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

cages (Figure 41 and 42), but also a wear lip on the inner running surface of the
wide end of the cages (Figure 43). On the inboard cage there was also a wear
scar on the outside of the narrow end of the cage (Figure 44).
Information
Factual

Figure 41
CT scan cross section of pocket on inboard cage showing wear on the top
and bottom surfaces

© Crown Copyright 2023 84 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 42
Material removal and displacement relative to a new cage (shown in green)
on the cage section between ball pockets

Figure 43
Optical and SEM images of wear on the inside of the wide end of the
outboard cage

© Crown Copyright 2023 85 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 44
CT scan images showing wear on outside of the narrow end of
the inboard side

1.12.4 Post-accident continued airworthiness response

As the same part number duplex bearing and tail rotor control system were
fitted to the AW189, soon after the accident the helicopter manufacturer
introduced a number of emergency inspection measures on both the AW169
and AW189. These were introduced by Alert Service Bulletins (ASB) which
were subsequently mandated by the EASA in a combination of emergency and
standard Airworthiness Directives (AD).

The first of these was Emergency AD 2018-0241-E, issued on 7 November 2018

and referenced ASB 169-120 and 189-213, which were issued on 5 and
6 November 2018 respectively. It mandated a one-time visual inspection of
the servo-actuator installation. The AD was then superseded by emergency

© Crown Copyright 2023 86 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

AD 2018-0250-E on 19 November 2018. In addition to the requirements of the

first AD, a precautionary one-off inspection of the duplex bearing was added.
This resulted in an initial number of bearings being rejected from helicopters in
service, some of which were sent to the AAIB for further investigation.

The helicopter manufacturer then published ASB 169-125 and ASB 189-214 on
21 November 2018. Consequently, EASA issued Emergency AD 2018-0252-E
to mandate them. This introduced a one-time inspection and breakaway torque
check of the duplex bearing and inspection and reinstallation of the servo-actuator
castellated locking nut.

Information
Factual
The manufacturer and airworthiness authority then determined that repetitive
inspections of the duplex bearing were necessary for continued monitoring of the
fleet. The helicopter manufacturer published ASB 169-126 and ASB 189-217
accordingly, and EASA issued Emergency AD 2018-0261-E in November 2018
to mandate these inspections. A steady number of bearings were removed from
service and were sent to the bearing manufacturer. Some were selected for
further investigation, using a standardised process agreed with the AAIB.

In the period following the introduction of these inspections, tail rotor system rig
tests were being conducted by the helicopter manufacturer (see section 1.16.1).
The test results showed that as the duplex bearing degraded, its operating
temperature increased consistently. A modification was therefore developed to
install and repetitively inspect a thermal strip, as an additional warning indicator
of the condition of the duplex bearing. This was introduced by the helicopter
manufacturer in ASB 169-135 and ASB 189-224 and mandated by EASA
through the issue of AD 2019-0023 on 1 February 2019.

Operator feedback from the repetitive tail rotor inspections allowed improved
techniques to be developed and the helicopter manufacturer published
ASB 169-148 and 189-237, to provide instructions for more in-depth inspections
of the duplex bearing. EASA issued AD 2019-0121 on 3 June 201956 to require
accomplishment of these actions.

After AD 2019-0121(R1) was issued, the helicopter manufacturer introduced into

service a modification to the Vibration Health Monitoring (VHM) system fitted to
the AW169 and AW189. The modification relocated an existing accelerometer
sensor on the tail to the servoactuator control lever, to allow monitoring of the
vibration signature of the duplex bearing and provide an optional aid for the
continued airworthiness of the fleet.

Whilst the modification itself was not mandated, the reporting of data from
helicopters with the modification installed, was mandated. This requirement

56 This was reissued later in June 2019 as R1 to correct inconsistencies between the AD and the ASB.

© Crown Copyright 2023 87 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

was included in a new AD 2019-0193 issued 7 August 2019, which also

included revisions to the other inspection requirements and superseded
AD 2019-0121(R1).

In early 2020, the helicopter manufacturer issued modification Service

Bulletins 169-153 and 189-249. These introduced a new standard of tail rotor
actuator. The control shaft now has a left-hand thread on the castellated
lock nut and an additional washer fitted to the actuator end of the shaft. The
EASA then issued Airworthiness Directive 2020-0048 on 6 March 2020, which
Information

superseded AD 2019-0193.
Factual

This AD mandated the fitment of the new standard control actuator, with
one-way interchangeability57. Fitting of the modified actuator alleviated the
requirement to conduct an inspection of the castellated lock nut every 10 flight
hours. All the other mandatory inspections were retained in the new AD.

The final change by the manufacturer was to develop a new tail rotor duplex
bearing introduced into service by mandatory Service Bulletins 169-162 and
189‑254 on 4 August 2020. Replacement with the new bearing was required
within 400 flight hours or 4 calendar months of the SB issue date. The new
bearing replaced the ceramic balls with steel balls. The new bearing had an
introductory life limit of 400 flight hours. The Service Bulletin also required
time expired bearings to be returned to the manufacturer for inspection
following replacement.

None of these safety actions were applied to the AW139 fleet, as the helicopter
manufacturer considered it was not affected by this issue.

1.12.5 Investigation of other failed bearings identified by emergency checks

Several bearings were removed from service globally as a result of inspections

carried out to comply with the ASB and AD requirements. Most of these
bearings were returned to the bearing manufacturer for further investigation,
but several of them were selected for further investigation by the AAIB. Some
of the total number of rejected bearings inspected were found not to show any
visible damage. However, some of the bearings exhibited levels of distress
that were inconsistent with their time since new and could potentially have
resulted in the same in service failure had they not been detected by the
emergency inspections.

The removed bearings showing evidence of distress, were subjected to

in‑depth forensic laboratory investigation using the same techniques applied

57 The old part number actuator can be replaced by the new part number actuator, but not the other way
around.

© Crown Copyright 2023 88 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

to the accident bearing. The following serial numbers are reported as

exemplars of the various stages of deterioration of the bearing but were not
the only bearings confirmed to have damage.

Serial number 14134

This bearing was removed in service from an AW189 during the initial
AD inspection requirement. It had accumulated 1,117 flying hours since new.
The operator identified that the bearing rotation was ‘notchy’ when turned by
hand, so rejected it for further investigation. This was done on behalf of the

Information
Factual
AAIB by nC2 at the University of Southampton.

Once the bearing had been weighed and CT scanned, it was opened for detailed
inspection. Visually there was evidence of degradation of the grease. The
grease on the outboard inner race appeared brown but still moist, suggesting
the presence of lubricating oil but no longer in the solid grease form. The
inboard inner race was also brown but with a tacky rather than moist residue
over the race surface (Figure 45). There was no evidence of any damage
to the balls, but the cages showed evidence of wear in the ball ‘pockets’ and
witness marks indicating a ‘running line’ around the circumference where the
cage had been in contact with the inner race.

Figure 45
A) Outboard inner race of bearing showing evidence of
moist lubricant residue. B) Inboard inner race showing tacky
residue coating the race surface

Non-destructive examination

Following ultrasonic cleaning, both the inner races were examined by visual
microscopy. This confirmed a clear track where the balls had been running,
which was consistent with the intended design position.

© Crown Copyright 2023 89 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The races were then scanned using the non-contact optical scanning technique
(RedLux OmniLux). This allowed the identification of raised features in the worn
running path on the inboard inner race (Figure 46).
Information
Factual

Figure 46
Optical scan of inboard inner race on a +5 µm to -10 µm colour scale
showing distribution of raised crack features

The inner races were inspected using an SEM, with the images then processed
using MeX software to create height maps. The outboard inner race showed
evidence of the original manufacturing grinding marks across the race surface,
except for the running area band, where they had been worn smooth. The
inboard inner race exhibited crack features, which displayed the same
orientation and aspect ratio but varied in size (Figures 47 and 48).

Figure 47
SEM image of inboard inner race showing variation in crack sizes

© Crown Copyright 2023 90 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 48
MeX height map of crack feature 1 showing measurements and pitting

Destructive examination

A circumferential and radial section was cut from the inboard inner race and
inspected using the SEM. This showed that the larger cracks extended to a
depth of 50 µm and were consistent with those seen on the accident bearing
(Figure 49).

Figure 49
SEM image of circumferential section showing crack depth and orientation

Etching of the sections from both the inboard and outboard inner rings confirmed
a DER of microstructural change within a band from the surface to 0.2 mm
down. (Figure 50). Nano hardness testing confirmed a reduction in hardness
through this region. The area of microstructural change on the inboard race
was deeper and more consistent than on the outboard race, but both showed

© Crown Copyright 2023 91 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

evidence of change consistent with the early stages of a surface origin, rolling
contact fatigue mechanism.
Information
Factual

Figure 50
Etched radial section from inboard inner race showing area of
microstructural change (DER)

Serial number 15119

This bearing was removed from an AW169 during the post-accident repetitive
inspection programme. It had accumulated 663 flying hours in service.
Initially it was opened and inspected by the bearing manufacturer, after which
components were provided for further forensic assessment by nC2 at the
University of Southampton and the bearing manufacturer’s failure analysis
specialist, in order to independently compare the findings.

Non-destructive examination

Initial inspection showed burnt grease residue and heavy damage to both the
inner races. Two balls from the outboard race exhibited spalling damage, with
the other balls showing evidence of crazing. The cage from the inboard row
was cracked completely through in one location and partially cracked in another.
There was also wear in various ball pockets from contact with the balls. The
bearing components were CT scanned and cleaned, before being inspected by
optical macroscope (Figure 51).

© Crown Copyright 2023 92 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 51
A) Damage to inboard inner race. B) Damage to outboard inner race.
C) Magnified image of damage showing macropitting on inboard inner race.
D) SEM image of macropitting
.
Destructive examination

The inboard and outboard inner races were sectioned both radially and
circumferentially to assess the subsurface cracking. This showed angled,
surface initiated cracks consistent with the other bearings that had been
analysed but showing evidence of additional material loss to create macropitting
(Figure 52). Etching of the radial section and hardness testing confirmed the
presence of a DER of microstructural change extending approximately 0.2 mm
downwards from the surface (Figure 53). The radial section from the outboard
inner race showed some initial material transfer from the cage to the surface of
the race. The damage on this race extended over a larger arc of the running
surface compared to that seen on bearing s/n 14134.

© Crown Copyright 2023 93 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 52
Microscope view of circumferential section from inboard inner race showing
angled, surface initiated cracking with material loss

Figure 53
Macroscope view of etched (Vilella) radial section from outboard inner race,
showing change in microstructure (DER)

Cage damage and wear

The inboard cage had two fractures in pockets on the narrow end and one on
the wide end, but remained in one piece. Both the cages from this bearing had
a wear lip on the inside surface of the wide end of the cage (Figure 54).

© Crown Copyright 2023 94 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 54
Wear lip on the inner surface of the wide end of the outboard cage

Serial number 13123

This bearing was removed from service by an operator in May 2019 due to
the presence of black powder around the bearing and an increase from one
mandatory inspection to the next, in the measured torque required to turn the
bearing, although the torque measured was still well within the rejection limits.
The bearing had operated 1,695 hours since new. Following removal, it was
inspected by the bearing and helicopter manufacturer’s failure investigation
laboratories.

Non-destructive examination

When the bearing was opened, it was found to have significant damage over
the whole running surface of the bearing on the inboard row, inner and outer
races (Figure 55). Material had been displaced from a wear path the same
radius as the radius of the balls and pushed up above the shoulder of the race
(Figure 56).

© Crown Copyright 2023 95 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 55
A) Outboard inner race, cage and balls. B) Inboard inner race, cage and balls.
C) Damage to inboard inner race. D) Wear to inboard cage pocket

The outboard row races exhibited less damage than the inboard row.

Figure 56
Inboard inner race showing wear path created by the balls
and material displacement

© Crown Copyright 2023 96 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The inboard cage showed evidence of heavy wear predominantly to one of

the cage pockets, where the wall was holed. One of the balls from the inboard
row had heavy spalling, with wear scarring to the neighbouring ball as well,
potentially caused by contact between the balls through the pocket wall.

The ball had spalled over 50% of its surface area. The bearing manufacturer’s
report stated that although the estimated initiation point of the spalling was
identified, the cause could not be determined (Figure 57). The helicopter
manufacturer’s laboratory investigation report stated that a 3D particle was
identified embedded in the spalled area of the ball. EDAX analysis of the particle

Information
Factual
suggested it was iron oxide, which the report identified was used as an additive
during the sintering58 and/or hipping59 process The bearing manufacturer
refuted this, stating that iron oxide is not used in either of these processes
and that the material was likely adhered debris rather than an inclusion. The
helicopter manufacturer’s report stated the particle was ‘embedded’ with ball
material partially covering it. They considered it likely that this particle was
originally below the surface of the ball material.

Figure 57
Magnified view of the spalling on the surface of the ball

Destructive examination

The inner and outer races were sectioned and etched with Vilella’s reagent
to identify any material microstructure change. The inboard inner and outer
races showed surface initiated cracking at an angle of approximately 20° to the

58 Process of creating a solid from powder using heat and compression.

59 Hot isostatic processing (HIPping) involves the application of high gas pressure at an elevated
temperature to components to completely remove internal porosity and voids.

© Crown Copyright 2023 97 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

surface and extensive micropitting (Figure 59). However, there was no DER
below the surface as found on the other bearings (Figure 58).
Information
Factual

Figure 58
Inboard inner race radial section with no evidence of DER

Figure 59
Inboard inner race surface initiated cracking

Serial Number 17115

This bearing was removed from service in 2018 after just 23 flight hours due
to the presence of black dust, during one of the Service Bulletin inspections.
During the subsequent lab inspection, the grease was observed to be black in
colour, but consistently distributed in the bearing.

© Crown Copyright 2023 98 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The inner and outer race on one side of the bearing was found to be damaged
with significant spalling and material loss on both the races and on one of the
balls (Figure 60).

Information
Factual
Figure 60
A) Bearing with one side removed showing black grease.
B) Inner race damage. C) Spalled ball. D) Outer race damage

Forensic investigation by the bearing manufacturer confirmed that the ball had
spalled due to a large iron silicide inclusion in the ceramic material (Figure 61).

Figure 61
Remains of inclusion on the spalled ball

© Crown Copyright 2023 99 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Serial number 14125

This bearing was reported to the AAIB in January 2020 by the helicopter
manufacturer, as having been removed from an AW169 during the
postaccident repetitive inspection programme. It had accumulated 454 flying
hours in service. It was then assessed by the bearing manufacturer’s failure
specialists, who issued a laboratory report in February 2021. The bearing was
not assessed independently by the investigation and the factual information
provided below is based solely on the manufacturer’s report.
Information
Factual

Non-destructive examination

Initial inspection showed burnt grease residue on the outside of the seal on one
side of the bearing (0.11 g). Both seals were present and showed evidence of
wear consistent with contact with the cages. CT scans showed that the cage on
one side of the bearing had displaced outwards due to wear from contact with
the inner race at the wide end, the same as seen on various bearings inspected,
but most noticeably on bearing s/n 16141, used in the manufacturer’s final rig
test. Once opened, the bearing was found to contain grease which had fully
degraded to black powder. One of the cages had also completely fractured
into two pieces. There was also wear in various ball pockets from contact with
the balls. The balls had a matt white surface finish. One ball from the side of
the bearing where the cage was displaced exhibited spalling damage, with the
other balls all showing evidence of crazing. The outer races showed signs of
wear and damage, whilst the inner races exhibited heavy damage with spalling
across the normal running path of the balls, but with additional evidence of
damage across a broader width of the race.

Destructive examination

The inboard and outboard inner races were sectioned both radially and
circumferentially to assess the subsurface cracking. This showed angled,
surface initiated cracks consistent with the other bearings that had been
analysed with evidence of material loss to create macropitting. Etching of
the radial section and hardness testing confirmed the presence of a DER,
microstructural change and carbide flow. The inner races also showed some
initial material transfer from the cage to the surface of the race. As with the
other bearings, the fracture surfaces on the cages confirmed the cage failed in
fatigue.

1.13 Medical and pathological information

All five occupants of the helicopter suffered significant and disabling injuries
when the helicopter struck the ground. Post-mortem reports indicated that

© Crown Copyright 2023 100 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

four of the occupants survived the initial impact but died as a result of breathing
products of combustion from the resulting fire. One occupant was likely to have
died from injuries sustained during the ground collision.

Four first responders were treated for the effects of heat following their attempts
to rescue the occupants of the helicopter.

1.14 Fire

Shortly after rising above the stadium the helicopter was seen by two police

Information
officers in a car near to the stadium. They saw the helicopter begin to rotate

Factual
and descend from view followed by the sound of an impact.

They reported the accident to their control room and drove to the scene, arriving
at 2039 hrs60, approximately one minute after the helicopter struck the ground.
They found the helicopter resting on its left side with a significant fire already
visible towards the rear of the fuselage. In their statements, the officers reported
that as they approached the helicopter the fire was rapidly moving from the rear
towards the front of the helicopter and increasing in ferocity. One officer also
reported that they could hear one or both of the helicopter’s engines running.
The officers could not reach the right side door apertures due to their height
from the ground, so attempted to break the helicopter’s windscreen using their
batons and other handheld equipment, which was unsuccessful. Body worn
camera footage showed that by 2041 hrs the fuselage was completely engulfed
by the fire.

Approximately 13 seconds after impact, the helicopter’s baggage compartment

smoke detection system began to trigger intermittently and one minute after
impact the helicopter’s automated warning system was recorded by the CVR
announcing “engine one fire”.

Approximately nine minutes after impact the Fire Service began extinguishing
the fire. The fire was largely extinguished within six minutes of water being
applied, but periodic flare-ups were observed for a further eight minutes after
which no flames were visible.

1.15 Survival aspects

1.15.1 Certification requirements

The AW169 was certified in accordance with EASA CS 29 Amendment 261. The
current version is CS 29 Amendment 11.

60 Time recorded on police car camera.

61 https://www.easa.europa.eu/document-library/certification-specifications/cs-29-amendment-2
(accessed 28 July 2023).

© Crown Copyright 2023 101 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The certification requirements related to passenger protection and emergency

evacuation are defined in CS 29 Book 1, Emergency Landing Conditions,
CS 29.561 through CS 29.563 and Personal and Cargo Accommodations
CS 29.771 through CS 29.863.

A review of all the changes between CS 29 Amendment 2 and CS 29

Amendment 11 confirmed that the only changes to the certification standards
for passenger protection and emergency evacuation concern the introduction
of additional measures relating to landing on water which are not relevant to
Information

this accident.
Factual

The emergency landing conditions, which must be achieved by a helicopter

design, are defined in CS 29.561 (b) which states:

'(b) The structure must be designed to give each occupant every

reasonable chance of escaping injury in a crash landing when:

(1) Proper use is made of seats, belts and other safety

provisions

(2) The wheels are retracted (where applicable); and

(3) Each occupant and each item of mass inside the cabin
that could injure an occupant is restrained when subject
to the following ultimate inertial load factors relative to the
surrounding structure

(i) Upward - 4 g

(ii) Forward - 16 g

(iii) Sideward - 8 g

(iv) Downward - 20 g, after the intended displacement of

the seat device

(v) Rearward - 1.5 g’

Subpart (c) of CS 29.561 also states that the helicopter’s structure must be
capable of restraining significant items of mass, which are attached to the
structure, such as the engines and main rotor transmission at downward loads
of up to 12 g.

The dynamic conditions which a helicopter must withstand during an emergency

landing are defined in CS 29.562.

© Crown Copyright 2023 102 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

This states that a helicopter, although it may be damaged in a crash landing,

must reasonably protect each occupant when exposed to a range of forces.
CS 29.562 (b) requires that the seats installed in a helicopter must demonstrate
by testing their ability to provide protection from a peak floor deceleration of not
less than 30 g over a period of no more than 0.031 seconds with the longitudinal
axis of the floor inclined upward at 60° to the direction of deceleration. The
tests are conducted with a 77 kg test dummy secured to the seat.

The helicopter’s fuel system must also meet the crash resistance standards
defined in CS 29.952. This states that fuel tanks located in the helicopter cabin

Information
Factual
must be capable of resisting an ultimate downward inertial load factor of 20 g.
The ability of the fuel system to meet dynamic load requirements is verified by
carrying out a ‘drop test’ from a height of at least 15.2 m.

1.15.2 AW169 crashworthiness

In order to meet the emergency landing dynamic conditions of CS 29.562 the

cockpit and passenger seats installed in the AW169 are fitted with an impact
absorption mechanism. Two L shaped legs secure the seats to the cabin floor
and carry the seat pan. A slide is fitted to each side of the seat pan which
engages in a rail in each seat leg. This allows vertical adjustment of the seat pan
and allows downward movement of the seat pan against an energy absorption
system during severe vertical loads. The energy absorption system consists of
sheet metal straps positioned between the slides and seat rails. These bend
progressively under load, decreasing the forces experienced by the occupant.
A ‘stroke index mark’ is located on the side of each seat leg (Figure 62). The
stroke index mark must remain visible with the seat pan at its lowest position.
If the mark is not visible or partially obscured, this is an indication that the
seat’s impact absorption system has operated. The seats were designed, and
certified, to mitigate vertical decelerations of up to 30 g.

Figure 62
Generic AW169 cockpit seat (original image courtesy of the manufacturer)

© Crown Copyright 2023 103 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The helicopter manufacturer provided documentation which confirmed that

the AW169, and the interior configuration installed in G-VSKP, met the
cabin and passenger safety requirements defined in CS 29 Amendment 2.
Documentation was also provided which confirmed that, during the certification
process, the fuel tank installation and fuselage structure met the design and
drop test requirements of CS 29.

The design of most helicopter’s, including the AW169, does not allow for the
provision of emergency exits in the top, bottom or rear of the fuselage. If the
Information

helicopter comes to rest on its side during an accident, the only practical means
Factual

of escape for the occupants would be to leave by the doors and exits on the
uppermost side of the helicopter. This would require them to climb up to the
highest side of the helicopter using seat arms and internal fittings as hand and
foot holds.

1.15.3 Examination of wreckage related to crashworthiness

Damage observed to the lower fuselage of the helicopter showed evidence

of buckling and failure in the region directly below the main fuel tanks. It was
consistent with this section of the fuselage striking the raised step on the
accident site. Examination of the damage showed evidence that parts of the
fuselage structure had been driven into the fuel tank structure as a result of
impact forces (Figure 63).

Figure 63
Lower fuselage and fuel tank damage

© Crown Copyright 2023 104 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

After recovery of the helicopter to the AAIB, an examination of the helicopter’s

cabin was carried out to locate the cockpit and passenger seat impact absorption
features and to determine if they had operated correctly during the accident.
Due to the damage caused by the post-impact fire it was not possible to identify
specific components of the two cockpit seats. The four rearward facing seats
in the passenger cabin had been extensively damaged, but the lower sections
of the seats remained in-situ. The level of damage to the seats did not allow
reference to the stroke index marks to determine if the seat impact absorption
systems had operated. However, examination of the position of the seat pan
sliders within the seat leg rails, confirmed that the impact absorption system of

Information
Factual
the two outboard seats had operated and seat pan slides had exceeded the
limit of their downward travel (Figure 64).

Figure 64
Rearward facing passenger seat impact absorption mechanism

Examination of the remains of the three forward facing passenger seats

confirmed that the impact absorption mechanism of the central seat had also
operated, and the seat pan slides had reached the downward limit of their
range of movement.

© Crown Copyright 2023 105 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.16 Tests and research

1.16.1 Engineering tests and trials

1.16.1.1 Post-accident bearing tests

The helicopter manufacturer utilised three test rigs, two in Italy and one in the UK.
These were used to conduct a series of fifteen tests for both investigation and
continued airworthiness purposes. A fourth test rig at the bearing manufacturer’s
facility was used to conduct a further investigation test. The rigs used production
Information

standard TRA control shafts to apply an axial load to the bearing. The rig in
Factual

the UK also allowed a bending moment load to be applied. The control shafts
were instrumented to measure temperature, vibration and torque. Specific
temperature, vibration and torque limits were defined as stop conditions for the
testing in order to protect the rigs. In practice, observation of a torque reading
on the control shaft became the limiting factor which resulted in the tests being
stopped, as it demonstrated that the bearing was starting to seize.

The test scenarios explored a range of possible factors including:

● Standard and modified bearings with different operating loads

applied.

● Standard and modified bearings with different preloads.

● Standard and modified bearings with the grease degraded or

removed.

● Intentionally incorrectly installed bearings.

● Continued running of bearings that had been removed from

service with initial signs of distress.

● Continued running of bearings that had been removed from

service with heavy damage.

The tests demonstrated that as the axial load changed direction (control shaft
moved to the left or right) the side of the bearing carrying the load changed and
the temperature in that part of the bearing increased. The tests with different
preloads did not result in any damage to the bearing, as such the manufacturer
did not consider this to be a significant factor in isolation.

The tests which continued operation with existing heavy race damage
(TSDD-DB-4&6) and those where the grease was completely removed
(TSDD‑DB-1&2), were conducted to try to understand the duration and sequence
of the final failure of the bearing, rather than to replicate the initiating cause of
bearing failure.

© Crown Copyright 2023 106 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

These tests ran until a stop condition was reached and identified that the
temperature of the bearing (measured at the control shaft) rose significantly
and consistently in the final stages of operation prior to failure (seizure), peaking
around 600°C. The incipient seizure of the bearing was replicated in two of the
rig tests. Both confirmed that seizure of the bearing resulted in a torque load
being transferred to the control shaft. On one of the tests this also resulted in
movement of the servo end locking nut relative to the shaft.

A separate rig test (TSDD-DB-16) was completed replicating the removal of the
seal and grease on one side of the bearing as with the earlier test but using an

Information
Factual
AW139 bearing, this bearing subsequently failed in the same manner62.

The helicopter manufacturer’s test card for one test (TSDD-DB-05) recorded
the finding that ’typical’ grease loss was present in the form of a ring of grease
on the external face of the seal. In this test the bearing was operated with
intact seals and nominal grease content. It ran for 1,037 hours with no damage
identified when the bearing was disassembled.

1.16.1.2 Investigation requested endurance rig test

This test was carried out on the rig at the bearing manufacturer’s facility and
was a 1,000 hour endurance test, undertaken at the request of the investigation.
The continuous run test was conducted on a new bearing (s/n 19189), with a
constant load in the same direction of 8,000 N axially and 16 Nm bending load63,
recommended by the manufacturer to replicate the maximum certification static
flight load case for the AW169.

Except for two minor stoppages due to technical difficulties, the test ran
continuously for 1,000 hours. During this time, the temperature of the bearing,
measured by a thermocouple on the outside of the inner race, varied between
approximately 72°C and 82°C. At the end of the test the bearing was still able
to rotate freely.

Lab forensic investigation

The endurance test bearing (s/n 19189) was removed from the test rig and sent
to nC2 at the University of Southampton for the same forensic examination as
the accident bearing.

62 At the time of publication, two tail rotor bearings have been reported as having failed on the AW139
fleet. These are being investigated as a separate but linked AAIB investigation. None of the emergency
AD inspections or modifications issued for the AW169/AW189 are applicable to the AW139, which are
covered by separate inspection requirements.
63 The rig test couldn’t mechanically apply bending moment, so a calculated equivalent load was applied.

© Crown Copyright 2023 107 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Non-destructive examination

Comparison of the pre and post-test bearing mass showed that 1.4 g had been
lost during the test. The bearing was opened to separate the component parts.

The grease was found to be black in colour, with some separation of the oil and
the matrix. It had also become sticky and lumpy in consistency, indicating a
change of condition due to ageing (Figure 65).
Information
Factual

Figure 65
Condition of the grease in the endurance test bearing s/n 19189

The races of the loaded side of the bearing showed evidence of a wear line
created by the balls, but no evidence of fatigue damage. The balls also exhibited
a ‘run’ line, which was off centre, but no spalling (Figure 66). The cages had
witness marks in the pockets, which were more pronounced on the loaded side
of the bearing, but no significant damage.

Figure 66
Wear on inner race and balls of the loaded side of the test bearing

Destructive examination

Sectioning, etching and SEM inspection of the race material, confirmed there
was no evidence of rolling contact fatigue damage or a heat affected zone of

© Crown Copyright 2023 108 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

material properties change on any of the races. The inboard race of the loaded
side of the bearing did, however, exhibit a DER below the race surface, where
the wear line showed the balls had been running (Figure 67).

Information
Factual
Figure 67
DER under the running surface of the inner race on
the loaded side of the bearing

1.16.1.3 Manufacturer’s subsequent rig test

The manufacturer conducted a further rig test on the test rig based in the UK.
This test utilised the same certification endurance test profile to test the hybrid
bearing as was used for the approval of the new all steel replacement bearing.
The hybrid bearing selected for the test was s/n 16141. This bearing had been
removed from service in November 2018 with 138 flight hours, after being
rejected for rough operation following the additional in-service inspections (SB
169-125). The bearing was inspected visually and found serviceable, so it was
reconditioned with fresh grease by the bearing manufacturer and sent for use
on the test rig. However, a decision was made by the helicopter manufacturer
to completely remove the seal on the inboard side of the bearing, to test how
this would affect the performance of the bearing. The test rig was instrumented
with sensors to measure axial load, bending moment, temperature and torque.

© Crown Copyright 2023 109 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The test spectrum used for the certification endurance test was based on the
highest axial loads recorded during the original certification flight testing of
the AW189, (Figure 68) combined with the highest bending moment from the
development spectrum.
Information
Factual

Figure 68
AW189 flight loads used to create the certification endurance test
for the new all steel bearing.
(original image courtesy of the manufacturer)

This was translated into a test profile by alternating the loads at each step
(green line in Figures 68 and 69) to create a test block.

Figure 69
Load profile for certification endurance test
(original image courtesy of the manufacturer)

© Crown Copyright 2023 110 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Each test block consisted of a total of five hours of running time under load,
distributed at the loads and durations shown in Figure 70, followed by two
hours at a complete stop. The test was also conducted at the AW189 tail rotor
rotation speed of 1,406 rpm, rather than the AW169 tail rotor rotation speed of
1,633 rpm, used for the other rig tests.

Information
Factual
Figure 70
Test block for certification endurance test
(original image courtesy of the manufacturer)

The hybrid bearing rig test finished on 10 December 2020 after a total of
145 test blocks had been conducted, resulting in an elapsed time of 1,015
hours and an operating time of 725 hours.

The test had been halted at various points through its progression. The first
was at 290 hours to replace the thermal indicator strip which was showing
an erroneously high temperature. The second stop occurred when the rig
temperature sensor warning was triggered to indicate the bearing sensor had
reached 130°C. The warning threshold was progressively raised to 200°C, then
300°C and then 400°C to allow the test to continue. The test was eventually
stopped when the torque alarm was triggered at 10 Nm, indicating that the
bearing was starting to transfer drive torque through to the control shaft.

The inspection conducted at the first stop indicated that a ‘collar’ of grease
extruded from the bearing had built up around the inboard bearing face where
the seal had been removed (Figure 71). The volume of grease remained the
same throughout the test.

© Crown Copyright 2023 111 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 71
Grease extruded from the bearing during the first 290 hours of testing.
(original image courtesy of the manufacturer)

The actual axial and bending moment loads recorded during the testing were
provided to the investigation for further analysis. This data was sampled
once a minute. In many cases the test point recorded loads did not exactly
match the planned test loads shown in Figure 70. The top three positive and
negative load cases were considered during this analysis as they were above a
threshold where damage could potentially be incurred from the resulting contact
pressures. The data for each test point was then extracted and averaged to
give a representative spectrum for the whole test. The approximate bearing
bending moments were then calculated64 (Table 6).

Approx. bearing
Approx. bearing
Target axial Average Axial bending
bending moment
load (N) load (N) moment NRL
PRL (Nm)
(Nm)
14,000 13,834.01 -10.5 -2.25
-14,000 -10,684.60 20.4 -20.6
10,000 9,703.20 -5.9 -9.5
-10,000 -7,605.67 15.6 -19.6
7,800 7,956.77 -4.64 -10.4
-7,800 -5,980.96 12.7 -18.1
Table 6
Averaged actual loads applied during the rig test for highest load cases
64 For more information on bending moment sensors and PRL and NRL locations see section 1.16.2

© Crown Copyright 2023 112 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 72
Graph showing temperature increase with load application during three blocks
of the rig test
(original image courtesy of the manufacturer)

Plotting the load and temperature sensor readings showed that the temperature
on each side of the bearing increased proportionately to the load magnitude
and direction applied. Figure 72 shows the two temperature sensors T1 and
Tx and the load being applied TH1.

Towards the end of the test the temperature increase seen each time the load
was applied began to increase significantly more than seen at the start of the
test, until the torque alarm was triggered, and the test was stopped (Figure 73).

The bearing was removed from the test rig and collected by the AAIB for further
investigation by nC2 at the University of Southampton using the same agreed
procedure used for examining the other bearings. The extruded grease was
recovered and weighed at 3.3 g. Following initial visual and SEM inspections,
the bearing was cut in half, to allow one half to be examined separately by
the helicopter manufacturer. Prior to disassembly of the bearing, it was CT
scanned. This showed that the cage on the outboard side of the bearing had
moved, relative to its intended running location.

© Crown Copyright 2023 113 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 73
Graph showing rise in temperature increase with load application
at the end of the test
(original image courtesy of the manufacturer)

A groove had been worn in the cage and a lip worn on the race where they
were in contact (Figure 74). Large amounts of debris were also seen within the
bearing races.

Figure 74
CT scan of bearing 16141 showing wear interaction on
the outboard cage and race

© Crown Copyright 2023 114 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Non-destructive examination

The inboard side of the bearing, which had operated with the seal removed,
was disassembled and inspected. The grease had degraded to the extent that
it was black, dry and powdery but it was still present (Figure 75).

Information
Factual
Figure 75
Condition of the inboard side of the bearing which was operated
with the seal removed

The inner race of the inboard side showed discreet areas of macropitting and
high temperature induced permanent change in colour (Figure 76).

Indications of
macropitting

Figure 76
Inboard inner race showing discrete areas of macropitting and
permanent colour change

© Crown Copyright 2023 115 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The grease on the outboard side was in a similar condition to that of the inboard
side (Figure 77).
Information
Factual

Figure 77
Condition of the outboard side of the bearing operated with the seal in place

The cage could be rotated independently but not separated from the inner race
due to the groove and lip worn into the cage and race (Figure 78).

Inner race

Lip worn on the wide Groove worn

end of the inner race into cage

Figure 78
Image showing the groove and lip worn into the cage and inner race
of the outboard side of the bearing and the damage
to the race running surface (post-cleaning)

The race surface of the outboard inner race was more heavily damaged
than the inboard side, with the level of damage consistent all around the
circumference. The balls from both halves of the bearing were examined

© Crown Copyright 2023 116 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

visually and using an SEM. Both sets of balls were found to be surface
crazed in a similar way to that seen on the accident bearing. There was no
evidence of spalling on the balls.

The cages on both sides of the bearing were also visually inspected using a
stereo macroscope. On the inboard side (no seal) the pockets were worn in a
consistent manner, with more wear on the leading side than the trailing side of
the pockets. On the outboard side, the cage pockets were more heavily worn
than the inboard side, again with the leading side of each pocket worse than
the trailing side. The heaviest wear occurred where the groove had been cut

Information
Factual
into the cage by the lip on the inner race. This wear feature was also seen to a
lesser extent on the accident bearing.

The damage to the outer races mirrored that of the respective inner races,
with the inboard side showing individual discrete macropits in the middle of
the rolling surface, while the outboard race had consistent surface damage all
the way around its circumference and across the width of its running surface.

Destructive examination

The outer race was sectioned to allow inspection using an SEM. The inboard
side displayed growing RCF damage from a series of surface initiated cracks.
Copper deposits were also identified on the rolling surface. The outboard side
had more extensive micropitting resulting in an undulating surface. Copper
transfer was also identified to a greater extent on this surface. Etching and
polishing of the sections identified microstructural change below the surface
but no DER.

The inner races from both sides of the bearing were also sectioned and
inspected using an SEM. The inboard side (no seal) showed discrete micro
and macropitting consistent with surface initiated RCF. The cross sections
were etched and polished to show a DER was present below the surface of
the race (Figure 79), with compression and deformation of the microstructure
immediately below the surface. Shallow angle surface initiated cracks were
also present.

The outboard inner race sections confirmed surface damage all over, with large
amounts of copper transfer. The race showed evidence of heat treatment during
the etching process, which was confirmed by the presence of a DER and heat
affected zone below the surface. The microstructure also showed evidence of
flow lines consistent with plastic deformation. Shallow angle, surface initiated
cracks were also present, although these were more closed than seen on the
outer race and previous bearings inspected (Figure 80).

© Crown Copyright 2023 117 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 79
DER layer identified on the radial section and surface cracks shown on
circumferential section of the inner race, inboard side

© Crown Copyright 2023 118 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Deformed lip of the inner race

Information
Factual
Dark etched region

Deformed
microstructure
Shallow angle, surface
initiated crack

Figure 80
Outboard inner race radial section showing DER and circumferential section
showing surface initiated crack

© Crown Copyright 2023 119 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.16.1.4 Review of AW169 flight test and rig test bearing contact pressures

The data recorded during the AW169 flight test load survey65 for axial load
(TH1) and bending moment were requested by the investigation and provided
by the helicopter manufacturer. This consisted of over 1,600 individual flight
test manoeuvres from 47 test flights. For each manoeuvre the resulting highest
(positive and negative) static and oscillating fatigue load, highest (positive and
negative) individual static and dynamic load and highest (positive and negative)
total load (combined static and dynamic) was provided. For the bending
moment data, this was provided for both ‘NRL’ and ‘PRL’ at both ‘BB1’ and
Information
Factual

‘BB2’. This data was manually referenced and sorted, to match the helicopter
flight test variables for the applicable flight test with the resulting axial load and
bending moment data for each manoeuvre test point.

The contact pressure between the bearing rolling elements and the inner and
outer races is generated by a combination of the bearing preload and the
external axial and bending moment loads acting on the bearing. The bearing
manufacturer analysed the contact pressure reached for several combinations
of the ratio of axial load to bending moment (Fa/M) against axial load (Fa). This
analysis showed contact pressure reached a similar level to the highest value
considered in the development spectrum at axial loads above 7,000N, for each
of the considered ratios. To prioritise assessment of the flight test points likely
to generate the highest contact pressures, the test data was reviewed and the
test points which had an axial load greater than 7,000N were selected as an
initial cut, resulting in 95 test points of interest.66

For these test points, the approximate bending moment at the bearing needed
to be calculated from the individual bending moments recorded at ‘BB1’ and
‘BB2’. This was done independently by the investigation using professional
beam analysis software. The bending moment and location data for ‘BB1’ and
‘BB2’ were input into a calculation, along with the simplified actuator shaft
geometry and material properties to estimate the effective ‘PRL’ and ‘NRL’
bending moments at the bearing.

This analysis identified a number of bearing bending moments (PRL and/or

NRL) which were greater than the largest bending moment considered in the
AW169/189 development spectrum of 42.4 Nm67, but lower than was considered
by the AW139 development spectrum.68

65 See section 1.6.6 for a full description.

66 It is possible high contact pressures were also generated in test points with axial loads below 7,000N,
but given resource constraints the analysis was targeted at identifying where contact pressures were
equal to or exceeded the development spectrum, rather than a comprehensive review of all the test data.
67 See Table 4 for the full development load spectrum. The highest bending moment, axial loads and
contact pressures are highlighted in the table.
68 See Table 1 for the AW139 load spectrum, The highest bending moment is highlighted.

© Crown Copyright 2023 120 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

This subset of 37 data points was provided to the bearing manufacturer to input
into their current and most accurate bearing model simulation tool to assess the
resulting contact pressure and PVmax.

Individual bearings are not certified as a discrete component, they are only
assessed for suitability within the system application under consideration, in
this case the tail rotor control system. PV is a figure which can be used as a
guide to the performance demand on a bearing within a specific application.
Calculated as the product of contact pressure and bearing velocity (P x V), it
can be considered as a relative indication of how much ‘duress’ the bearing is

Information
Factual
under in different operating conditions, to allow a simple and direct comparison
for different load profiles and operating speeds. As the contact pressure varies
across the race profile (Figure 87), PVmax is often used to reference the highest
PV figure calculated across the profile. However, it is not intended to be used
as an absolute threshold for acceptance or rejection of the bearing. The data
below is provided solely to allow comparisons between the development
spectrum, flight test data and rig test data, with the same region of values
highlighted in yellow on each summary graph.

The full results for the 37 flight test data points are provided in Appendix E but
summary graphs are shown below (Figure 81 and 82).

Figure 81
Significant flight test points calculated contact pressures

© Crown Copyright 2023 121 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 82
Significant flight test points calculated PVmax

As a comparison the maximum contact pressure in the bearing certification

specification was stated as 3,340 MPa, with a PVmax of 440 on the inner ring for
the extreme axial load case of 13,300N FZ (axial load) and 34.4 Nm Bending
Moment (Table 4). However, this contact pressure was calculated using the less
accurate modelling software available at the time the AW169 was developed.

Reassessment of the contact pressure using the current, more accurate,

simulation software gave a revised contact pressure of 3,100 MPa and PVmax
of 400 for this load case69 (the top line of each yellow highlighted box), showing
it to be comparable to the highest contact pressures identified in the flight test
results, which were achieved with much lower axial loads around 7,000N to
8,000N as shown in Figure 81 and Appendix E.

In order to provide a reference to compare with these figures from flight test, the
intended test loads from the last rig test (Table 7) conducted by the helicopter
manufacturer were also input into the current bearing model simulation software.
This is significant because the rig test demonstrated that the loads applied
during the test were sufficient to cause the same deterioration and damage as
seen in the accident and other in-service bearings70.

69 Documented in the bearing manufacturer’s report TR 11220-22-1 issue C.

70 See section 1.16.1.3 for detailed description of the test and results.

© Crown Copyright 2023 122 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Table 7
Rig test load spectrum

Information
The resulting contact pressures and PVmax factors were calculated. (Figure 83

Factual
and 84).

Figure 83
Rig test calculated contact pressures

Figure 84
Rig test calculated PVmax

© Crown Copyright 2023 123 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

However, as described in section 1.16.1.3 the actual loads applied during the
test itself in some cases varied from the planned test point values. In order to
give a more accurate assessment of the actual loads used in the rig test, the
average for the highest three load cases (positive and negative) was calculated
(Table 6 and Table 8) to give a representation of the test as a whole and these
were provided to the bearing manufacturer to reassess the contact pressures.
The results are presented below (Figures 85 and 86).

Axial Load Approx. bearing Approx. bearing

(N) bending bending
Information

moment NRL moment PRL

Factual

(Nm) (Nm)
Case 1 13,834.01 -10.5 -2.25
Case 2 -10,684.6 20.4 -20.6
Case 3 9,703.204 -5.9 -9.5
Case 4 -7,605.67 15.6 -19.6
Case 5 7,956.766 -4.64 -10.4
Case 6 -5,980.96 12.7 -18.1

Table 8
Load cases considered by the analysis of averaged test data

Figure 85
Rig test actual contact pressure (averaged data)

© Crown Copyright 2023 124 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 86
Rig test actual PVmax (averaged data)

Again, most of these load cases are comparable with the contact pressures
and PVmax calculated for the flight test data group.

None of the contact pressures generated by the actual test load conditions
were in excess of the contact pressures considered by the original development
load spectrum, as calculated by the standard of bearing modelling software
available at that time. However, the highest actual test point contact pressure
was higher than the highest contact pressure in the development spectrum
after it was reassessed with the latest standard of bearing modelling software
now available.

The bearing manufacturer was also able to calculate the pressure and PV
distribution relative to the curvature of the inner race (Figure 87).

The graphs and illustration of the inner race profile in Figure 87 show how
contact pressure and PV vary across the race profile and where the peak
values occur (PVmax). The location of these peak values correlates closely with
where the first evidence of surface initiated rolling contact fatigue appeared on
the inner races of bearing s/n 16141 used in the rig test, shown in Figures 76,
79 and 8071. And the inner races of bearing s/n 14134 which was removed from
service, shown in Figures 46 and 5072.

71 See section 1.16.1.3 for a full description of the bearing condition.

72 See section 1.12.5 for a full description of the bearing condition.

© Crown Copyright 2023 125 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The significance of this data comparison is explained further in the analysis

section 2.9.3 - Review of flight and rig test data.
Information
Factual

Figure 87
PV distribution relative to the inner race curvature

1.16.2 Impact assessment

The helicopter manufacturer carried out an assessment of the deceleration

loads experienced during the impact sequence using recorded and calculated
data provided by the AAIB. The assessment considered the loads on the
helicopter’s structure in the region of the fuel tanks and rear row of passenger
seats. It also considered the possible differences had the helicopter’s landing
gear been extended.

The assessment identified that with the landing gear extended, there was
no significant decrease in the forces transmitted through the helicopter’s
structure. The manufacturer stated that this was because the calculated rate
of deceleration and the forces involved exceeded the landing gear’s ability to
react, deform and dissipate the impact energy.

In reality the impact sequence was highly dynamic, but in order to estimate the
deceleration loads, based on an analysis of recorded data, the assessment
determined that the helicopter initially struck the ground with 19.77° of nose up
pitch and 29.88°of left roll (Figure 88).

© Crown Copyright 2023 126 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual
Figure 88
Illustration of initial impact attitude

The deceleration loads were then calculated at three points, A1, A2 and A3
(Figure 89).

Figure 89
Impact load calculation positions
(original image courtesy of the manufacturer)

The maximum and minimum accelerations in the vertical (Z), lateral (Y) and
horizontal (X) axes and the time they occurred after the initial impact were
calculated (Figure 90 and Table 9). These indicated that G-VSKP had probably
been subjected to loads which exceeded its design limits. The helicopters
attitude and the highly dynamic nature of the impact and subsequent loads
meant that it was not possible to determine the absolute margin by which the
design limits were exceeded.

© Crown Copyright 2023 127 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 90
Axis convention used for impact assessment calculation

Position X Axis Y Axis Z Axis

A1 Maximum +48.05g @ 0.03s +31.57g @ 0.027s +32.871g @ 0.028s
Minimum -46.18g @ 0.026s -40.14g @ 0.029s -41.87g @ 0.0314s
A2 Maximum +29.25g @ 0.022s 35.81g @ 0.31s +46.08g @ 0.0265s
Minimum -29.36g @ 0.024s -30.31g @ 0.0325s -41.76g @ 0.023s
A3 Maximum +73.99g @ 0.0315s 152.39g @ 0.0294s +86.85g @ 0.0239s
Minimum -92.11g @ 0.018s -33.72g @ 0.0205s -122.3g @ 0.0279s

Table 9
Calculated maximum and minimum impact accelerations

The simulation showed that the impact with the step would result in localised
crushing of the lower fuselage and significant damage to the fuel tank
supporting structure, with elements of damaged structure being driven into
the space occupied by the fuel tank bladders causing numerous penetrations
of the bladders. This was consistent with the damage observed during the
examination of the helicopter wreckage.

1.16.3 Flight simulator trials

The investigation team used the manufacturer’s flight simulator facilities to

investigate the symptoms of the control failure experienced by G-VSKP. The
trials were also an opportunity to gain an understanding of what cues might
have been available to the pilot and what challenges he faced in recognising
and responding to the emergency. During these trials the investigation used
a variety of flight and response parameters to explore their effect on scenario
outcomes.

© Crown Copyright 2023 128 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The trials revealed that G-VSKP experienced a divergent and disorientating

failure with no system-generated cues to alert the pilot to its nature. Despite
the pilot’s application of full left pedal to counter the uncommanded rotation,
the helicopter continued yawing right. With nose-down pitch and right bank
applied at the time of failure, the helicopter quickly diverged in all three axes.
In the trials, even with the collective lever fully lowered within one second of the
failure, the remaining torque imbalance resulted in peak yaw rates exceeding
100°/s. The trials indicated that in the time and height available to the accident
pilot it was not possible to regain positive control of the helicopter’s trajectory.

Information
Factual
While primarily exploring post-failure controllability factors, a secondary aim
of the trials was to compare a standard Cat A profile with that of the accident
flight. The observed 600-700 ft/min average rate of climb on the accident flight
required a higher main rotor torque setting than would have been needed for
a 300 ft/min climb. For similar collective lever intervention times, while peak
yaw rates and aircraft instability were slightly elevated at the higher torque
setting, the trials indicated this did not significantly influence the post-failure
controllability of the helicopter.

A detailed account of the flight simulator trials is included at Appendix B.

1.16.4 Manufacturer’s additional flight mechanics analysis

The manufacturer performed additional flight mechanics analysis using flightlab

software in order to consider if a different control input sequence after the failure
could have enabled a lower vertical speed at impact. The details provided
by the manufacturer are included in Appendix J. The simulation followed the
event up to the instant of failure using the FDR data. Immediately after the
failure the control logic simulated inputs to limit the pitch and roll motions, and
1.5 seconds73,74 after the failure, the collective lever was fully lowered. The
collective lever was fully raised at a simulated height of approximately 100 ft.
When the collective lever was lowered, cyclic control inputs to minimise pitch
and roll motions continued. The engines were not shut down. The analysis
plots provided by the manufacturer do not show any of the simulated lateral
motion of the helicopter. The manufacturer concluded from this analysis that it
was possible to:

73 According to FAA Advisory Circular 29-2C (AC 29-2C) Annex B Airworthiness Guidance for Rotorcraft
Instrument Flight, 1.5s is the suggested pilot response time that may be used during testing of automatic
flight guidance and control systems for an ‘attentive-hands-on’ phase of flight. Available at AC 29-2C
with changes 1-8 (faa.gov) [accessed 5 May 2023].
74 The FAA stated that the AC 29-2C ‘response,’ or ‘delay’ times, are used solely for flight test
demonstration of compliance and had been harmonised with other regulatory authorities, including the
EASA and that they are meant to serve as a mechanism for test pilots to conduct evaluations.

© Crown Copyright 2023 129 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

● Limit the yaw rate and maintain pitch and roll attitudes within
manageable limits.

● Avoid the disengagement of the AFCS and thus maintain at

least the basic stabilisation along the entire event (by avoiding
the saturation of the yaw rate channel above 128°/s).

● Decrease the rate of descent at impact to values around

1950 ft/min.
Information

1.17 Organisational and management information

Factual

1.17.1 Requirements for non-commercial operations with complex aircraft

European Union Commission Regulation No. 965/201275, including its

subsequent amendments, regulates the operation of aircraft subject to the
EASA regulatory framework. Specifically, Annex VI (Part-NCC) of that regulation
applies to non-commercial operations with complex motor-powered aircraft.

1.17.1.1 Complex helicopters

Under the EASA regulatory framework, a helicopter is considered complex if it

is certificated:

● for a maximum takeoff mass exceeding 3,175 kg, or

● for a maximum passenger seating configuration of more than

nine, or

● for operation with a minimum crew of at least two pilots.

G-VSKP was considered a complex helicopter because its maximum

takeoff mass exceeded 3,175 kg and it was certificated for a maximum of
11 passengers.

1.17.1.2 Part-NCC Operator requirements

Part-NCC requires operators of complex aircraft to adhere to the same

essential requirements as commercial air transport operators but the rules are
proportionate - instead of holding an Air Operator’s Certificate, operators must
submit a declaration to the member state’s competent authority76 about their
operation.

75 Commission Regulation (EU) No 965/2012 (‘Air Operations Regulation’). Available at https://www.easa.

europa.eu/document-library/regulations/commission-regulation-eu-no-9652012 [accessed 28 July 2023].
76 UK CAA for aircraft registered and/or operated from within the UK.

© Crown Copyright 2023 130 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

NCC operators need to comply with the Air Operations Regulation, in

particular the detailed requirements in its Annex III (Part-ORO - Organisation
Requirements) and Annex VI (Part-NCC), and their pilots must hold a valid
licence in accordance with Commission Regulation (EU) No 1178/2011 laying
down requirements on aircrew licensing. NCC operators are further required
to:

● have an Operations Manual,

● have a management system corresponding to the size of the

Information
operator and the nature and complexity of its activities,

Factual
● have an approved Minimum Equipment List for each aircraft,

● complete and submit a declaration to the competent authority,

detailing the aircraft type, operational and continued
airworthiness requirements and any approvals held, and

● ensure that the pilot(s) flying the aircraft hold(s) a Part-

FCL licence issued under Commission Regulation (EU) No
1178/2011.

The operator of G-VSKP was compliant with these requirements and had
added G-VSKP to their Part-NCC declaration to the CAA with effect from
13 October 2017.

The helicopter was not operating with an active Flight Data Monitoring77 system
and, under Part-NCC regulations, it was not required to.

1.17.2 Congested area operations

The LCFC training ground and King Power Stadium were within an area
designated as a congested area and special permission was required to fly
into them. The aircraft operator had been granted delegated authority from
the CAA to conduct congested area take offs and landing in accordance with
procedures set out in their operations manual which included the requirement
to conduct a site survey to establish that safe operations were achievable.

The two landing sites in Leicester had been surveyed in accordance with the
requirement, thereby providing pilots of G-VSKP with the appropriate permission
to operate into the sites. A requirement of the congested area permission for
G-VSKP was that operations at these sites were to comply with Cat A profiles
to mitigate the risk of engine failures during takeoff and landing.
77 A system used to monitor aircraft operations, capturing flight parameters in a similar way to accident
data recorders. System thresholds can be set for a given flight profile. Should a flight deviate beyond
expected parameters the system would alert the operator, thus prompting a review of the flight.

© Crown Copyright 2023 131 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.17.3 Operational oversight

Data from G-VSKP’s previous flights from the stadium showed that the rate of
climb had exceeded 300 ft/min and turns had been commenced below VY on
previous occasions. It was not possible to establish the reason for the rate of
climb exceedances or what prompted turns below VY.

For NCC operations, individual owners and operators must conduct an

appropriate level of ongoing operational oversight. G-VSKP’s operator’s
operations manual stipulated that surveyed landing sites, such as the King
Information
Factual

Power Stadium, should be ‘re-surveyed at intervals of not more than 12 months.’

The investigation found evidence that the site had been resurveyed by the pilot
within the preceding 12 months.

Pilots using the operator’s congested area permissions framework were

required to submit an after-flight report each time they operated into surveyed
sites. G-VSKP’s pilot had complied with this requirement.

Data from the CAA indicated that there were in excess of 780 helicopters78, of
many different types, in the UK onshore sector. Most of these were introduced
under legacy, rather than EASA, certification standards. Most helicopters
currently operating in the UK are not equipped with FDM systems. The diverse
nature and scope of onshore helicopter operations poses a challenge for the
development of FDM algorithms which rely on detecting operational parameters
that are outliers when compared with a ‘normal’ flight profile.

As part of their NCC oversight strategy the CAA had initiated a 4-year rolling
programme of operator audits in compliance with Part-ARO79 requirements for
the oversight of declared organisations.

1.18 Additional information

1.18.1 AW109 Cat A profile

A witness, with experience of flying Cat A profiles on both the AW169 and AW109
types, suggested to the investigation that the pilot’s greater familiarity with the
AW109 helicopter could explain the relatively high rate of climb seen during the
stadium departure. The equivalent Cat A profile for the AW109 required a climb
at 500±100 ft/min.

78 CAA presentation to the RAeS Onshore Helicopter Symposium, Hamilton Place, London, July 2019.
79 EASA Part-ARO - Authority for Air Operations. Available at https://www.easa.europa.eu/acceptable-
means-compliance-and-guidance-material-group/part-aro-authority-requirements-air (accessed
28 July 2023)

© Crown Copyright 2023 132 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.2 Reported drone sightings

Several witnesses came forward to report “drone” activity around the stadium
after the match.

Leicestershire Police operate a Small Unmanned Surveillance Aircraft (SUSA)

which is employed for crowd surveillance and intelligence gathering on match
days. The SUSA was airborne at the end of the match. Activity is coordinated
by a tactical controller located with the Silver Commander in the stadium’s
match-day operations room.

Information
Factual
All the witness reports of drone activity correlated with known police SUSA
operations after the end of the football match. The police aircraft was on the
ground when G-VSKP arrived into the stadium and its operations had finished
by the time the helicopter departed. There were no reported drone sightings
during the period that G-VSKP was airborne on the accident flight.

1.18.3 Research regarding pilot response to helicopter tail rotor emergencies

As part of a trial undertaken on behalf of the CAA and published in 199780,

pilot response time81 to tail rotor drive failures was measured during routine
training sorties with civil pilots in an Aérospatiale Super Puma simulator. The
failure was injected during level flight at 2,000 ft and the first cue available
to the pilots was yaw to the left of approximately 80⁰/s. This research was
considered relevant because the failure symptoms and the required pilot
response were similar to the accident circumstances. The study report does
not detail the terrain below the helicopter when the failure was injected. The
study defined ‘detection time’ as the time between the onset of the failure and
the initiation of a response using the collective lever. Yaw pedal response was
not reported. Data on detection time was collected from 35 pilots who were not
expecting the failure. It ranged from 0.58 s to 3.21 s and the mean was 1.53 s.
The study also collected ‘total reaction time’ which was defined as the time
between the initiation of the failure and the completion of lowering the collective.
Total reaction times ranged from 3.26 s to 8.26 s and the mean was 4.9 s.

80 Chappelow, J.W. and Smith, P.R. (1997). Pilot Intervention Times in Helicopter Emergencies: Final
report. PLSD/CHS/HS3/CR97020/1.0. DERA
81 The time taken to detect an event, identify what it is, decide on a response and execute that response.
In the case of this research, the time between the onset of the yaw which was the first symptom of the
failure and the time when the collective reached the minimum point.

© Crown Copyright 2023 133 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.4 Startle and surprise

Startle is a ‘brief, fast and highly physiological reaction to a sudden, intense or

threatening stimulus’82. A startle response occurs immediately in response to
a startling stimulus and can impair pilot responses for a short period of time,
usually between 0.3 and 1.5 s83.

Surprise is: ‘an emotional and cognitive response to unexpected events that
are (momentarily) difficult to explain, forcing a person to change his or her
understanding of the problem.’ Surprise often follows a startle response if the
Information
Factual

cause of the stimulus that triggered the startle is not understood. Experimental
studies looking at the effects of surprise on the flight deck have shown for
example, delayed initiation of responses84 and incorrect or incomplete
application of procedures85.

1.18.5 Critical Part

Critical parts are defined by CS 29.602 as:

‘A critical part is a part, the failure of which could have a catastrophic

effect upon the rotorcraft, and for which critical characteristics have
been identified which must be controlled to ensure the required
level of integrity.’

Critical parts are identified by the manufacturer through conducting a Preliminary

System Safety Assessment, typically using Functional Hazard Analysis (FHA)
and Failure Modes and Effects Analysis (FMEA) techniques. These techniques
attempt to anticipate all the ways in which a system may fail in operation, the
probability of failure occurrence and the severity of the effect of the failure.
Catastrophic failure for the TRA was defined in the FMEA as resulting in the loss
of the helicopter, the death of multiple occupants or the death or incapacitation
of the flight crew. The current definition in CS AMC 29.1309 is any failure that
prevents the continued safe flight and landing of the rotorcraft.

82 Landman, A., Groen, E.L., van Passen, M.M. Bronkhorst, A. & Mulder, M. (2017) ‘Dealing with
unexpected events on the flight deck: A conceptual model of startle and surprise’ in Human Factors, Vol
59 pp 1161-1172.
83 Martin, W., Murray, P. & Bates, P. (2012) ‘The effects of startle of pilots during critical events: a case
study analysis’ Proceedings of 30th EAPP Conference: Aviation Psychology & Applied Human Factors –
working towards zero accidents.
84 Martin, W.L., ‘ Murray, P.S., Bates, P.R., & Lee, P.S. (2016) ‘A flight simulator study of the impairment
effects of startle on pilots during unexpected critical events.’ Aviation Psychology and Applied Human
Factors, Vol 6, pp24-32
85 Casner, S.M., Geven, R.W. & Williams, K.T. (2013) ‘the effectiveness of airline pilot training for abnormal
events.’ Human Factors, Vol 55, pp-477-485.

© Crown Copyright 2023 134 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.6 Rolling Contact Fatigue (RCF)86

RCF is a type of surface damage that results from repeated rolling or rolling
and sliding contact between curved surfaces, typically the race and ball in a
bearing. RCF can be considered comparable to conventional material fatigue
to the extent that it results from alternating stress action, in the case of bearings
this is referred to as contact or Hertz87 stress. Contact stress comes from the
forces acting on the rolling elements of the bearing pushing them onto the
race surface. This results in an area of material conformity (deformation), which
creates a small contact area or ‘footprint’ to produce a contact pressure on

Information
the race. For deep groove ball bearings this contact area is typically an ellipse

Factual
shape.

Over the lifetime of the bearing RCF will result in cracks forming in the race
material, which then propagate and due to repeated contact stress will result in
material loss.

This is typically characterised by cracks which initiate in a region of higher

stress at a subsurface level and grow upwards towards the surface (Figure 91).

Bearings operating with adequate lubrication, a correct operating temperature,

a suitable load level and contact points with pure rolling motion (rather than
sliding) will eventually fail due to RCF given enough time. The life of a rolling
bearing is defined as the number of revolutions the bearing can perform before
incipient macropitting (material loss) occurs. The life is referred to as the L10
life, because it is a statistical prediction that gives a 90% reliability that similar
bearings will achieve the same number of revolutions given the same operating
conditions. However, RCF can also result in the premature failure of the bearing
under less than optimum conditions.

Macropitting is macroscale damage often described as pitting, initial pitting,

destructive pitting, flaking, spalling, scabbing and fatigue wear. It results from
the subsurface growth of fatigue cracks, which may have a surface or subsurface
origin and have a distinctive appearance. Fully developed macropits (with a
diameter much larger than their depth) show discrete walls and a floor that
intersects the surface at a steep or shallow angle depending on whether they
initiate at the surface (shallow ≤30°) or subsurface (steep ≥40°) (Figure 92).

86 This section includes paraphrased and condensed extracts and figures 90 and 91 from the publication
‘Rolling Contact Fatigue – Review and Case study’ by Dr N Symonds. British Crown Copyright 2004/
MOD.
87 The analytical method of determining the contact stresses for two non-conforming objects was
developed by Heinrich Hertz in 1882.

© Crown Copyright 2023 135 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 91
RCF, key features and divisions

Figure 92
Illustration of typical surface origin macropitting

The bearing races are also subject to forces acting in a plane which is parallel
to the race surface and perpendicular to the forces pushing the rolling elements
into the race. The stress generated in the race material by these forces is called
shear stress. The position of maximum shear stress is normally located just

© Crown Copyright 2023 136 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

below the surface at Hertzian depths. Sliding (rather than rolling) balls can
significantly alter the stress distribution in the surface and near-surface material
of a bearing race. As the tangential forces and thermal gradient caused by
friction from a sliding ball increase the magnitude of the alternating shear
stress, it moves nearer to the ball/race contact area causing premature crack
initiation to occur at the surface and the crack to extend downwards into the
material. Once surface macropitting has initiated, the bearing becomes noisy
and rough running. If allowed to continue to operate, catastrophic failure of the
bearing will follow.

Information
Factual
Maintaining adequate lubricant to prevent sliding is an important aspect of
avoiding premature failure.

In a rolling bearing, such as the tail rotor duplex bearing, the balls and bearing
races are nonconforming88. Consequently, the bearing load is concentrated
where the ball and race come into contact. Under these pressures the balls
and race elastically deform so that their surfaces conform to each other over
a very small area creating the conditions for elastohydrodynamic lubrication
(EHL). In a ceramic hybrid bearing, the extreme hardness of the ceramic balls
means they conform less than a conventional steel ball bearing, resulting in a
smaller contact area and higher contact pressures.

1.18.7 Grease lubrication89

Grease is formed from a base oil, mixed with a thickener. The grease used
in the tail rotor bearing is Aeroshell Grease 22, which is a clay-based grease
with a synthetic hydrocarbon base oil. Other additives can be used in grease
manufacture depending on the application, for example antioxidants, which
extend the life of the grease, and others to reduce operating friction and
improve load carrying. AeroShell Grease 22 is formulated and approved to
meet US Military specifications MIL PRF 81322G and MIL PRF 24508B. The
grease change process is strictly managed and the grease is subject to regular
performance review to maintain its Qualified Product Listing on the US Military
Approval Portal (QPD - Qualified Products Database (dla.mil)).

88 A nonconforming contact is one in which the shapes of the bodies are dissimilar so that under zero load
they only touch at a point.
89 Adapted from Grease Lubrication in Rolling Bearings – Piet M. Lugt. and the SKF Evolution magazine
article Grease lubrication mechanisms in rolling bearing systems (skf.com)

© Crown Copyright 2023 137 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Phases in grease lubrication

Grease lubrication is a dynamic process that can be divided approximately into

three phases.

The duplex bearing used in the tail rotor is fully filled at manufacture, so the
grease is located between the rolling elements. Once in operation, this leads
to high churning losses during start-up or running-in and can result in excess
grease being pushed past the bearing seals to form a grease ‘collar’ around the
Information

outside of the bearing face. During this phase, called the churning phase, the
Factual

grease will be pushed from the races into the unswept volume of the bearing
(onto the seals or the bearing race shoulders) or will end up attached to the
cage. This phase can last up to 24 hours of operation and is characterised
by higher friction, leading to increased operating temperatures and, as the
churning phase progresses, potentially some degradation of the lubricant which
is retained on the races.

In the second phase, known as the bleeding phase, the bearing reaches a
steady state, with the reservoirs of grease in these non-race locations slowly
providing the races with lubricant either by bleeding oil from the grease thickener
or by shear90. The lubricating films on the bearing races are governed by a
feed and loss mechanism in which they are fed by grease from the reservoirs
but also lose lubricant due to side flow from the contact between the ball and
the race and due to oxidation. This may lead to lubricant starvation, especially
in sealed bearings where the grease reservoirs are smaller. Another feed
mechanism is occasional replenishment caused by softening of the grease
close to the ball/race contact due to local heat development, resulting from
occasional film breakdown.

At some point, the reservoirs will be empty or deteriorated to the point that
replenishment can no longer happen. This is the final phase, resulting in severe
film breakdown, called the end of grease life, which subsequently leads to
bearing damage and failure.

Grease reservoir formation

The rate at which the reservoir formation will take place is governed by the flow
properties of the grease, also called its rheological properties. This will also
determine the physical degradation of the grease.

Lubricating grease shows visco-elastic behaviour, meaning that the viscosity

of the grease is a function of both shear and shear rate. The viscosity is very
high at low shear rates. This means that the resistance to flow will be very high

90 The mechanical action of two surfaces moving parallel to each other.

© Crown Copyright 2023 138 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

if the grease is not touched – ie when it is located in the unswept volume. This
is termed the consistency of the grease. During the churning phase the grease
may lose some of its consistency. The extent to which this occurs is called the
mechanical stability of the grease.

The viscosity of lubricating grease is so high at very low shear rates that only
creep flow will occur, and the grease has an apparently solid behaviour. The
opposite of this is shear thinning, which is when the grease viscosity decreases
substantially with increasing rates of shear.

Information
Factual
At very high shear rates the grease viscosity may approach the base oil
viscosity. Such high shear rates occur in the lubricating films between rolling
elements and races. Together with oil bleeding, this is the reason why the film
thickness in grease-lubricated bearings is usually calculated using the base oil
viscosity (ηoil).

Film thickness

A lubricating grease will only provide a long bearing service life if a sufficiently
thick film is developed, separating the rolling elements (balls) from the races.
Both base oil and thickener are known to enter the bearing race. The lubricating
film thickness in grease-lubricated bearings is determined by boundary layers
formed by thickener material (hR) and by the hydrodynamic action of the base
oil (hEHL) (elastohydrodynamic lubrication). The film thickness (hT) is therefore:

hT = hR + hEHL

Grease-lubricated bearings often run under so-called starved lubrication

conditions where only very thin layers of oil are available and where the film
thickness is primarily a function of the thickness of these oil layers. The change
in thickness of these layers is caused by the difference between the feed and
loss flow rates of lubricant into or out of the raceways. The oil on the race
rolling surface is lost due to the transverse flow caused by the high contact
pressure between the balls and the race. Some replenishment may take place
by creep flow and oil bleeding but this will be a very slow process. Shear from
the relative rotation of the cage and race and drag due to the balls spinning as
well as rolling, will probably have a greater effect in drawing in fresh grease
from the reservoirs. At higher temperatures oxidation and evaporation will also
have an impact on the film thickness resulting in lubricant being lost. Higher
temperatures will also change the viscosity and lubricity of the grease.

© Crown Copyright 2023 139 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Dynamic behaviour

Starved lubrication will cause a decrease in film thickness that will proceed
until the bearing is no longer properly lubricated. Temporary collapses of the
lubricant film layer result in direct contact between the ball and race, causing
bearing damage.

These are referred to as ‘events’ and are identified by a rise in temperature.

They do not follow a regular or predictable pattern and can vary in duration.
Information

The film thickness will subsequently increase again, often as a result of the
Factual

heat generated softening the surrounding grease and allowing it to flow. This
results in sufficient lubrication and a reduction in temperature until the next
event takes place. This sequence may occur a number of times, depending on
the ability of the grease to recover following an event, which is a function of the
ability of the grease to maintain its fluidity. Where the outer ring of the bearing
rotates, this can also have a detrimental effect on the grease by resulting in
higher temperatures, increased grease flow and accelerated oil bleeding.

Grease life

Grease life is defined by the point in time where the grease can no longer
lubricate the bearing and is indicated by a permanent rise in operating
temperature. This time may be very long and therefore difficult to measure in a
bearing test rig. To accelerate such a test, the outer ring of the test bearing is
heated, which accelerates the ageing process and reduces the viscosity of the
grease. Grease life is also affected by the rotational speed of the cage. For
the same bearing rotational speed, outer ring rotation causes a higher cage
rotational speed, than inner ring rotation.

Effect of load on Grease Life

Bearing load shortens grease life more than would be expected based on EHL
film thickness theory alone. Where varying loads occur, bearing manufacturers
will often use penalty factors for higher loads to reduce the expected grease life
compared to constant low load applications. The effect of load also increases
with increased bearing speed. The magnitude of bearing load has a small effect
on fully flooded lubricant film thickness, but has a large effect on starvation rate,
contact size, grease degradation and damage during starvation events.

Safe operating temperature

Lubricating greases are developed to operate in a limited temperature

window. The maximum temperature, called the high temperature limit (HTL),
is determined from the dropping point when the grease loses its structure

© Crown Copyright 2023 140 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

irreversibly. The safe maximum temperature is lower and is called the high
temperature performance limit (HTPL); for safety reasons the HTPL is reduced
by 15-20°C.

The low temperature limit (LTL) is determined by the temperature at which the
grease will enable the bearing to start up without difficulty. It is usually measured
by a start-up torque test. The safe minimum temperature therefore is higher and
is called the low temperature performance limit (LTPL). In the zone between
these safe temperatures the grease life is a function of temperature where,

Information
as a rule of thumb, grease life halves with every 15°C temperature increase.

Factual
AeroShell Grease 22, has a useful operating range of -54°C to +177°C.

Grease life models

Various models exist that can be used to predict grease life. All models are
empirical, based on grease life tests. Grease life is defined as the grease
L10 life; the time at which 10% of a large population of bearings have failed. For
sealed bearings such as the tail rotor bearing, under normal circumstances, the
grease life would be expected to be higher than the service life of the bearing.

Ageing

Both the mechanical and chemical properties of the grease will change while
the grease is exposed to milling and oxidation in the bearing. The type of
degradation depends on the operating conditions: physical ageing dominates
at lower temperatures and higher speeds, whereas chemical ageing dominates
at high temperatures. Physical ageing results in a change to the grease’s
rheological properties, which results in leakage, reduced bleeding properties
and a reduction in its ability to replenish the contact area between the balls and
the race. Chemical ageing is primarily caused by oxidation.

Antioxidants slow this process but when these are consumed, oxidation leads
to a loss of lubricant. Oxidation results in the formation of volatile products
within the grease which then evaporate resulting in the formation of a lacquer
which no longer lubricates the bearing.

Choice of grease

Grease manufacturers provide a specification for the different types of grease

that they produce. The selection of a specific grease for a specific bearing
application is done by the bearing and helicopter manufacturers in parallel. The
grease manufacturer is typically not involved in this process beyond providing
guidance on the general suitability of their products to different applications. For
the tail rotor duplex bearing the choice of AeroShell 22 grease was primarily

© Crown Copyright 2023 141 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

made by the helicopter manufacturer, who had extensive experience of using

it in other bearing applications across their range of helicopters. The suitability
of the grease was confirmed by the bearing manufacturer, based on their
assessment of the load spectrum provided by the helicopter manufacturer.

1.18.8 Dark Etched Region

During destructive examination of the various bearings under investigation,

sections of the bearing were subjected to a standard metallurgy technique of
polishing and chemical etching to reveal features within the microstructure of
Information
Factual

the steel. The Dark Etched Region (DER) was identified after using Vilella’s
reagent on the bearing sections. It is a recognised feature in metallurgy,
indicative of microstructural change as a result of the cyclic passage of the
balls over the surface of the bearing. It is most heavily concentrated at a
depth corresponding to the maximum shear stress and consists of a ferritic
phase91 containing non-uniformly distributed excess carbon content. It was also
identified in this failure mode as being a precursor to the appearance of cracks
on the bearing surface due to rolling contact fatigue.

1.18.9 Avionics simulator – yaw rate effects

The helicopter manufacturer has an avionics test bed. This replicates the
interconnected avionic systems from the helicopter.

It allows the evaluation of how the systems react to different conditions. This
was used to verify how the helicopter avionic systems reacted to an invalid yaw
rate.

The ADAHRS units supply the FCC channels with yaw rate data, amongst
many other parameters. The data bus can only represent yaw rates between
-128°/s and 128°/s. Outside of this range the data on the bus is flagged as
invalid. The effects of this were explored using the avionics simulator.

The start condition for the test was both autopilots engaged in attitude mode,
with no warnings or cautions. Invalid yaw rate data was simulated for the output
of the ADAHRUs. This resulted in the AP1 and AP2 switch lights on the AFCS
control panel extinguishing and an aural “autopilot autopilot” message in
the headset, repeated twice. The Crew Alerting System showed three amber
caution messages: ‘1-2 ap off’, ‘ap ahrs1 fail’ and ap ahrs 2 fail’. The
autopilot indications on the PFD switched from ATT92 to green boxes. The other
attitude and air data related indications, originating from the ADAHRUs, were
unaffected.

91 Ferrite is a body centred cubic structure phase of iron which exists below temperatures of 912°C.
92 ‘Attitude hold’ autopilot mode.

© Crown Copyright 2023 142 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.10 Flight mechanics simulation

The helicopter manufacturer developed models that relate control inputs to

resultant aircraft orientation and motion.

The manufacturer had determined, through modelling and testing, that the
bearing failure would result in the tail rotor actuator moving to its full extent in
the same direction and with the same speed as was active when the control
input became disconnected. This fault was injected into various simulation
models with different actuator speeds to establish when the resultant modelled

Information
behaviour best matched the recorded motion of the accident flight. There were

Factual
limitations to this process, including the accuracy of the derived yaw rates from
the flight data and the validity of the modelling outside of the certified envelope.
Of the fault profiles tested, the accident was best replicated, particularly
during the initial period following failure of the bearing, with the actuator taking
2.5 seconds to drive the tail rotor to -10° of pitch.

1.18.11 Vibration monitoring of the duplex bearing

The manufacturer determined that the current TVM sensor set would not assist
in vibration monitoring of the duplex bearing. They carried out rig tests to
establish a method for integrating the monitoring of the duplex bearing into the
vibration health monitoring system.

For an effective system, the location of the accelerometer must be subject to

vibration from the failing component. The algorithms applied to the sensor
data must also be properly configured to detect the changes in vibration
characteristics. Rig testing of the tail rotor systems was carried out to evaluate
different locations for the sensor and the benefit of different algorithms.

Figure 93 shows some of the accelerometer locations evaluated on a test rig.

The rig was run with a normal bearing, a bearing with no grease and a damaged
bearing. The signals acquired at sensors located at both ends of the rod were
similar. Signals acquired on the lever, shown as A05 and A06 (Figure 93),
retained a similar vibration pattern.

© Crown Copyright 2023 143 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398
Information
Factual

Figure 93
Sensor location testing.
(The actuator is approximately upside down compared to
the helicopter mounted orientation)

The Health Indicator algorithms were applied to the gathered data. The most
reactive to the degradation were linked to low frequency energy, though others
also detected issues. It was decided that all their standard bearing Health
Indicators would be used on the helicopter, coupled to a new sensor on the
lever in the A06 location (Figure 94). Field experience would determine which
are the most effective Health Indicators in practice.

Figure 94
Simple schematic of the new accelerometer location relative to
the duplex bearing of interest

© Crown Copyright 2023 144 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Information
Factual

Figure 95
Extracts from manufacturer’s modification document SB 169-140
(Image courtesy of the manufacturer)

© Crown Copyright 2023 145 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Safety action

The helicopter manufacturer issued a letter to the AW169 customers and

operators, reference PSE/2019/0373, dated 16 July 2019 and Service Bulletin.
N˚169-140, dated 30 July 2019. The letter described recent enhancements of
the HUMS ’dedicated to the monitoring of the Tail Rotor (TR) Duplex Bearing
area.’

These detail the relocation of an accelerometer to the TR actuator lever assembly

feeding into the onboard vibration monitoring systems (Figure 95). The change
Information
Factual

is on production aircraft and available for retrofit through the Service Bulletin.

The systems were put in place for transferring the new data to Heliwise and
the manufacturer is providing a free of charge data analysis service for this
new data. The letter stated that ’Customers and Operators are strongly
recommended to regularly upload HUMS data on the servers to ensure a timely
and effective trend monitoring.’

1.18.12 Previous accidents

LN-OJF

On 29 April 2016, the main rotor of an Airbus Helicopters EC 225 LP Super

Puma, registration LN-OJF, detached in-flight. The helicopter was transporting
oil workers and was enroute from the Gullfaks B platform in the North Sea to
Bergen Airport in Norway.

The subsequent investigation by the Norwegian Safety Investigation Authority

(NSIA)93 revealed that the accident was a result of a fatigue fracture in one
of the eight second stage planet gears in the epicyclic module of the main
rotor gearbox (MGB). The fatigue fracture initiated from a surface micro-pit in
the upper outer race of the bearing, propagating subsurface while producing a
limited quantity of particles from spalling, before turning towards the gear teeth
and fracturing the rim of the gear without being detected.

The investigation found that the combination of material properties, surface

treatment, design, operational loading environment and debris gave rise to a
failure mode which was not previously anticipated or assessed.

The design of the EC 225 LP satisfied the requirements in place at the time
of certification in 2004. However, the NSIA found weaknesses in the EASA
Certification Specifications for Large Helicopters (CS 29).
93 Report on the air accident near Turøy, Øygarden municipality, Hordaland county, Norway 29 April 2016
with Airbus Helicopters EC 225 LP, LN-OJF, operated by CHC Helikopter Service AS | nsia (accessed
28 July 2023)

© Crown Copyright 2023 146 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The accident had clear similarities to an Airbus Helicopters AS 332 L2 Super

Puma accident off the coast of Scotland in 2009 (G-REDL)94. This accident
was investigated by the AAIB and was also identified to be the result of fatigue
fracture in a second stage planet gear; however, the post-investigation actions
were not sufficient to prevent another main rotor loss.

The NSIA investigation into the LN-OJF accident found that only a few second
stage planet gears ever reached their intended operational time before being
rejected during overhaul inspections or non-scheduled MGB removals. The
parts rejected against predefined maintenance criteria were not routinely

Information
Factual
examined and analysed by the helicopter manufacturer in order to understand
the full nature of any damage and its effect on continued airworthiness. The
NSIA made the following recommendation:

‘Safety recommendation SL No. 2018/08T

The Accident Investigation Board Norway recommends that the European

Aviation Safety Agency (EASA) review and improve the existing provisions and
procedures applicable to critical parts on helicopters in order to ensure design
assumptions are correct throughout its service life.’

B-MHJ

B-MHJ95 was an AgustaWestland AW139 that ditched at Victoria Harbour, Hong

Kong on 3 July 2010. The accident occurred because the tail rotor assembly
detached from the helicopter. This happened shortly after takeoff when the
helicopter was climbing over water at approximately 350 ft AMSL and 70 kt. It
was a two-pilot operation. The initial symptoms of the failure were ‘a loud bang
from the rear of the helicopter’ and ‘airframe vibrations’ along with a loss of
authority of the yaw pedals. The report states that the commander ‘immediately’
put the helicopter into autorotation and the outcome was a controlled ditching.
All occupants survived. The total time between the first symptoms of the failure
and the touchdown was 16 seconds.

94 https://www.gov.uk/aaib-reports/2-2011-aerospatiale-eurocopter-as332-l2-super-puma-g-redl-1-
april-2009 (accessed 28 July 2023)
95 Hong Kong Special Administrative Region Civil Aviation Department (2014). Report on the accident
to AgustaWestland AW139 Registration B-MHJ operated by East Asia Airlines Limited at Hong Kong
Victoria Harbour on 3 July 2010. https://www.cad.gov.hk/reports/B-MHJ%20Accident%20Final%20
Report_2%20June%202014_Consolidated.pdf [Accessed on 28 July 2023]

© Crown Copyright 2023 147 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

PR-SEK

PR-SEK96 was an AW139 that crashed in the Campos Basin in Brazil on

19 August 2011 due to the tail rotor assembly detaching from the helicopter.

The failure occurred when the helicopter was in a stabilised climb over water
with the autopilot engaged at 130 kt. It was a two-pilot operation. The initial
symptoms of the failure were abnormal noise and ‘abrupt’ yaw to the right
and roll to the left. For the purpose of determining response time, this was
Information

assumed to be the point in time when the pilots were first alerted to a problem97.
Factual

The failure resulted in significant lateral and longitudinal accelerations. The

autopilot responded initially with a left pedal input to oppose the yaw and the
pilot made cyclic control inputs and began to lower the collective 1.2 – 1.7 s
after the first symptoms of the failure. This initial movement of the collective
was then reversed, and the pilot began to lower the collective again about
4.5 to 5 s after the first symptoms of the failure, completing the input about
5 to 5.5 s after the onset of the failure. The pilot achieved zero yaw rate and
a stabilised autorotation, but the helicopter became uncontrollable due to the
loss of both hydraulic systems and crashed into the sea. All occupants suffered
fatal injuries.

G-WNSR

G-WNSR98 was a Sikorsky S-92A that suffered uncommanded yaw twice

due to a failure of the tail rotor pitch change shaft bearing during a flight on
28 December 2016 from Aberdeen to several offshore installations. The first
time was during lift-off from an offshore installation. As the helicopter lifted, it
yawed unexpectedly to the right and the pilot immediately started increasing
the left pedal input to oppose the developing yaw. Full pedal was reached after
about three seconds. After a further two seconds, about five seconds after
the uncommanded yaw began, the pilot began to lower the collective. The
second occasion was during landing at another installation and the response
in terms of starting the lower the collective was faster (about 1.5 s after the
uncommanded yaw began).

Appendix C summarises this information from previous events alongside the

research findings discussed above.

96 Centro de Investigação e Prevenção de Acidentes Aeronáuticos (CENIPA) 2015, Final report

A-546/CENIPA/2015. http://sistema.cenipa.aer.mil.br/cenipa/paginas/relatorios/rf/en/RF_A-
546CENIPA2015_PR-SEK_-_English_Final.pdf?fbclid=IwAR3T-enQCNRc5nucpMuNO1hwHZU_
yU6sLUNM2aNJdNi47js4WXXOeQfpGtY [Accessed on 7 January 2021)
97 Reported in Table a on page 10 of the report as 19:48:05. All other times highlighted here were
measured from this point on Figure 1 of the CENIPA report on page 12. The sample rate for collective
position is 0.5 s.
98 Aircraft Accident Report AAR 1/2018 - G-WNSR, 28 December 2016 - GOV.UK (www.gov.uk) (accessed
29 July 2023)

© Crown Copyright 2023 148 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.13 Rule Making Tasks (RMT) 128 and 712

As a result of the recommendations from the LN-OJF investigation and other

associated safety investigations, EASA initiated rulemaking task 128 to consider
changes to CS 27 and CS 29. RMT 712 was initiated to improve and modernise
the regulations relating to safety assessment of systems and to harmonise with
proposed changes to the FAA regulations.

In February 2022, EASA issued Notice of Proposed Amendment (NPA)

2022-01. This proposed several amendments to CS-27 and CS-29, including

Information
changes to CS 29.602 which addresses critical parts. The proposed new text

Factual
amended ‘shall’ to ‘must’ for paragraph b and introduced the concept of a
Continued Integrity Verification Programme (CIVP). The NPA also proposed
the introduction of a new Acceptable Means of Compliance (AMC) guidance
for CS 29.602.

The NPA also contained the proposed amendment to CS 29 introducing an

AMC for CS 29.571 Fatigue evaluation of flight structure, which introduced
consideration of rolling contact fatigue in the design of rotor drive systems.

It also proposed changes to the AMC for CS 29.1309 to increase the focus
on detecting errors in the development process. Further changes were
subsequently introduced to the CS 29.1309 regulation text. These removed
specific requirements relating to how the safety assessment must be carried
out, but also introduced the requirement for no catastrophic failures from a
single cause.

The full text extracts of the NPA relating to these changes can be found in
Appendix G.

Comment Response Document (CRD) 2022-01 was issued in February 2023

detailing the comments received in response to NPA 2022/01 and documenting
EASA’s decision whether to accept or reject them. As a result of these
comments, EASA decided to withdraw the proposed changes to CS 29.602,
stating it required further review with stakeholders.

The remaining changes were introduced into Amendment 11 of CS-29 issued in

Feb 2023. The final wording of the relevant extracts is included in Appendix I.

© Crown Copyright 2023 149 Section 1 - Factual information

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

1.18.14 Certification Specifications for Engines (CS-E)

The EASA design requirements relating to engines are contained within a

dedicated set of Certification Specifications referred to as CS-E.

Turbine engines have several components whose failure is assessed as

resulting in a hazardous engine effect, which qualifies them as critical parts99.
However, as these components are not Principal Structural Elements their
assessment, testing and the control of fatigue life, resulting in a hard life limit on
the aircraft, is addressed by regulation CS-E.515 - Engine Critical Parts. The
Information
Factual

full wording of CS-E 515 is contained in Appendix F of this report. The life limit
of these components is classed as an airworthiness limitation and is contained
in the Airworthiness Limitations Section (ALS) of the instructions for continued
airworthiness for the aircraft on which the engine is installed.

99 See section 1.18.5 for the equivalent CS 29 definition of critical parts.

© Crown Copyright 2023 150 Section 1 - Factual information

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

2 Analysis

2.1 General

The helicopter was compliant with all applicable airworthiness requirements,

had been correctly maintained and was appropriately certified for release to
service prior to the accident flight.

After taking off from the King Power Stadium, while climbing through a height of
approximately 250 ft, the helicopter pitched nose-down and, shortly afterwards,
entered a gentle right turn in response to the pilot’s control inputs. Moments
after the helicopter became established in the turn, a divergent and accelerating
uncontrollable right yaw rate developed. As the yaw rate increased it induced
uncommanded pitch and roll deviations and rendered directional control of the
helicopter’s flight path impossible.

The physical evidence recovered from the accident site confirmed that the loss
of yaw control of the helicopter resulted from failures in the tail rotor control

Analysis
system, which physically disconnected it from the pilot’s control inputs on
the yaw pedals. The subsequent rotation of the helicopter was driven by the
unopposed torque couple from the main rotor combined with the additional
thrust from the tail rotor as its blades moved unrestricted to their physical limit
of travel, resulting in a negative blade pitch angle. This sequence of events
was initiated by the seizure of the tail rotor duplex bearing.

2.2 Helicopter operation

G-VSKP was a corporately owned helicopter which was operating under a

third-party operator’s Part-NCC declaration to the CAA. The operator was
compliant with the requirements of Part-NCC and its associated regulations.
Under Part-NCC regulations G-VSKP was not required to be equipped with an
active FDM system. Operations into the LCFC training ground and the King
Power Stadium were conducted under the auspices of the operator’s delegated
congested area permission issued by the CAA.

The accident pilot was an independent contractor providing pilot services to the
owner. At the time of the accident, he held a valid ATPL(H), was a current TRI
on the AW169 and was the pilot in command of G-VSKP.

While not yet a qualified helicopter pilot, the front seat passenger was
commercially licensed to fly fixed wing aircraft. She was familiar with G-VSKP
and had previously flown it under the supervision of the accident pilot.

© Crown Copyright 2023 151 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Prior to the flight the pilot appeared to be in good spirits and had been witnessed
carrying out flight planning for the accident flight while at the stadium.

The investigation did not find any operational causes for the accident.

2.3 Stadium departure

Permission to operate into the King Power Stadium was conditional on the
use of Cat A flight profiles to mitigate against the risk of engine failure. The
pilot was required to follow the Ground and Elevated Heliport/Helideck Variable
TDP Procedure as specified in the AW169 RFM. This required a maximum
300 ft/min rate of climb and was designed to assure safe performance margins
should one engine fail at a critical stage in the departure.

While the investigation was not able to determine the actual TDP height used
on the accident flight, the helicopter was above an appropriate height of 215 ft
when the pilot lowered its nose and committed to a CTO.
Analysis

The accident flight departure differed from the published RFM Cat A profile to
the following extent:

● The rate of climb during the rearward climb exceeded 300 ft/min.

● The helicopter’s landing gear was raised at a speed below VY.

While the accident flight departure was flown at a higher rate of climb than
specified in the AW169 RFM, simulator trials indicated that the consequent
additional main rotor torque did not significantly influence the post-failure
controllability of the helicopter.

Had the helicopter suffered an engine failure below 215 ft, a controlled landing
back into the stadium may not have been assured.

Cockpit voice recording revealed that the pilot had asked the front seat
passenger to select the landing gear up, indicating that he did not take his
hand off the collective lever to do so himself. The call to raise the landing
gear came after the pilot had committed to the CTO. The investigation did not
consider raising the helicopter’s landing gear before reaching climb speed to
be a contributory factor in the accident or in its survivability.

The performance analysis for the stadium operation, derived from RFM
performance tables, assumed an 85 ft height loss during the transition to a
climb following an engine failure above TDP. While not explicitly prohibited
by the RFM Cat A procedure profile, a turn commenced below VY could have
affected obstacle clearance during a single engine CTO.

© Crown Copyright 2023 152 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

G-VSKP entered a low angle of bank turn (approximately 10-15°) while still
below VY but approximately 85 ft above TDP and 170 ft above the 130 ft
minimum obstacle clearance height for the departure. In a 15° angle of bank
turn the vertical component of the helicopter’s main rotor thrust would have
been reduced by approximately 3-4%1.

While recognising that entering a turn below VY was outwith the manufacturer’s
guidance for the Cat A procedure being flown, given the low angle of bank
and additional obstacle clearance margin at entry to the turn, the investigation
considered that it did not compromise the safety of the helicopter while both
engines were operating normally. It was also determined that, given the
helicopter’s height at turn entry and assuming the pilot would have rolled out
of the turn to maximise the vertical component of rotor thrust if an engine had
subsequently failed, the required obstacle clearance margin would likely still
have been achieved.

In this specific case the recorded data showed the tail rotor failure sequence

Analysis
was precipitated by the pedal input initiating the turn. However, pedal inputs
during this phase of flight are common and could have been made for any other
potential reason, for example to compensate for a variable crosswind.

As such, the investigation concluded that the pilot choosing to enter a turn
below VY was not of itself a factor in the accident.

Based on the evidence available, it was not possible to determine why the
departure differed from the RFM procedure. A witness suggested that the rate
of climb exceedance could have been due to the pilot’s greater familiarity with
the AW109 Cat A departure profile, but the investigation could not objectively
establish if this was the case.

2.4 Emergency handling

Emergency procedure

Due to there being no certification requirement, the AW169 RFM did not contain
guidance for the specific tail rotor pitch control runaway failure experienced by
G-VSKP. The LTE drill contained within the RFM details two scenarios, ‘in the
hover’ and ‘in forward flight.’ G-VSKP was climbing in a dynamic transition from
rearward to forward flight and had entered a turn at the time of failure. Training
scenarios for various malfunctions were available in the simulator but there were
none that related directly to this failure mode. The AW169 type rating course
was not required to include training for failures involving tail rotor pitch control
runaway. Without a specific drill for the encountered failure, applying the LTE
1 Vertical component of thrust in a 15° banked turn derived by Cos(15°) = 0.9659 = 96.59% of the total
main rotor thrust.

© Crown Copyright 2023 153 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

emergency procedure would have been an appropriate response by the pilot.

Shutting down the engines as part of the LTE drill would have removed the
engine-derived component of the de-stabilising torque, but not that component
generated by the tail rotor at maximum negative pitch. Given the rate at which
the yaw divergence developed, the dynamic and disorientating behaviour
of the helicopter, and the limited time and height available, the investigation
considered it was not unreasonable for the pilot to concentrate on flying the
helicopter rather than diverting his attention inside in an attempt to locate and
operate the engine rotary controls.

Pilot response time

A pilot can only begin to take action when they have recognised the need to
act and identified an appropriate emergency procedure to follow. As discussed
above, the pilot performed the most appropriate actions available.

The accident pilot reacted to the uncommanded yaw in less than one second
Analysis

by attempting to oppose it with the pedals. The next action, lowering the
collective, was initiated about five seconds after full left pedal was applied and
was completed over the course of about two seconds. The point when full left
pedal was applied and had no effect was considered to be the moment that the
pilot could definitely recognise the need to take additional action.

Data from previous tail-rotor failure accidents shows that pilots immediately
reacted to the uncommanded yaw using the pedals. Data from these accidents
and from research show that the next action of lowering the collective is more
variable. In the B-MHJ and PR-SEK accidents the pilots faced no obstructions
in their landing area and in the G-WNSR event the helicopter had only just lifted
off so lowering the collective was probably a clear course of action. This would
likely have helped the pilots to act quickly in comparison to being faced with an
ambiguous situation.

When the failure occurred in this accident, the helicopter was above, or close
to being above, the stadium roof. In that position, with the heading and pitch
angle that the helicopter had at the time, the pilot would have had a view of
the stadium roof. This was an imposing structure with substantial vertical
supports above the main roof line. It is possible that the pilot decided to wait
before lowering the collective in an effort to avoid descending onto the stadium
structure.

© Crown Copyright 2023 154 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

If the pilot did not decide to wait, a combination of adverse performance shaping
factors was present which may have had the effect of lengthening his response
time:

● Startle in response to the unexpected and dramatic

uncommanded yaw.

● Surprise and confusion indicated by the pilot’s comment “i’ve

no idea what’s going on". The symptoms of the failure
in that phase of flight had never been experienced by him
before.

● Disorientation due to the effects of the rapid yawing, pitching

and rolling of the helicopter on his visual and vestibular
sensory organs.

There are no sources of evidence to tell the investigation more about the
accident pilot’s thought processes or capability to respond in that moment.

Analysis
Taking everything into account, the G-VSKP pilot’s response was considered
to be within the range expected given the circumstances. A similar amount of
time could be required for any pilot to initiate the appropriate response but a
lengthy response results in more instability and even more challenge for a pilot.
Training and procedures can improve response times, but they will always be
vulnerable to performance shaping factors like startle. Given the large variation
of pilot response times, rapid pilot response should not be relied on when
assessing risks and designing procedures associated with such failures.

Post-failure controllability

Lowering the collective after the failure reduced the de-stabilising main rotor
torque but also had the effect of reducing lift from the rotor blades and the
helicopter began to descend rapidly. With its tail rotor pitch at the full extent
of its travel, G-VSKP maintained a high residual yaw rate during the descent.

The simulator trials conducted at the helicopter manufacturer’s facilities showed

that the greater the time taken to lower the collective, the greater the peak
yaw rate and the magnitude of associated pitch and roll deviations. However,
regardless of how quickly the collective was lowered, it was not possible to
achieve effective directional control of the flightpath following a tail rotor pitch
runaway in simulated flight conditions representative of the accident.

The manufacturer also performed additional flight mechanics analysis where

computer generated control inputs designed to limit the pitch and roll motions
began immediately after the failure, the collective was lowered after 1.5 seconds
and the collective was raised at the best possible moment. The manufacturer

© Crown Copyright 2023 155 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

concluded that it was possible to limit yaw, pitch and roll motions, avoid the
disengagement of the AFCS and reduce the rate of descent at impact by
instantly applying optimal control inputs.

Whilst it may have been theoretically possible to achieve a more stable

attitude and lower rate of descent at impact with the ground, the simulator
trials and flight mechanics analysis were not valid representations of real pilot
performance in an unexpected and confusing failure situation. In the flight
mechanics analysis a 1.5 second interval was incorporated to simulate pilot
response time. As discussed above, the response times of line pilots in real
emergency situations can be expected to be variable and longer than those
used in the simulations. The pilot response times suggested in AC 29-2C are
for the purpose of standardisation during testing of AFCS systems and are not
a performance standard for pilots.

Immediately from the point of failure, the flight mechanics analysis was ‘flown’
by a computer model that does not replicate the limitations of real human
Analysis

performance in terms of ability to judge the magnitude and direction of the

helicopter’s motion and respond to it. Therefore, the model was able to make
optimal control inputs that are unlikely to be possible for a real pilot encountering
a situation for the first time. Similarly, the model was able to make iterative
calculations to judge the optimal moment to raise the collective which was not
possible for the accident pilot.

In the accident flight, after the failure but before the collective was lowered, the
helicopter was lifted away from the stadium roof on an off-vertical yawing axis.
No lateral motion information was included in the flight mechanics analysis, but
the control inputs presented would have provided less time for the helicopter to
move away from the roof and would likely have resulted in a descent axis that
was closer to vertical. Given the helicopter was likely above the stadium roof
at the point of the failure, in this theoretical scenario the helicopter may have
been more likely to collide with the roof structure or land closer to the stadium
where there were more people.

In the latter stages of the descent the accident pilot raised the collective to
cushion the impact. The investigation could not determine what cues were
available to the pilot, or find any documented guidance that might have helped
him assess when to begin raising the collective, or the degree to which this
reduced the rate of descent. The investigation did not determine to what extent
pitch, roll and yaw instability might have affected the pilot’s judgement of height
during the descent. Nonetheless, at night, in a highly unstable helicopter
which was yawing uncontrollably and descending rapidly in close proximity to
buildings, the pilot managed to cushion the descent sufficiently to render the
initial impact survivable for at least four of the five occupants.

© Crown Copyright 2023 156 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The investigation found that, in the prevailing circumstances, the loss of yaw
control was irrecoverable. Theoretical analysis presented by the manufacturer
suggests it may have been possible to maintain a more stable attitude and
achieve a lower rate of descent. However, this is not representative of real pilot
performance and would not necessarily have improved the outcome.

2.5 External operational factors

Meteorological

There were no observed adverse weather phenomena that would have affected
the departure and, on the observed climb heading, the crosswind component
was within limits for the departure.

Drone activity

None of the drone activity observed by witnesses in the vicinity of the stadium
occurred during the time when G-VSKP was airborne on the accident flight.

Analysis
The investigation found no evidence that drone activity was relevant to the
accident and evidence from the rest of the investigation was not consistent with
mid-air collision as a causal factor.

2.6 Accident flight recorded data

The recorded data did not indicate any system status problems before takeoff.

After the helicopter climbed out from the stadium a rapidly increasing yaw rate
developed, contrary to the pilot’s pedal inputs. The recorded data indicated
that the helicopter yaw rate reached 200°/s within approximately 7 seconds of
the helicopter failing to respond to yaw control inputs. The derived yaw rate
peaked at 209°/s. With this yaw rate, the longitudinal forces experienced by the
pilot would have been in excess of 3 g in the forward direction. The yaw rate
reduced to approximately 150°/s after the collective was lowered, but this still
far exceeded what might be experienced or considered controllable in routine
flight.

The helicopter behaviour was modelled by the manufacturer with different

failure scenarios based on the physical evidence. The modelled reactions to
disconnecting the tail rotor actuator arm and driving the rotor blade pitch to
-10° over 2.5 seconds correlated well with the recorded data. However, there
were limitations in both the recorded flight data and the modelling data. As
such, it was not possible to determine with certainty the maximum tail rotor
blade pitch achieved, given that the primary yaw stops were no longer effective
in limiting the range of movement.

© Crown Copyright 2023 157 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Prior to impact, the collective was pulled up, the rotor speed dropped and the
engine torques ramped up to compensate. This reduced the descent rate prior
to impact.

There was a period of approximately 14 seconds between the initial loss of tail
rotor control and the impact with the ground.

Alerts

‘ap ahrs1 fail’ and ‘ap ahrs 2 fail’ cautions were flagged during the accident
flight. The autopilot systems use motion data from the ADAHRS units. Within
approximately 4 seconds of the onset of the failure the yaw rate exceeded 128°/s,
the maximum yaw rate value that the ADAHRS units can send to the autopilots.
After this, the yaw rate data became invalid and the autopilots disconnected
and flagged cautions against the two ADAHRS. The disconnection of the
autopilot and ‘ap ahrs1(2) fail’ cautions are therefore not failures as such but
a functional system being exposed to yaw rates it was not designed to handle.
Analysis

Other warnings and cautions were issued. A ‘rotor low’ warning was
triggered as the rotor speed briefly dropped by more than the 2% allowable
with two engines running. With a nominal NR of 103%, the main rotor is rotating
at 348 rpm, nearly 2100°/s. The yaw rate of the helicopter itself peaked at
approximately 10% of this, which is an unusual control situation. The NR
reduction was minor and was quickly recovered. The collective was lowered
shortly after this.

Oil pressure alerts were generated for the main gearbox and engines. The
oil systems for each engine and the main gearbox are separate. The alerts
were likely triggered due to the effects of the yaw-rate-induced forces on the
oil distribution and sensing of each of the three oil systems. The gearbox and
engines did not fail.

The DAFR recorded a problem with ADAHRS1 for the last two seconds of flight.
The cause of this is not known. The NVM from the ADAHRU records internal
problems only. It did flag a failure, but time alignment indicated that it was likely
later, possibly at impact. The cause of the DAFR recorded failure is not known
and not considered relevant to the accident sequence.

2.7 Loss of tail rotor control

The accident sequence began with a deterioration over time of the duplex
bearing which connected the rotating tail rotor assembly with the non-rotating
tail rotor actuator control shaft. Eventually the bearing became so damaged
that the rotating outer race and the static inner race of the bearing became

© Crown Copyright 2023 158 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

seized. The tail rotor system is driven at high torque by the main helicopter
gearbox, which in turn is driven by the engines. When the bearing seized, the
torque from the tail rotor drive system was transmitted through the bearing to
the actuator control shaft, causing it to rotate at high speed.

Immediately prior to the control shaft starting to rotate, the pilot had applied an
input on the right yaw pedal. This resulted in the tail rotor actuator control shaft
starting to move to the right, pushing out the spider assembly which, via the
pitch link connection, reduced the tail rotor blade pitch.

The locking nut at the actuator end of the control shaft clamped the pin carrier
to the outer shaft of the hydraulic actuator, with the pin in the carrier providing
the pivoting connection to the control system linked to the pilot’s pedals. The
now rotating inner shaft had enough torque to break the locking wire and shear
the installed split pin on the nut. Continued axial movement of the control shaft
under hydraulic pressure maintained the contact pressure between the nut and
the pin carrier, allowing the threaded portion of the shaft to ‘unscrew’ completely

Analysis
from the nut2. In the process, friction heated the nut sufficiently for localized
melting to occur, effectively welding it to the pin carrier. Both the nut and pin
carrier were pushed off the end of the control shaft as it continued to move
(Figure 96).

Figure 96
Sequence of disconnection of the TRA control shaft from
the pilot’s controls

2 The rotation of the control shaft also resulted in the tightening of the locking nut at the bearing end,
leading to the high torque figure found during disassembly.

© Crown Copyright 2023 159 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The actuator lever mechanism is designed to act as mechanical feedback

for the hydraulic actuator, closing off hydraulic pressure once the movement
of the control shaft matches the pilot’s pedal input. As the lever was now
completely disconnected from the control shaft, the shaft continued to move
under hydraulic pressure without restriction. The primary control stops for the
yaw system, which normally limited the range of travel of the tail rotor blades,
were located on the pilot’s side of the disconnect and so become ineffective.
This allowed the control shaft to continue moving until it reached the full range
of travel physically possible for the blades. The result was an increasing rate of
right yaw, driven by the now unresisted main rotor torque couple and the torque
generated by the force from the negative pitch angle of the tail-rotor blades.

The pilot tried to apply a left yaw pedal input to stop the rotation but due to
the physical disconnection, had no possible means of controlling the tail rotor.
The pilot reduced the collective input to reduce the torque generated by the
main rotor; while this reduced the rate of rotation of the helicopter, it remained
uncontrollably high until impact.
Analysis

This sequence of events was verified during the subsequent tail rotor rig testing,
which demonstrated that the locking nut would ‘unscrew’ once the bearing
began to seize with an input load present on the control shaft.

2.8 Crashworthiness and survivability

Information provided by the helicopter manufacturer confirmed that the AW169,

including the cabin configuration installed in G-VSKP, met the emergency
landing and crashworthiness requirements of CS 29 Amendment 2 when the
helicopter type was certified.

The examination of the impact absorption mechanisms of the rear passenger

seats that were occupied on the accident flight found that they had operated
and reached the limit of their travel. This confirmed that the helicopter and its
occupants had been subjected to vertical deceleration forces greater than the
30g design limit of the seat impact absorption mechanisms.

The highly dynamic nature of the impact meant that it was not possible to
make a direct comparison between the requirements of CS 29 and the forces
experienced during the accident. However, the impact analysis calculations,
supported by the physical condition of the crashworthiness safety features
and fuselage structure, indicate that the impact forces probably exceeded the
design specifications of the helicopter.

Despite the magnitude of the impact forces, post-mortem examination showed

that four of the five occupants survived the initial impact. Their reported injuries

© Crown Copyright 2023 160 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

would, however, have prevented them from being able to escape from the
helicopter without external assistance, given the position in which it came to
rest.

The analysis also showed that the presence of the concrete step produced
localised crushing of the lower fuselage and structure supporting the fuel tank
bladders. The damage observed to the lower fuselage on the accident site
confirmed that elements of this damaged structure had penetrated the fuel tank
bladders.

Fire and rescue

The helicopter came to rest on its left side. The impact with the step had
resulted in the release of fuel which then pooled around the helicopter. Given
the final orientation of the helicopter and the damage it sustained during the
impact sequence, there would have been several potential ignition sources
including the engines, damaged navigation and anti-collision lights and other

Analysis
damaged electrical circuits. Evidence shows that the fire had already taken
hold when the first emergency services vehicle arrived on site, approximately
one minute after the impact. Statements from the police officers who were first
on the scene stated that the fire appeared to have progressed forward from the
rear of the helicopter.

With the helicopter resting on its side and the fire having taken hold, the
first responders were unable to reach the uppermost, right side to gain
access to either the cockpit or cabin. They attempted to gain access to the
cockpit by breaking the windscreen but as this was designed to withstand a
high-speed bird strike, it could not be broken with the equipment available
to them. Specialist equipment would have been needed to break or cut the
windscreen. The intensity of the fire increased rapidly preventing further
rescue attempts. The post-mortems confirmed that the surviving occupants
would have quickly succumbed to inhalation of the products of combustion.

The area in which the helicopter struck the ground was the only area close to the
stadium which did not contain people, cars or other structures. Given that the
pilot had no control over the horizontal trajectory of the helicopter, any change
in the timing of the loss of control or the pilot’s response could have resulted in
third party casualties and additional collateral damage on the ground.

© Crown Copyright 2023 161 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

2.9 Duplex Bearing failure

Accident bearing

Analysis of the findings from the detailed lab investigation of the accident
bearing (s/n 14126) confirmed that the inner and outer races of both sides of
the bearing had become damaged by Rolling Contact Fatigue (RCF).

The damage was most extreme on the inner race of the inboard side. The RCF
resulted in surface initiated crack growth and led to material loss on the rolling
surface of the race. This was likely to have resulted from a high shear stress at
the surface of the race material, as evidenced by the surface initiation, material
flow and Dark Etched Region (DER) evident on the sectioned races. Evidence
from the material analysis and lab work showed that significant heat was
generated by the increasing friction between the balls and the race, degrading
the grease further until it eventually became dry carbon powder and creating a
heat affected zone of changed material properties in the race material closest
Analysis

to the surface. The lack of lubrication then increased the amount of heat
generated and the rate at which damage accumulated on the race surfaces.

Whilst a small amount of grease was found around the slider adjacent to the
inner race seal, this was consistent with excess grease extruding from the
bearing in early operation and was also seen in other bearings removed from
service and used in rig tests. The inner race and inboard side seal were found
disturbed following removal from the wreckage. However, wear marks on the
inside surface of the seal showed that it had been in contact with the cage in
operation and it had likely been disturbed by movement of the inner race during
the process of extracting the bearing from the wreckage.

Analysis of the failed cages showed that the increasingly erratic rotation speed
of the individual balls around the race surfaces caused them to contact the
cage and transferred loads to the cage structure which it was not designed to
tolerate. This resulted in heavy wear around the cage pockets and subsequent
fatigue cracking and failure of the cage structure. Once the cage failed, the
now unrestrained balls were able to migrate across a larger area of the race
surface spreading the damage.

Inspection of the surface of the inner race showed that large sections of the
surface material had been released (macropitting) as crack growth increased.
This material had then been ground into powder by the action of the balls and
mixed with powdered copper, released from wear to the cage, and the powdered
carbon from the grease. The powder mix was then compressed back onto the
surface of the race by the contact pressure from the balls, creating a new rolling
surface.

© Crown Copyright 2023 162 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

RCF then restarted the process of crack growth on the much less homogenous
powder coated surface, resulting in larger sections of material being released
and re-laid. The profiling of the race surface showed that this created high spots
above the normal surface level. As the ceramic ball material was much harder
than the race material, their geometry had not been as significantly affected by
wear during this process. Eventually the clearance between the balls and the
inner and outer races was compromised by the material deposition process
and the bearing seized.

Bearings removed from service by continued airworthiness actions

The selection of bearings investigated after they had been removed from
service for failing the mandatory inspection Service Bulletin checks, showed
the chronological sequence of deterioration of the bearing in more detail.

Bearing s/n 14134 showed the early stages of RCF damage to the bearing
inboard inner race. The grease had deteriorated, due to temperature and

Analysis
mechanical ageing, from a moist lubricant to a tacky residue. Evidence of the
increased temperature was also observed in the presence of a zone of heat
induced material property change under the running surface of the bearing
race. Small crack features were developing on the race running surface,
demonstrating the initial phase of surface initiated cracking and material loss.
The location of the cracks was consistent with the location of highest contact
pressure and PV calculated by the bearing manufacturer’s simulation software.
The bearing cage was intact, limiting the area of damage on the race.

Whilst the service life of the bearing was appreciably more than the accident
bearing (1,117 hours vs 330 hours respectively), this was still short of the
discard life of the bearing (2,400 hours) and significantly less than the L10 life
(12,882 hours), suggesting that it was subject to a premature failure mechanism
rather than routine end of life RCF. This is supported by the surface initiation
of the cracks and presence of a DER close to the surface, both consistent with
the accident bearing, and when compared to more typical Hertzian subsurface
initiated cracking due to routine accumulated operating life.

Bearing s/n 15119 demonstrated a more advanced stage of deterioration. The

cracks had developed to the point of significant material loss leaving extensive
macropitting on the race surface. The cage was cracked and worn in the pockets
and a lip worn around the inner circumference of the inboard cage, indicating a
change from the intended smooth rolling mechanism of the balls and allowing
the cage to diverge from the normal running line of the balls on the race3. The
spalling on the ceramic balls from the outboard race suggests truncation had

3 A further example of this can be seen in the bearing used for the manufacturer’s rig test documented in
section 1.16.1.3.

© Crown Copyright 2023 163 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

taken place, this was supported by the wider arc of microstructure damage
seen on the outboard inner race. Truncation occurs when the balls migrate to
run on the corner of the race surface, significantly increasing the point contact
pressure on the balls. Spalling on the surface of the balls is the next stage
from traction cracking (crazing seen on the accident bearing), where material is
lost as a result of crack growth. The bearing races showed the same surface
initiated cracking, shallow DER and heat induced zone of material property
change as the previous bearings. The analysis of the race material showed
evidence of the balls sliding rather than rolling.

Bearing s/n 13123 displayed a level of damage to the bearing where significant
material loss had occurred as areas of macropitting joined together around the
surface of the races. The condition of the grease, which had turned to carbon
powder shows high temperatures had occurred in the bearing.

However, this bearing did not exhibit the DER below the race surface, indicating
that it had not experienced the same level of shear forces from the balls sliding
Analysis

rather than rolling, as with the other bearings inspected. The heavy wear in a
single cage pocket and the heavy spalling of a single ball relative to the others,
suggests this failure was more likely to have been caused by a problem with the
individual ball, possibly an inclusion as evidenced by the particle of iron oxide
reportedly found embedded in the ball material.

Whilst there was disagreement between the various lab analysis reports about
the cause of the spalling, the similarities to bearing s/n 17115, suggest the
mechanism may have been the same, although the inclusion in that case
was a different material and was closer to the surface, which accounts for the
difference in rate of progression of the bearing damage4.

While bearing s/n 14125 was not independently assessed, the physical evidence
recorded by the manufacturer demonstrated a similar level of degradation as
s/n 15119 and similar features to those seen on the accident bearing.

The grease had degraded until it became powder and the damage had
developed to the point of creating macropitting on the inner race surfaces. The
cage had failed in fatigue and was worn in the pockets and in a step around
the inner circumference of the wide end on one of the rows. This indicated a
change from the intended smooth rolling mechanism of the balls and allowed a
divergence from the normal running line of the balls on the race. The spalling
on the ceramic ball from the side of the bearing where the cage had been
displaced by wear from contact with the inner race, suggests this was caused
by truncation. Again supported by the wider arc of microstructure damage

4 This failure mode was dealt with separately to this investigation by the manufacturer and the EASA as a
continuing airworthiness issue.

© Crown Copyright 2023 164 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

seen on the inner race surface. The bearing races showed the same surface
initiated cracking, shallow DER and heat induced zone of material property
change as the other bearings. This evidence was consistent with high surface
shear forces resulting from the balls sliding rather than rolling.

2.9.1 Investigation-requested endurance rig test

The bearing (s/n 19189) did not exhibit any external evidence of distress during
the rig test run, such as triggering a temperature alert, and the results from the
detailed lab investigation of the bearing showed no evidence of surface level
fatigue damage. However, the grease condition was consistent with localised
operating temperatures higher than the external thermocouples recorded. The
presence of the DER below the inner race surface only on the loaded side of
the bearing, showed that the microstructural change was a result of the load
applied.

The depth of the DER was also similar to that seen on other bearings inspected
where surface initiated cracking had subsequently developed. However, this

Analysis
evidence of initial bearing race damage was all to a significantly lesser extent
than identified on the other bearings investigated.

As the only test parameter that was applied to the bearing was a consistent
load it is reasonable to conclude that the initiation of the material properties
change on the loaded race was directly related to the operating load applied.
However, the bearing manufacturer’s review of contact pressure between the
rolling elements and the race surface (conducted after the test was done)
showed that a combination of 8,000 N axial load and 16 Nm bending moment
did not generate a sufficiently high contact pressure in the bearing to trigger the
rate of damage progression seen in the other bearings.

2.9.2 Manufacturer’s subsequent rig test

The final rig test carried out by the helicopter manufacturer applied higher loads,
through a combination of high axial and bending moment loads, compared
to the endurance test requested by the investigation and loaded the bearing
cyclically, with varying load magnitudes, alternating loads directions and cooling
periods between each cycle. The test spectrum was initially defined to certify
the new all steel modification standard bearing and as such needed to reflect
the high axial and bending moment loads recorded on both the AW189 and the
AW169. The test was then repeated using a hybrid bearing of the type fitted
to the accident helicopter, but the manufacturer also elected to remove the
inboard seal to explore the effect of this on bearing performance.

© Crown Copyright 2023 165 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Grease loss

The bearing (s/n 16141) was inspected on three occasions during the test
sequence. This identified that a ‘collar’ of extruded grease was present on
the side with the seal removed. The grease was extruded within the first
290 operating hours and the quantity did not increase further during the
test. The bearing continued to operate for a significant period with recorded
temperatures below any of the threshold limits, despite the reduced grease
content. The extruded grease was recovered and weighed at 3.3 g.

This was slightly more than the original certification endurance test for the
AW169, which lost 2.38 g, and the certification endurance test for the AW189,
which lost 2.86 g. With the seal not in place to act as a boundary, additional
grease may have been extracted during the recovery process, which would
otherwise have been below the seal had it been present. Despite this and
given that the seal was completely removed for this test, the loss of grease
was not extreme in comparison with other tests conducted. It also showed that
Analysis

removal of the seal did not result in a complete loss of grease, as would have
been required to replicate the results of earlier rig tests, where the grease was
intentionally removed in its entirety to expedite the failure of the bearing. The
loss of some grease past the seals is accepted as normal during the churning
phase of bearings which are initially fully filled with grease.

Observations during the test

The temperature data recorded that there was a notable and consistent
temperature rise on the side of the bearing which was under load. The
larger the load, the greater the temperature rise. As the race rolling surfaces
deteriorated, progressively higher temperatures were recorded. These
temperature increases were the result of increased friction due to the increased
contact pressure between the races and the balls under load, but subsequently
added to by the increased friction resulting from deterioration of the grease and
the balls travelling over the damaged race surfaces. The test was allowed to
continue with peak temperatures of 400°C recorded, at which point a torque
load was transferred by the bearing, indicating it was starting to seize.

Bearing damage

The laboratory investigation of the bearing confirmed that both sides of the
bearing showed the same rolling contact fatigue features seen in the accident
bearing and the other bearings removed from service. Heavy wear on the
outboard cage demonstrated how this resulted in the cage being displaced,
allowing truncation of the balls. The bearing contained powdered grease
and there was evidence of the transfer of copper onto the inner race running

© Crown Copyright 2023 166 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

surface. The inner races displayed a heat affected zone and shallow DER as
well as regions of deformed microstructure with surface initiated cracks.

The compressed nature of the cracks, the increased levels of plastic deformation
and smearing on the outboard inner race, suggest that the sequence of failure
had progressed further than seen in the other bearings inspected after removal
from service. Despite being the side of the bearing with the seal still fitted,
the damage on the outboard side of the bearing had progressed further than
the inboard side which had the seal removed. This demonstrated that seal
damage or displacement during installation or in service was unlikely to be a
factor in the deterioration of the bearing with this specific failure mode.

The low-level transfer of drive torque detected at the end of the rig test showed
that the bearing had reached the stage of incipient seizure. However, the
damage seen in the bearing had not yet progressed to the stages of fracturing
the cage and extensive replacement of the running surface seen in the accident
bearing. It is therefore likely that the bearing would have continued to operate,

Analysis
albeit in an increasingly distressed state, for a further period before the damage
reached the extent seen on the accident bearing and complete seizure and full
transfer of drive torque into the control rod occurred.

The high loads were only applied for short durations, with the load direction
reversed immediately afterwards. This allowed the temperature of the unloaded
side of the bearing to decrease before the next reapplication of load. The test
was also run at the lower AW189 tail rotor speed rather than the maximum
AW169 speed, used in all the other rig tests. These mitigations would have an
effect in slowing down the rate of deterioration of the bearing. The test data
recorded during the test showed that the axial loads applied varied from the
planned test spectrum. The average negative loads, which loaded the inboard
race were lower than the average positive loads on the outboard race. This
was reflected in the level of damage progression seen on the two races.

2.9.3 Conclusions from the bearing investigation

Potential causes of bearing failure eliminated

There are a number of basic factors which can potentially cause a bearing to
fail prematurely.

Given the vast experience of operating bearings across many industrial

applications, these have been extensively researched and documented and
were considered in detail by the investigation.

The investigation benefitted from inspecting several bearings either removed

from service or following rig tests. This facilitated the compilation of factors that

© Crown Copyright 2023 167 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

were common to the accident bearing and all the similar damaged bearings,
and allowed the elimination of those factors which were inconsistent with this
group of bearings.

Whilst not an exhaustive list, the following significant factors were considered
and eliminated.

Two of the damaged bearings reported were either confirmed or likely to have
been caused by manufacturing issues with the balls and were characterised by
the extensive spalling of the individual ball affected. These were included in
the report to document the differences in the physical evidence, most notably
the lack of a DER, to show they were not the same as the accident bearing
or bearings s/n 14125 and s/n 15119 and to highlight the consistency of the
damage to this group of bearings.

The bearing material properties and dimensions were assessed in the bearings
inspected and any variations confirmed to be a consequence of the damage
Analysis

process. Preload was explored by various rig tests and found not to be a
significant factor in isolation. The metallurgy showed that the RCF damage was
surface initiated and caused by high surface shear stress from the balls sliding.
This was not consistent with a random low life failure due to Hertzian fatigue in
a bearing operating normally.

Truncation of the balls due to movement of the cage was demonstrated to be

a consequence of the failure process on the bearings where this occurred. No
evidence supporting truncation as an initiating cause was present on these
bearings and evidence of truncation was not found on the accident bearing
or consistently across all the bearings which showed the same damage
characteristics as the accident bearing.

The investigation considered a grease specification or contamination issue,

but it was confirmed that the grease quality is strictly controlled and reviewed
to meet Military Specification standards. Each batch of grease was used in
multiple hundreds of bearings, which is inconsistent with the numbers of failing
bearings identified and the variations in initiation time and time to failure seen
across the damaged bearings. No evidence was found to suggest that the
grease used in the damaged bearings did not perform in accordance with
its specification. Where grease degradation occurred it most likely resulted
either from prematurely reaching the end of its useful life due to the high
operating contact pressures within the bearing or due to exposure to operating
temperatures which exceeded its specification limits.

Water contamination of the bearing during the manufacturing process was

also considered, particularly in relation to the application method and use of

© Crown Copyright 2023 168 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

preservation oil on the bearing components. There was no evidence identified

that this had occurred or was a likely risk and a significant amount of evidence
that contradicted it as a possible factor.

The investigation found that there were extensive safeguards within the
manufacturing process to avoid contamination of the oil and had it been a
problem it would have affected many thousands of other components, which
was not the case.

No evidence of water contamination or corrosion has been identified on any of

the bearings inspected by the investigation and no generic issues of this nature
have been reported by the bearing or helicopter manufacturer on this bearing
part number.

The compatibility of the preservation oil with the grease has been reviewed
and confirmed by the bearing manufacturer with the grease manufacturer.
Contamination of bearings at manufacture was not consistent with the variation

Analysis
in bearing lives observed across the damaged bearings considered by the
investigation, where the highest life bearing had the lowest level of damage.
An issue present at manufacture would likely have resulted in a consistent rate
of deterioration and time to failure across all the bearings.

A more general review of the bearing manufacturing process, including

findings from a quality audit conducted by the helicopter manufacturer after the
accident, found no evidence to suggest that the actual manufacturing process
had caused or contributed to the premature failures of the accident bearing and
the bearings with the same failure characteristics.

Extensive leakage from the bearing of low viscosity grease was not consistent
with the evidence from the specification of the grease nor from the rig tests
which took the bearings up to between 400 and 600 °C. Rather, the tests
demonstrated that most of the grease was retained and degraded to carbon
powder when subjected to these high temperatures. This was also consistent
with temperature experiments on the grease conducted by the helicopter
manufacturer to facilitate a baseline assessment of grease condition.

Grease extrusion around the bearing seal during the ‘churning phase’
leading to a ring of grease around the face of the bearing was confirmed
to be normal. This was supported by a number of independent sources of
evidence, including reference texts published by recognised industry experts
on bearing lubrication, articles published by the bearing manufacturer and a
test report issued by the helicopter manufacturer. The AW169/AW189 bearing
is unusual in having 100% of the free volume filled with grease. The normal
industry standard as quoted in the bearing manufacturer’s product catalogue

© Crown Copyright 2023 169 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

is 25-35%. The AW139 bearing has a minimum grease content specification

of 33%. When applied to the AW169 bearing this suggests that up to 4 g
of grease can be extruded with no adverse effect. The rig test referenced
by the helicopter manufacturer’s report operated a bearing with intact seals
and nominal grease content for over 1,000 hours with evidence of grease
extrusion around the seal described as ‘typical’ by the report; no damage was
identified on this bearing. Similarly, both certification endurance tests resulted
in grease extrusion, but the bearings were still deemed serviceable by the
bearing manufacturer.

The final rig test conducted by the manufacturer, where the seal on one side
of the bearing was completely removed, showed the damage was worse on
the side with the seal still in place and the largest amount of grease (powder)
retained.

However, even with the seal completely removed, the amount of grease expelled
was not extreme and only slightly greater than the amount of grease expelled
Analysis

in other rig tests. The grease was also extruded early in the test consistent
with the initial churning phase, but the recorded bearing temperature remained
well below the grease specification operating temperature limits for close to
700 hours of testing. No additional grease was lost before the bearing
temperatures started to rise towards the end of the test. These timelines were
not consistent with the accident time to failure of 330 hours.

None of the damaged bearings removed from service were found to have
missing or significantly displaced seals. Most displayed wear marks on the
inner surface of the seals consistent with in situ contact between the seals
and the cage. The accident bearing demonstrated the same wear marks.
Displacement of the seal found after removal was consistent with displacement
of the adjacent inner race resulting from the separation process of the control
shaft from the tail rotor wreckage.

Identified cause of bearing failure

By contrast, a significant amount of common supporting evidence was identified

across the group of bearings found with the same damage characteristics as
the accident bearing. This provided coherent evidence that these bearings
and the accident bearing had suffered the same early onset, surface initiated,
rolling contact fatigue, consistent with high contact pressure resulting from
operating loads.

The installed, but unloaded bearing is designed to operate with a constant

baseline contact pressure between the balls and the races, controlled by the
preload on the bearing. When an additional external axial load and/or bending

© Crown Copyright 2023 170 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

moment are experienced by the bearing due to the tail rotor hydraulic actuator
reacting or overcoming the inertial, elastomeric and aerodynamic loads
generated by the tail rotor blades during manoeuvres in different operating
conditions, this increases the contact pressure between the balls and the race,
within the side of the bearing reacting the load.

Research has shown that the ceramic balls used in hybrid bearings result in
a contact pressure approximately 12% higher than steel balls under the same
load.

This is because the hard ceramic balls deform less under pressure creating a
contact ‘footprint’ between the balls and the race surface that is smaller than
with steel balls. The balls and races are normally separated by a thin layer or
film of grease that lubricates the contact area and reduces the friction. This is
referred to as elastohydrodynamic lubrication. The thickness of this grease
layer and hence the effectiveness of the lubrication provided, is affected by a
number of factors, but most significantly by the contact pressure it is subject to

Analysis
and by the temperature, which affects its viscosity.

Grease that is heavily worked by the mechanical effects of a high contact pressure
and the chemical changes which result from high operating temperatures
due to increased friction, will degrade more rapidly than would otherwise be
the case in a less extreme environment; this is referred to as ageing. As the
grease degrades it reduces its effectiveness as a lubricant. This even applies
to grease which is working exactly as defined by its specification. Where this is
anticipated or monitored by design, the grease can be replaced at appropriate
intervals. With sealed bearings, such as the tail rotor duplex bearing, this is
not possible and is mitigated by selecting a grease which won’t reach the end
of its effective life prior to replacement of the bearing. However, accurately
predicting this effective life is dependent on a full understanding of the bearing
maximum contact pressures, temperatures and load cycle durations likely to be
encountered in operation.

Loss of lubrication effectiveness either by momentary reductions in film

thickness, which can result in lubrication starvation events, or by degradation of
the grease, or by a combination of both, increases friction between the bearing
race and the balls, leading to a further increase in temperature. This cycle
also results in an increase in the amount that the balls slide which creates high
shear stresses at the surface of the bearing race material, further increasing
the temperature. Initially the increase in surface shear stress will manifest as
subsurface microstructural change but this will progress under continued high
stress to form distinctive surface initiated cracks and material loss, which also
increases friction. This cyclic process eventually causes sufficient damage to
the bearing race surface that it results in a self-perpetuating downward spiral of

© Crown Copyright 2023 171 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

reducing lubrication effectiveness, increasing friction, temperature and damage

to the bearing until it seizes (Figure 97).

Lubrication Shear stress Damage

film resulting from to race
breakdown sliding balls rolling
causes the causes damage surface
balls to slide to race rolling increases
more than surface friction
roll
increasing
friction

Increase in
Aging grease
friction increases
Analysis

and lubrication
temperature
starvation events
increase friction

Higher contact
pressure
increases friction

Increase in
contact Increase in
pressure and contact pressure
temperature and temperature
accelerate reduces
grease aging lubrication film
and oxidation thickness

Figure 97
Cycle of increasing friction, grease deterioration and surface damage in
bearings due to high contact pressure, resulting in premature failure

© Crown Copyright 2023 172 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The degradation of the grease, seen to various extents across all the bearings
inspected, was indicative of the high mechanical work and the increasing
temperature due to increases in friction. While there is the possibility of rapid
grease deterioration in the churning phase of the bearing’s operation, given
that only a limited number of bearings have been identified with damage and
all bearings experience this phase, it can only act as a potential contributory or
exacerbating factor to the main issue of degradation caused by high mechanical
work and friction.

The presence of a DER just below the race surface was characteristic of the
high shear stress closer to the surface than Hertzian theory would predict,
caused by the increased amount that the balls were sliding rather than rolling.
The DER was not present on bearing s/n 13123, which suffered a similar
degradation sequence and level of distress, but due to a different failure cause.
It was, however, present on the bearing from the final rig test, where the only
variable test parameter introduced which would negatively impact on the
bearing’s performance was a high operating contact pressure, resulting from

Analysis
high applied axial and bending moment loads.

As seen across all of the bearings, once fatigue cracks developed on the race
surface, the friction and thus heat increased as the balls rolled or slid over
the rough surface, further increasing the stresses on the race material and
changing the microstructure of the material within a heat affected zone below
the race surface, making it softer and less durable. This continued to degrade
the grease further, eventually completely removing its capacity to lubricate the
bearing and accelerating the rate of RCF damage, leading to more significant
macropitting and material loss.

The final sequence to failure, only seen to its fullest extent in the accident bearing,
occurred as debris released by the RCF damage was ground to powder and
re-laid to form an unstable new race surface that continued to break up. This
represented the final stage of the bearing’s life until the dimensional clearances
reduced sufficiently for the bearing to seize completely (Figure 100).

Cage damage and wear

The damage and wear to the cages was also indicative of this failure mechanism
and was consistent across the accident bearing, the bearings removed from
service and the rig test bearing. Figure 98 shows how the balls and cage rotate
within the bearing, resulting in wear to the cage.

© Crown Copyright 2023 173 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Figure 98
Rotation of balls and cage within the bearing
Analysis

The geometry of the bearing inner and outer races results in an angled spin
axis for the balls. The scoring and witness marks within the pockets confirmed
that the balls had been in contact with the sides of the pockets, resulting in a
friction force that pushed the cage towards the seal, causing the narrow ends
of the cages to be forced against the balls and the wide ends against the inner
ring.

This force occurred whenever the cage rotational speed varied relative to the
balls (Figure 99), but may also have been exacerbated by the bending moments
acting on the bearing.

On the accident bearing the outboard cage, although fractured through three
pockets at the narrow end, remained in one piece, whereas the inboard cage
had broken completely into two sections. Where the fracture surfaces were not
smeared, it was possible to identify fracture features consistent with fatigue.
Momentary but repeated speed differences between the balls and the cage,
driven by disruption to the procession of the balls, resulted in contact between
the balls and the cage and generated tension across the pockets, creating the
cyclic loading required to drive the fractures. Once the inboard cage broke into
two sections it moved outwards against the outer race due to inertia, resulting
in the wear mark on the outward side of the narrow end of the cage.

© Crown Copyright 2023 174 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Figure 99
Ball spin axis and force generated by friction between
the balls and the cage pocket

Analysis
The disruptions in the procession of the balls were caused by lubrication failure
events, resulting in the balls sliding rather than rolling. Once macropitting was
present on the rolling surface, the increased friction as the ball rolled over the
pitting would have exacerbated this.

Movement of the cages due to wear or failure allowed the balls to run on the
edge of the race causing truncation and spalling and to move across the race
surface extending the area of damage.

Inner race Balls Cage Outer race Grease

1 The friction forces
locally heat the
Witness mark band bearing making the
from passage of grease work harder,
balls. the grease is
The ceramic balls
pushed out of the
impart a loading
contact.
and traction force
A dark etched Although loaded by
on the inner ring. Grease, goes from
region (DER) is the balls, the
brown to black,
formed under the geometry of the
2 raceway as the contact reduces the
becomes thicker
and sticky in
microstructure is local stress, no
consistency, with
changed. DER yet.
lumps. Some
Witness mark band
Surface traction Increased friction at Creation of witness separation of the oil
from passage of
3 creates grain-flow contact with inner marks within cage
balls. Ball sliding
and thickener
and microcracks. ring, some sliding pockets. material.
wear marks.

© Crown Copyright 2023 175 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Inner race Balls Cage Outer race Grease

1 RCF macro- The friction forces
Cage slows
cracking and locally heat the
relatively to
creation
Witness of ring
mark band bearing making the
individual balls
debris. Heatingofof
from passage grease work harder,
(caused by other
inner ring affecting
balls. the grease is
The ceramic balls balls sliding).
bulk microstructure pushed out of the
impart a loading Friction between
4 (Heat affected zone
spinning balls and
DER formed below contact.
and softening). and traction force the race loaded
surface.by
A dark etched Thethe
balls display cage pocket forces Although
Damage on inner ring. Grease, goes from
region progresses
(DER) is crazing from heat cage towards seal,
Grain
the flowthe
balls, at
with timeunder
creating surface leading brown to black,
formed the and traction forces, resulting in cage geometry of theto
2 increasingly
raceway asroughthe RCF micro-cracking
contact reduces the
becomes thicker
lots more sliding deformation and and sticky in
running surface is
microstructure for and micro
local pitting.
stress, no
and stopping of wear. consistency, with
balls.
changed. Surface
DERbecomes
yet.
individual balls. lumps. Some
Cyclic loading of rougher
Witness mark andband
Surface traction Increased friction at Creation of witness
cage pockets by produces debris. separation of the oil
Cage debris are free from passage of
3 creates grain-flow contact with inner marks withinball
uneven cage
balls. Ball sliding
and thickener
toand
move about the
microcracks. ring, some sliding pockets.drive material.
procession wear marks.
5 bearing, becoming
fatigue cracks
adhered to the race
through narrow and
rolling surface.
wide ends of cage
pockets
6 A mix of cage, race With the cage
Two pockets
Grease continues to
completely fail.
and grease debris broken the path the degrade.
Analysis

Cage breaks into With the failure of

become over-rolled balls can take
two sections, inertia the cage, the ball
by the balls which becomes more The friction present
throws them against path is no longer
are no longer erratic and less heats the grease
the outer ring. Lots stable and so can
constrained by the confined. The balls fully degrading its
of cage debris is lead to plastic
cage. A hybrid alloy run over the hybrid properties,
created adding to deformation of edge
material is material rolling in eventually turning it
the mix of ring of raceway.
deposited over the more layers of to dust.
debris and
race surface. debris.
remaining grease.
Large subsurface
The cage continues
cracks form within Balls impart RCF
to produce large Hybrid debris flakes
the weak hybrid loading conditions
amounts of debris. transfer to the outer
7 layer of material, on the surface and
Hybrid debris flakes race rolling surface
breaking out large subsurface of the
transfer to the cage and are over-rolled.
chunks and re- hybrid material.
pockets.
depositing them.
A full race width The next ball cannot
piece of hybrid fit within the gap The locked bearing
material fails between the two applies toque
The cage section
through subsurface raceways with the through the bearing
8 RCF. The chunk of additional chunk of
with the jammed
housing, sliding the
ball stops. The
material enters the hybrid debris outer race within its
second cage
pathway of the next present. The ball housing.
section stops when
ball. stops relatively to
it meets the first
9 The torque on the
the outer ring,
section. The
The torque between
applying torque to the outer race and
inner race drives the bearing is seized
the normally the housing is
rotation of the TRA
stationary inner reduced by the
control shaft.
race. rotation of the shaft.

Figure 100
Figure showing failure sequence of the bearing

© Crown Copyright 2023 176 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Review of flight and rig test data

The data referred to in this section of the analysis can be found in

section 1.16.1.4.

Analysis of the flight test load survey data for axial load5 and bending moment
(M) confirmed a cluster of manoeuvres that generated bending moments
higher than the largest moment considered by the bearing manufacturer in
the development load spectrum, but which occurred in combination with axial
load magnitudes that were approximately half the highest axial load considered
within the development spectrum. All the cases occurred on flights which were
conducted within the approved operating envelope for production helicopters,
though some were recorded during higher altitude or specialist equipment test
flights. However, the conclusion drawn in the test reports by the helicopter
manufacturer for these flights was that the loads were matched or were less
severe than those recorded during lower altitude, basic flights and as such they
were not unique to those flight conditions.

Analysis
When the combinations of medium (7-8 kN) axial loads and high bending
moments recorded during these manoeuvres were assessed using the bearing
manufacturer’s current computational model, the inner race contact pressure
and PVmax were the same as with the most extreme axial load (13 kN) case in
the development spectrum (3,100 MPa).

The contact pressure and PVmax for the selected flight test manoeuvres were also
similar to those which occurred under the actual (averaged) loads (combined
axial and bending moment) applied during the manufacturer’s rig test. As can
be seen in the comparison of the highlighted areas on the summary graphs in
section 1.16.1.4. This is significant because the rig test generated the same
damage characteristics seen in the accident bearing and others removed from
service. It is therefore possible to conclude that the contact pressures which
generated damage during the rig test can also be experienced by the bearing
during operation of the helicopter in routine manoeuvres, though likely only
under a limited set of operational circumstances.

The manoeuvres completed during the load survey test flights were a limited set
of tightly defined individual test points. The axial and bending moment loads of
interest were recorded during the dynamic entry and exit of the manoeuvres,
as well as during the steady state ‘on condition’ part of the test point. Only the
highest test point conditions were analysed during the investigation. The flight
tests did not measure loads during dynamic combinations of manoeuvres and
were necessarily flown in calm, low wind speed conditions, rather than the
turbulent, gusting wind conditions that may be experienced in service.

5 Also referred to as FZ, Fa or TH1.

© Crown Copyright 2023 177 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

It is likely that what might be considered as less severe individual manoeuvres

or combinations of manoeuvres, when flown in ‘real world’ conditions during
the normal operation of the helicopter, can generate combinations of bending
moment and axial load that result in the same or greater bearing contact
pressures than the flight test and rig test points analysed by the investigation in
section 1.16.1.4 or considered by the original development load spectrum for
the bearing (Table 4).

The accident helicopter was a production standard model and therefore not
fitted with the sensors installed on the instrumented prototype airframes used
for flight testing by the manufacturer. As such, it was not possible to determine
exactly what axial loads, bending moments or contact pressures the accident
bearing had experienced in service.

Some of the specific flight test points identified by the analysis which generated
high contact pressures, related to simulated wind speeds from adverse
directions6, ground taxiing and from autorotation manoeuvres. The flight
recorder data recovered from the accident helicopter only provided a 25 hour
Analysis

snapshot of the 330 hours which the helicopter had been operated. But it did
include evidence that the pilot practised autorotations, as would be expected
of a commercial pilot maintaining currency in emergency procedures, and
that the helicopter was taxied on the ground. Due to the shape of the football
stadium, takeoffs could only be done in one of two directions orientated along
the long axis of the pitch. The helicopter could potentially have been exposed
to adverse wind directions as it emerged above the stadium roof, but this was
not recorded in the flight data or journey logs. The helicopter was locked into
this specific routine during the football season, differentiating it from other roles,
such as offshore transport or Helicopter Emergency Medical Services (HEMS).

Without recorded data evidence for the whole life of the helicopter nor onboard
load measuring or recording equipment, it was not possible to determine with
certainty that the specific manoeuvres identified by the flight test analysis
had been experienced by the accident helicopter, or whether other routine
manoeuvres and flight conditions experienced by the helicopter had resulted in
similar or greater contact pressures to those identified in flight and rig testing.

The ESUM data showed 12 transient exceedances of the RFM transmission

maximum continuous torque limit. Seven of these events occurred prior to
delivery of G-VSKP. The maximum torque reached was 109% for a duration
of approximately 60 seconds. The Type Certificate Data Sheet (TCDS) for the
AW1697 provides an all-engines operating maximum torque limitation of 111%

6 See section 1.6.5.2 for further explanation of adverse wind directions.

7 https://www.easa.europa.eu/sites/default/files/dfu/AW169-TCDS%20R-509%20Issue1.pdf (Accessed
3 July 2023)

© Crown Copyright 2023 178 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

for a duration of 5 minutes. It was therefore concluded that, while the ESUM
data showed 12 transient exceedances of RFM limits the TCDS limits had not
been exceeded.

No evidence was identified in 25 hours of recorded data recovered by the

investigation that G-VSKP had been flown outside the approved envelope
for the AW169 for that period. All the high contact pressure manoeuvres
identified from the flight test data were also within the approved envelope for
type certification. As such, there was no evidence to suggest that the accident
duplex bearing had experienced, or had failed as a result of being subjected to,
manoeuvres that were not approved for the AW169 in normal operation.

Although the contact pressures considered by the bearing manufacturer in

the original development load spectrum during their development analysis
were similar in magnitude to those which led to the failure in the rig test and
subsequently highlighted by analysis of the flight test loads, they were considered
in a different context by the bearing manufacturer at the time. The L10 analysis

Analysis
considered a theoretical distribution of contact pressures and durations across
the life of the bearing based on an eventual failure by routine Hertzian RCF.
This did not provide any guarantee that those high contact pressures could be
sustained repetitively in a dynamic real world operating environment where
bearing performance is also dependent on the response of the lubrication to
sustained mechanical loading and elevated operating temperatures, potentially
leading to lubrication film breakdown, surface shear loads and surface initiated
cracking due to premature RCF.

When all the evidence available to the investigation was considered as a whole,
including the very specific damage to the cages and races seen across all the
bearings, the rig test results and the comparative flight and rig test contact
pressure data analysis, it was concluded likely that the accident helicopter
tail rotor duplex bearing failed due to premature grease deterioration and
accumulation of race damage caused by high contact pressures, resulting from
routinely conducted manoeuvres within the approved operating envelope of the
helicopter.

Variation in bearing time to failure

There was significant variation in the operating lives of the bearings examined
in this investigation. The extent of damage observed was not consistent with a
simple relationship of increasing flight hours, with the accident bearing showing
the maximum level of distress, whilst having the lowest service life 8. 108F

8 Bearing s/n 17115 is excluded from this, given that the failure mode was confirmed as being different
from the accident bearing.

© Crown Copyright 2023 179 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

Analysis of the evidence available suggests that only a limited subset of

manoeuvres generated combined loads sufficient to cause contact pressures
within the bearing, that over time resulted in grease deterioration and race
damage. The inherent flexibility in helicopter manoeuvres and diversity of
atmospheric conditions in which they operate, results in significant potential
variability in the duration, magnitude and frequency of exposure to the potentially
damaging contact pressures associated with this subset of manoeuvres. These
differences in the timing and severity of exposure to high contact pressures for
each individual helicopter affected, resulted in significant potential variation in
the accrued bearing life at which accumulation of damage was initiated, the
rate at which the damage progressed towards failure and the extent of the
damage observable at the time when they were inspected, following removal
from service due to a maintenance inspection or as the result of an incident or
accident.

In addition to the bearings chosen to be part of the investigation, it is possible

that others removed from service over this period had developed damage to
Analysis

some degree but were either not returned to the manufacturer or were not
subjected to the same disassembly inspection to identify and document the
damage. It is also likely some helicopters in the AW169 and AW189 fleet
were not subject to manoeuvres which generated bearing contact pressures
sufficient to cause premature damage, as evidenced by the endurance rig test,
or were subjected to these high contact pressure manoeuvres, but not to an
extent sufficient to progress the cycle of grease deterioration far enough to
result in observable damage, prior to the bearing being removed at the required
discard life or replaced by the new standard of bearing. All these factors in
combination may help to explain why only a relatively small number of tail
rotor hybrid bearings operated in AW169s and AW189s either failed or were
confirmed to have suffered damage.

Analysis of the tail rotor rotational speed from the 25 hours of flight data
available to the investigation, also shows that the accident helicopter operated,
as expected, in ‘PLUS’ mode for the majority of this time with some occasional
reversions to ‘BACKUP’ mode. This resulted in approximately 75% of the tail
rotor bearing’s recorded operation being at rotational speeds above that used
by the bearing manufacturer for their original and subsequent performance
analysis of the bearing or by the helicopter manufacturer during their final rig
test. Analysis of the 216 hours of ESUM data also showed similar extensive but
expected operation of the tail rotor above 100% rpm. The majority occurring
around 103% rpm, but with transients up to a maximum of 106%. Whilst
these operational rotational speeds were well within the limits for the bearing,
when combined with the other factors affecting contact pressure, they would
have contributed to the duress the bearing was under, as illustrated by the PV
factor. It is unlikely that this was significant in its contribution to the initiation

© Crown Copyright 2023 180 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

of the failure but may have accelerated the rate of damage accumulation
within the accident bearing when compared to others in service or used in the
final rig test.

Assessment of bearing certification requirements and testing

TDH rig tests

TDH rig endurance tests were carried out during both the AW189 and AW169
development and were used as the main tests to validate that the bearing could
operate satisfactorily, albeit the tail rotor duplex bearing was just one of many
components being assessed in the rotor drive and control systems.

A visual only inspection of the condition of the bearings after the test,
determined they were in good condition and this was considered sufficient
by the manufacturer and the airworthiness authority to satisfy the certification
requirement. The axial load sample data provided to the investigation showed

Analysis
similar magnitudes to the development load spectrum. Due to the high data
sampling rate, it wasn’t practical within the limitations of the investigation to
calculate the bearing bending moments experienced, though given the test was
inherently static, it is unlikely that they would have reached the levels recorded
during the dynamic manoeuvres of flight test. As such, it was not possible to
assess the contact pressures within the bearing to allow a comparison with the
subsequent investigation rig testing. However, the lack of wear or damage seen
during the visual inspection of the TDH test bearings, along with the condition
of the grease, suggest the contact pressures and local temperatures of the
inner races were not particularly high and less than the rig test which resulted
in failure of the bearing.

Flight test

The original flight test programme used four flight test helicopters on the
AW169 and five on the AW189. Several of the tail rotor duplex bearings
fitted to these helicopters were replaced during the programme, for various
reasons. As a result, the highest life achieved on a single bearing prior to
certification was 558 hours, compared to the discard life of 2,400 hours. One
of these bearings was removed from an AW169 flight test helicopter during
a routine maintenance inspection for what was initially considered rough
operation. This was the same inspection process which detected the failing
bearings during the post-accident in-service inspections. However, the cause
for removal during flight test was subsequently dismissed as inaccurate and
the bearing was not investigated further, highlighting the subjective nature of
the inspection criteria. The manufacturer confirmed that at the conclusion of
the pre-certification flight test programme of both the AW189 and the AW169,

© Crown Copyright 2023 181 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

the installed duplex bearings remained fitted to the flight test helicopters.
As such, none of the bearings removed during either helicopter type’s
pre-certification flight test programme were inspected for condition by
the bearing manufacturer, neither were the bearings inspected after the
pre-certification flight test programme had been completed.

Whilst at least some of the bearings would have experienced high contact
pressures during the flight testing, it is likely that the very limited exposure
duration to test manoeuvres which generated those high contact pressures,
the multiple prototype airframes used for the testing and the limited total flight
times on each bearing meant that the damage, if present, was not sufficient
to have been detected by the on-wing inspections. The possible exception to
this was the AW169 bearing removed for rough operation but as this was not
investigated further, the evidence was lost.

Whilst the flight test load survey results were assessed by the helicopter
manufacturer, this was primarily from a component fatigue life perspective, rather
Analysis

than to validate the load spectrum supplied to the bearing manufacturer during
initial approval of the bearing for this application. The bearing manufacturer
was not provided with any of the flight test data. They were the only party
that had the specialist proprietary computer model to calculate the contact
pressures resulting from the various axial load and bearing bending moment
combinations recorded inflight. As such, a comparison of bearing contact
pressures experienced during flight test with the original predicted design load
spectrum contact pressures, was not carried out before the helicopter type
designs were approved by the airworthiness authority and the AW189 and
AW169 models entered service.

There was no requirement for the helicopter manufacturer to share the flight test
data with the bearing manufacturer, as nothing in the airworthiness regulations
requires flight data to be used to validate the accuracy of the theoretical load
spectrum analysis for bearings. The bearing manufacturer had highlighted
in their design document summarising their analysis of the theoretical load
spectrum provided by the helicopter manufacturer, that the contact pressures
were high for this bearing design. Their stated understanding was that the
provided load spectrum included a safety margin in the maximum load cases
and as such had confirmed the bearing was acceptable for the application.
Had they been provided with the flight test data, it is possible they may have
realised that this was not the case, given the actual flight loads recorded.

As the helicopter manufacturer ultimately decides the final build standard of

their product, it was not possible to state definitively whether raising such
concerns would have resulted in changes to the design in this specific case.
However, the lack of regulatory requirements or guidance requiring both parties

© Crown Copyright 2023 182 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

to conduct a formal post-test review, contributed to the fact that no opportunity

was ever provided to at least consider the continued suitability of the bearing
in this application.

There is always the potential for theoretical loads analysis to underestimate

the loads which occur in practice. This was the case with the initial
AW149/AW189 bearing load spectrum (Table 2). Where subcontract suppliers
hold the sole expertise to analyse the significance of this for the component
they design and qualify against a specification, it is essential that the type
design manufacturer shares all the subsequent data obtained from the installed
rig and flight tests during development. This provides the opportunity for a
‘closed loop’ validation by the specialist manufacturer of their component within
the system application in which it will be used. This is particularly significant
for critical parts, where component failure has catastrophic implications. The
following Safety Recommendation is made:

Safety Recommendation 2023-018

Analysis
It is recommended that the European Union Aviation Safety Agency
amend Certification Specification 29.602 to require type design
manufacturers to provide the results of all relevant system and flight
testing to any supplier who retains the sole expertise to assess the
performance and reliability of components identified as critical parts
within a specific system application, to verify that such components
can safely meet the in-service operational demands, prior to the
certification of the overall system.

Rolling Contact Fatigue

There are currently no explicit requirements within the CS 29 regulations

defining how rolling contact fatigue should be addressed within the design
process or any compliance test activity for any type of bearing, even though
bearings are being used in critical safety applications on helicopters.

Following the LN-OJF accident and the subsequent Norwegian Safety

Investigation Authority findings and recommendations, the European Union
airworthiness authority undertook to review RCF as part of RMT 128 and
an NPA was issued in February 2022, with various proposed amendments
to CS 29, which were eventually included in Amendment 11 of CS 29 in
February 2023.

The amendment to the AMC for CS 29.571 offers an improvement by providing

guidance to manufacturers to at least consider rolling contact fatigue within
their analysis. However, this regulation is aimed at Principal Structural Element

© Crown Copyright 2023 183 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

(PSE) components within a power drivetrain, rather than critical components

within a control system, such as the duplex tail rotor bearing. The tail rotor which
included the duplex bearing was certified to CS 29.547, so the manufacturer
would not have considered CS 29.571 during the tail rotor design process.
Only the Acceptable Means of Compliance has been amended rather than
the regulation and this only states RCF should be considered during the
analysis, as such it does not introduce any specific criteria, which must be
met and demonstrated during certification, to ensure an appropriate minimum
safety standard when dealing with components whose failure is assessed as
catastrophic or hazardous. The mitigating actions it proposes are also aimed
at drivetrain systems and include techniques such as magnetic chip detection,
which is associated with a liquid oil lubrication system rather than an individual,
sealed, grease lubricated component. The action taken to date does not
adequately address the issue highlighted by this investigation of the lack of
regulatory requirements specifically addressing the risk of catastrophic failure
due to premature rolling contact fatigue in bearings identified as critical parts.
Analysis

As such, the following Safety Recommendation is made:

Safety Recommendation 2023-019

It is recommended that the European Union Aviation Safety Agency

introduce additional requirements to Certification Specification 29
to specifically address premature rolling contact fatigue failure
across the full operating spectrum and service life of bearings used
in safety critical applications.

2.9.4 Associated factors

Critical parts

Although not causal to this accident, the tail rotor bearing has an ambiguous
airworthiness status.

Currently only life limits and associated latent failure inspections deemed
Critical Maintenance Requirements (CMR) for principal structural elements,
identified under CS 29.571 and CS 29.573, are mandated by the regulations to
be listed as airworthiness limitations in the ALS, which in this case is Chapter
Four of the Approved Maintenance Planning Information (AMPI) manual. Other
critical parts, whose failure is just as catastrophic for the helicopter, but which
do not fit under this definition are just considered to have discard lives, which
are managed as scheduled maintenance tasks in a different section of the
AMPI (Chapter Five). Whilst the helicopter manufacturer and airworthiness
authority argued that at a basic level all tasks and limits contained in the AMPI

© Crown Copyright 2023 184 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

are necessary for the continued airworthiness of the helicopter and discard
lives are enforced, the difference in status of these components and the way
they are considered and described in the AMPI, despite them having the same
safety criticality, creates ambiguity. This is exemplified by the introduction to
Chapter Five of the AMPI which states ‘This section gives the recommended
time limits requirements for the components of the helicopter’. In contrast the
ALS section of Chapter Four is clear that the life limits are an airworthiness
requirement and can’t be varied, even going to the extent of applying life limit
reductions, where the operation of the helicopter is considered more severe
than that used for the original life assessment analysis.

On the AW169 and AW189 the bearing manufacturer stated that a maximum
service life was necessary given the magnitude of the load spectrum compared
to the AW139, but the helicopter manufacturer maintained their approach
from the AW139. Although development of the AW169 AMPI used an MPD
process for assessing scheduled maintenance tasks, which added a degree of
independent assessment, the basic regulatory analysis which fed this process

Analysis
was still conducted by the helicopter manufacturer and followed the historical
precedence of the AW139 experience. The mitigating actions taken after the
first failure of a tail rotor bearing on the AW139 took place in 2012, the same time
the AW169 and AW189 bearings were being developed. The introduction of a
discard life at that time was not mandated as the cause of the AW139 bearing
failure was not confirmed and the change was precautionary. The helicopter
manufacturer has subsequently amended the AW139 bearing discard life to
2,400 hours to be consistent with the maintenance task which removes the
bearing. This was effectively mandated by an Airworthiness Directive from the
European Union airworthiness authority, which required bearings with a higher
or equal life to be removed from service and has continued the ambiguity over
whether this is an airworthiness limitation or not.

The duplex bearing was identified as a critical part, as defined by CS 29.602, by

the helicopter manufacturer because its failure was assessed as catastrophic,
an assessment which has been validated by the circumstances of this accident.
Analysis by its manufacturer of the bearing against the development load
spectrum has also determined that it would have a finite life in this application,
the mitigation for which is replacement before it reaches its anticipated failure
life. The airworthiness considerations for non-structural critical parts are
identified through assessment to demonstrate compliance with CS 29.602, but
this regulation does not currently address life limits or their equivalent status to
the ALS limits identified to comply with CS 29.571. As such, no specific rules or
guidance are available to manufacturers to provide clarity on this issue.

A similar requirement does exist within CS-E dealing with critical parts on
engines, where the level of detail in the regulation relating to assessment and

© Crown Copyright 2023 185 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

control of airworthiness limitations for critical parts is far greater than is provided
in CS 29.602, even though they address the same catastrophic risk. The
component life limits generated by the analysis to comply with this regulation
are also required to be listed as airworthiness limitations in the ALS for the
aircraft. CS-E.515 is provided in Appendix F for comparison. The following
Safety Recommendations are made:

Safety Recommendation 2023-020

It is recommended that the European Union Aviation Safety Agency
amend Certification Specification 29.602 to define the airworthiness
status of life limits on non-structural critical parts and how they
should be controlled in service.

Safety Recommendation 2023-021

It is recommended that the European Union Aviation Safety Agency
define the airworthiness status of life limits and how they should
be controlled for existing non-structural critical parts approved to
Analysis

Certification Specification 29.602 requirements, already in service.

The classification of the tail rotor duplex bearing as a critical part by the helicopter
manufacturer meant that additional control measures were introduced during
manufacture and installation of the bearing and required that duplicate and
recorded inspections be carried out during maintenance. However, prior to
the accident, there was no requirement in place, either regulatory or from the
manufacturer, to conduct a sample assessment of the bearing condition after
removal from service for any of the AW139, AW189 or AW169 fleets. This
could have helped to validate the assumptions used for the calculated L10 life
and discard time calculations by flagging up potential premature degradation
issues. Time expired and rejected bearings were instead disposed of directly
by operators, resulting in valuable evidence being lost. This issue of inspecting
critical parts following rejection from service is an ongoing concern that has been
identified in several previous accident investigations, including the investigation
into LN-OJF, where a similar finding and recommendation was made 9. 109F

In response, the European Union airworthiness authority included a proposed

amendment to CS 29.602 in NPA 2022-01, which introduced the concept of a
Continued Integrity Verification Programme (CIVP). Whilst the basic principle
of requiring a CIVP was a positive step in the right direction, the proposed
wording of the amendment was confusing in that it specifically replaced ‘shall’
for ‘must’ in the changes to paragraph b of the regulation but reverted to ‘shall’
again for the new paragraph introducing the CIVP, suggesting a difference in
their interpretation. The European Union official policy document on the use
of English language suggests that ‘shall’ and ‘must’ are interchangeable in
9 Section 1.18.13 refers.

© Crown Copyright 2023 186 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

a regulatory context. However, the proposed wording of the complimentary

AMC, introduced to support the regulation change, stated that a list of
data sources ‘can’ be used to support the CIVP rather than ‘must’ be used,
introducing an element of choice.

‘(2) The following data can be used to support the CIVP:

(i) analysis of occurrence reports;

(ii) analysis of unscheduled removal rates;

(iii) results of scheduled maintenance;

(iv) strip reports / analysis at overhaul;

(v) post-TC development and maturity tests;

(vi) additional inspection (non-destructive and/or

destructive) and testing on selected high time or

Analysis
rejected components;

(vii) feedback from lead customers;’

It went on to state:

‘The assessments required by the CIVP, as described above,

should be performed at suitable periods through the complete life
of the subject component types, considering the types of operation,
environment and ageing effects expected. To meet this objective,
an evaluation will need to be performed on at least one sample of
each component at each major inspection interval or overhaul, and
at retirement time, as applicable.

In addition, the applicant should consider scheduling early

evaluation opportunities to confirm the suitability of the inspection
intervals scheduled at entry into service.’

This again was a positive improvement from the previous position of no

requirement at all, but the wording still introduced an element of choice
about when sampling should be completed and to what extent. It suggested
that inspections are driven by expected ageing, not to identify or respond to
unexpected issues. It set a low bar for time expired sampling and did not
address inspection of premature failures. Given the significance of the failure
of critical parts, mandating a clear, consistent standard is a proportionate
response. Such an approach would be consistent with the way critical parts are

© Crown Copyright 2023 187 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

controlled in engines as defined by CS-E; the relevant content of CS-E.515 can

be viewed in Appendix F for comparison.

The proposed change continued to have an element of ambiguity regarding

the airworthiness approach to critical parts and raised doubts about whether
the suggested CIVP would in practice achieve the necessary level of validation
from service run components. The other concern relating to the proposed
amendment was that it only addressed the issue for new design helicopters,
not existing helicopters already in service.

In February 2023 the proposed regulation amendments were withdrawn by

EASA, following their review of comments received from the industry during the
consultation process for the NPA. Although EASA have committed to continue
to review potential regulation change, at the time of writing no further proposals
have been put forward and the concern remains unaddressed.

Therefore, the following Safety Recommendations are made:

Analysis

Safety Recommendation 2023-022

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to require manufacturers
to implement a comprehensive post-removal from service
assessment programme for critical parts. The findings from this
should be used to ensure that reliability and life assumptions in the
certification risk analysis for the critical part or the system in which
it operates remain valid.

Safety Recommendation 2023-023

It is recommended that the European Union Aviation Safety

Agency require manufacturers to retrospectively implement a
comprehensive post-removal from service assessment programme
for critical parts, approved to Certification Specification 29.602
requirements, already in service. The findings from this should
be used to ensure that the reliability and life assumptions in the
certification risk analysis for the critical part or the system in which
it operates remain valid.

Starting with a theoretical load spectrum, calculation of a bearing L10 life 10 toF
01

define a service discard time, is a statistical process, based on best practice

developed from industry experience. It cannot be accurately or repeatably
demonstrated by a single test due to the variability of individual results. This

10 See section 1.18.6 for further detail.

© Crown Copyright 2023 188 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

theoretical calculation is based on ideal operating conditions, in terms of

lubrication, contamination and other environmental factors leading to eventual
failure due to routine, Hertzian rolling contact fatigue. Even assuming the
theoretical assessment of the loads and operating conditions used to calculate the
L10 life prove completely accurate in operation, by definition 10% of the bearings
will likely still fail at a different life to that calculated. The L10 life of the AW169/
AW189 bearing was reduced significantly to give an in-service discard time,
which was based on the experience of the bearing manufacturer. The reduction
from a 12,882 hour calculated L10 life to a 2,400 hour discard life, is indicative of
the inherent variability in the way this theoretical assessment is made.

Only by virtue of its location in the tail rotor, the bearing was included in the
tail rotor structural load analysis conducted to a set of load considerations
listed in CS 29.547, though this just requires the structure to ‘withstand’ the
prescribed limit loads. For the duplex bearing this translated to a limited set
of seven theoretical load conditions. The only stated consideration in this
development load spectrum regarding safety margins was related to static axial

Analysis
loads, where standard structural safety margins of limit and ultimate axial load
were considered. Whilst the bearing manufacturer commented on the contact
pressure generated by the static limit and ultimate axial load in the design
spectrum provided to them, the use of any safety factor for the combined
dynamic loads in this process was ambiguous and not clearly defined. As there
are no specific regulations governing this process for non-PSE components
such as the duplex bearing, there is no industry standard for what safety margin
should be applied to the theoretical bearing dynamic load spectrum. In the case
of the tail rotor bearing, the flight test loads demonstrated that there was little, if
any, margin for the effect of contact pressure on bearings by the full spectrum
of combinations of dynamic loads. Depending on what other regulations a
non-structural critical part is subject to, there may not be any applicable loads
analysis requirements or guidance at all.

The exposure durations for each of the load conditions used to calculate the
L10 life, and thus discard time of the bearing, are also an approximation using
an amalgamated flight profile, combining all the different roles the helicopter
can be used for. This produces an estimated percentage of the operating life
occurring at the various loads from the maximum to zero. Unlike Chapter Four
airworthiness limitations in the AMPI, in practice there is:

● No requirement to operate in accordance with this profile.

● No in-service monitoring of actual operating profiles.

● No penalty life tariff applied to the tail rotor bearings for

helicopters which operate for longer at higher loads and
contact pressures.

© Crown Copyright 2023 189 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

As with the other aspects relating to management of critical parts, the example
of how this is covered in much greater depth by the regulation CS-E.515 for
engines, can be found in Appendix F. The following Safety Recommendation
is made:

Safety Recommendation 2023-024

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to provide guidance and
set minimum standards for the calculation of design load spectrums
for non-structural critical parts. They must encompass, with an
appropriate and defined safety margin, the highest individual
operating load and combination of dynamic operating loads, and the
longest duration of exposure to such loads that can be experienced
in operation.

System safety analysis

Analysis

The certification process for the tail rotor system conducted by the helicopter
manufacturer identified that the consequences of failure of the duplex bearing
would be potentially catastrophic, but it did not correctly identify the mechanism
by which this would eventually occur. Compliance with the various certification
requirements during development did offer opportunities to identify and mitigate
the failure sequence seen in the accident, but these opportunities were not
realised at the time.

The failure mitigation recommended by the bearing manufacturer and employed

by the helicopter manufacturer to prevent in-service failure of the duplex
bearing, was a repetitive 400 hour subjective inspection for wear and smooth
rotation of the bearing and a 2,400 hour discard time for the bearing.

Given that the bearing was a sealed unit and could not be checked internally,
the maintenance inspection, even if carried out identically each time, would
only have been able to identify gross issues with the bearing and was less
reliable in outcome than a task with empirical acceptance and rejection criteria.
Failure of the accident bearing, and others rejected in service, demonstrated
that the 400 hour interval was too infrequent to address all possible causes of
bearing degradation before they became catastrophic.

Though the failure analysis work conducted by the manufacturer of the

helicopter identified that the failure of the duplex bearing and the castellated
locking nut on the bearing end of the TRA control shaft would be catastrophic
and the TRA manufacturer identified that failure of the castellated locking nut on
the actuator end leading to loss of feedback control would be catastrophic; the

© Crown Copyright 2023 190 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

failure mechanism of the shaft rotating in the opposite direction to the thread
on the actuator end locking nut, resulting in it ‘unscrewing’, was not identified
as a potential outcome.

The AW139 was designed to have a left-hand thread on the actuator shaft and
locking feature, to prevent it unscrewing if the actuator shaft rotated following a
bearing failure. This suggests that the failure mode had been considered as part
of the AW139 development. An AW139 bearing failure in 2012 demonstrated
that this design successfully prevented the actuator shaft from unscrewing from
the pin holder.

Whilst the subsequent bearing failure still resulted in a disconnection of the

pilot’s controls from the tail rotor blades, it allowed the actuator feedback system
to remain connected, resulting in the blades moving to a relatively neutral
position rather than driving to an extreme position as seen in this accident.
This was all known to the helicopter manufacturer at the time the AW169 and
AW189 tail rotor actuator was being developed, but the experience from the

Analysis
AW139 appears not to have crossed between product design teams or to the
subcontract supplier of the actuator. The modification introducing a left-hand
thread on the actuator has subsequently been introduced into service by the
helicopter manufacturer on the AW169 and AW189 post-accident. Whilst this
change alone may not have prevented the accident, it directly addresses a
step within the accident sequence and the airworthiness authority considered it
significant enough to mandate the change.

In a similar manner the castellated locking nuts on both ends of the shaft were
identified as safety critical, requiring double locking features to comply with
CS 29.607. However, the safety locking features employed were generic to
vibration related issues. As such, they were not designed to prevent the locking
nut from unscrewing against rotation driven by tail rotor drive torque during the
accident sequence.

The existing certification requirements in CS 29.547 and CS 29.1309 and

their Acceptable Means of Compliance (AMC) guidance, require a design
assessment and failure analysis to be conducted to identify hazardous and
catastrophic component failures within the tail rotor and its control system and
minimise their occurrence to an acceptable level of probability. Indeed, the
latest version of CS 29.1309 now goes further to state that no catastrophic
failure should occur from a single cause.

Under the current interpretation of these regulations, the European Union

airworthiness authority confirmed that there was no requirement to further
assess the consequences of any component failure once that failure is
classified as catastrophic. However, the failure of the duplex bearing and

© Crown Copyright 2023 191 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

the release of the castellated locking nut in this accident only became
catastrophic when the consequences of that failure affected the surrounding
system in which they operated.

As this accident demonstrates, where a bearing failure can lead directly to a

catastrophic outcome, it is not enough to rely solely on statistically derived
mitigations such as L10 life and the inspection efficacy and interval. It is just as
important to try to mitigate the severity of the outcome as well as minimising
occurrence. Manufacturers can employ additional techniques such as vibration
and temperature or condition monitoring, along with a more in-depth and
integrated failure analysis of the wider system to identify potential mechanical
design changes, such as redundancy and damage or failure tolerant features,
in combination with the statistical analysis. For example, the testing carried
out during this investigation has shown that torque sensors on the control shaft
can detect the initial transfer of torque by the bearing due to incipient seizure,
before the damage reaches a stage where the bearing seizes completely and
catastrophically, offering a potential early warning indication.
Analysis

The safety actions introduced by the helicopter manufacturer and mandated

by the airworthiness authority after the accident, show that aspects of this
approach have subsequently been taken to retain the airworthiness of the
AW169 and AW189 fleet. Lessons learnt from this should be incorporated
into certification requirements to prevent future accidents. The change
to the AMC for CS 29.571 in CS 29, Amendment 11 recommends taking a
fail-safe approach to critical component design, but this is only aimed at
structural components rather than control systems. This does not go far enough
to address the need to review the entire system for mitigation options for failures
initially assessed as catastrophic. This regulation was also not considered as
part of the demonstration of compliance for either the tail rotor (including the
duplex bearing) or the tail rotor hydraulic actuator.

The following Safety Recommendation is made:

Safety Recommendation 2023-025

It is recommended that the European Union Aviation Safety Agency

amend the relevant requirements of Certification Specification 29
and their Acceptable Means of Compliance to emphasise that,
where potentially catastrophic failure modes are identified, rather
than rely solely on statistical analysis to address the risk, the wider
system should also be reviewed for practical mitigation options,
such as early warning systems and failure tolerant design, in order
to mitigate the severity of the outcome as well as the likelihood of
occurrence.

© Crown Copyright 2023 192 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

2.10 Safety Actions

The helicopter manufacturer took immediate steps following the accident

to introduce inspections of the tail rotor duplex bearing on both AW169 and
AW189 helicopters in service. These were mandated by EASA Airworthiness
Directives.

Emergency AD 2018-0241-E was issued 7 November 2018 and

referenced ASB 169-120 and 189-213 on 5 and 6 November 2018.
It mandated a one-time visual inspection of the servo-actuator
installation to identify movement of the castellated locking nut.

Emergency AD 2018-0250-E was issued on 19 November 2018. In

addition to the requirements of the first AD, a precautionary one-off
inspection of the duplex bearing was added.

The helicopter manufacturer then published ASB 169-125 and

ASB 189-214 on 21 November 2018. Consequently, the EASA

Analysis
issued Emergency AD 2018-0252-E to mandate them. This
introduced a one-time inspection and breakaway torque check
of the duplex bearing and inspection and reinstallation of the
servo‑actuator castellated locking nut.

It was then determined that repetitive inspections of the duplex

bearing were necessary for continued monitoring of the fleet. The
helicopter manufacturer published ASB 169-126 and ASB 189-217
accordingly, and EASA issued Emergency AD 2018-0261-E on
30 November 2018 to mandate these inspections.

In the period following the introduction of these inspections, tail rotor system rig
tests were being conducted by the helicopter manufacturer (see section 1.16.1).
The test results showed that as the duplex bearing degraded, its operating
temperature increased consistently.

A modification was developed by the helicopter manufacturer to

install and repetitively inspect a thermal strip on the bearing end
of the tail rotor actuator control shaft. This was introduced in ASB
169-135 and ASB 189-224 and mandated by the EASA through
the issue of AD 2019-0023 on 1 February 2019.

Operator feedback from the repetitive tail rotor inspections

allowed improved techniques to be developed and the helicopter
manufacturer published ASB 169-148 and 189-237 on 29 May 2019,
to provide instructions for more in-depth inspections of the duplex

© Crown Copyright 2023 193 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

bearing. The EASA issued AD 2019-0121 on 3 June 2019

to require accomplishment of these actions. Later revised to
AD 2019‑0121(R1).

The helicopter manufacturer introduced into service a modification

to the Vibration Health Monitoring (VHM) system fitted to the
AW169 and AW189 by issuing SB 169-140 and SB 189-227. The
modification relocated an existing accelerometer sensor on the
tail to the servo-actuator control lever, to allow monitoring of the
vibration signature of the duplex bearing and provide an optional
aid for the continued airworthiness of the fleet.

Whilst the modification itself was not mandated, the reporting

of data from helicopters with the modification installed, was
mandated. This requirement was included in EASA AD 2019-0193
issued 7 August 2019, which also included all the other inspection
requirements and superseded AD 2019-0121(R1).
Analysis

Modifications were introduced into service to address the findings

of the investigation.

In early 2020, the helicopter manufacturer issued modification

Service Bulletins 169-153 and 189-249. These introduced a new
standard of tail rotor actuator. The control shaft now has a left-hand
thread on the castellated lock nut and an additional washer fitted to
the actuator end of the shaft. The EASA then issued Airworthiness
Directive 2020-0048 on 6 March 2020, which superseded AD 2019-
0193. This AD mandated the fitment of the new standard control
actuator, with one-way interchangeability11. Fitting of the modified
actuator alleviated the requirement to conduct an inspection of
the castellated lock nut every 10 flight hours. All the additional
inspections were retained in the new AD.

The final change by the manufacturer was to develop a new tail

rotor duplex bearing introduced into service by Service Bulletins
169-162 and 189-254 on 4 August 2020.

Replacement with the new bearing was required within 400 flight
hours or 4 calendar months of the SB issue date. The new bearing
replaced the ceramic balls with steel balls. The new bearing had an
introductory life limit of 400 flight hours. The Service Bulletin also

11 The old part number actuator can be replaced by the new part number actuator, but not the other way
around.

© Crown Copyright 2023 194 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

required time expired bearings to be returned to the manufacturer

for inspection following replacement.

Service Bulletins 169-178 and 189-272 were also issued on 4

August 2020 to increase the inspection intervals for the new bearing.
The 10 hour repeat inspections of the thermal strip and the bearing
were extended to 50 hour repeat inspections. While the 20 and 50
hour checks were extended to 100 hours, the 200 hour check was
reduced to 100 hours.

EASA issued AD 2020-0197 on 10 September 2020 to mandate

the SBs for fitment of the new bearing design and to extend the
inspection intervals.

The day after the accident the operator took the following safety action:

All the operator’s other company operated AW169 were grounded

Analysis
and, in accordance with their SMS procedure, did not resume
operations until 30 November 2018, at which point the operator
was satisfied that sufficient action had been taken to establish
continuing airworthiness of the helicopter.

2.11 Operational oversight

Onshore helicopter operations are diverse in both their nature and the number
of different types used. This diversity poses a challenge for the development of
meaningful FDM algorithms that might compliment the operational supervision
of helicopters, such as the AW169 type, equipped with FDM-capable systems.
With such a widespread footprint, the airworthiness authority relies on operators
to maintain effective tactical oversight of these operations. Without active and
effective in-cockpit monitoring systems, comprehensive day-to-day oversight of
single-pilot helicopter operations is impractical.

2.12 HUMS

The AW169 helicopter’s systems incorporate vibration monitoring functions

that are used in conjunction with Heliwise, a ground-based system, to detect
the degradation of key components in the transmission system. The system
gathers vibration data using accelerometers located strategically for the
target components. The sample rates and Health Index or Health Indicator
(HI) process algorithms are tuned to the target components. The trends in
the HI results can be tracked using Heliwise as it is these rather than the
absolute values, that indicate problems. The duplex bearing was not being
monitored by this system.

© Crown Copyright 2023 195 Section 2 - Analysis

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

The nearest sensor to the failed bearing was not in a location conducive to
detecting these failures. Even had it sensed vibrations of concern, the operator
did not, nor were they required to, upload the data for analysis after each
flight. The manufacturer has introduced a new accelerometer at a location
suitable for monitoring the tail rotor duplex bearing, with associated additional
data gathering and processing updates. When installed, upload of the data
recorded from it to the Heliwise system is mandated, but installation of the new
sensor is optional.

The raw data from the accident flight was lost but the processed data was
recovered. Historical HUMS data was also available. The last upload
from G-VSKP to the Heliwise system provided helicopter data from
11 September 2018 to 28 September 2018. The manufacturer reviewed the
available data for any issues and determined that no maintenance actions
would have been triggered.
Analysis

© Crown Copyright 2023 196 Section 2 - Analysis

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

3 Conclusions

3.1 Findings

1. G-VSKP was operated out of Fairoaks Airport in compliance with the

requirements for non-commercial operations with complex motor-powered
aircraft established in Commission Regulation (EU) No 965/2012, in
particular in Annex VI (Part-NCC).

2. The pilot was correctly licensed and qualified to conduct the flight.

3. The congested area permission for operations at the King Power Stadium
required a Cat A departure to mitigate the risk of engine failure.

4. The average rate of climb during the accident flight rearwards climb
exceeded the Cat A profile’s parameters but the additional torque demand
did not materially affect the post-failure controllability of the helicopter.

5. The helicopter was above an appropriate TDP height when the pilot
committed to a CTO.

6. When above TDP height, but before completing the Cat A procedure
acceleration profile, the pilot initiated a turn to the right while transitioning
to forward flight.

Conclusions
7. A right yaw pedal input during the turn initiation resulted in the tail rotor
actuator control shaft moving to the right under hydraulic pressure from
the actuator.

8. The tail rotor duplex bearing seized resulting in the tail rotor actuator
control shaft, driven by the high torque tail rotor drive system, rotating at
high speed.

9. The axial movement of the tail rotor actuator control shaft maintained
contact pressure between the pin carrier and the lock nut, causing the nut
and pin carrier to friction weld together.

10. Both secondary locking features on the castellated locking nut at the
actuator end of the shaft failed under the torque from the rotating shaft,
and the control shaft unscrewed from the nut.

© Crown Copyright 2023 197 Section 3 - Conclusions

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

11. Once the control shaft was detached from the pin carrier, the feedback
mechanism of the hydraulic control system became ineffective, and the
control shaft continued to move under hydraulic pressure until the pitch
of the tail rotor blades reached its physical limit of travel.

12. The rate of yaw of the helicopter continued to increase rapidly due to
the unopposed main rotor torque couple and negative tail rotor blade
pitch angle.

13. The pilot’s yaw control pedals became ineffective after the TRA control
shaft detached, resulting in the pilot being unable to control the direction
or rate of yaw of the helicopter.

14. Without effective yaw control the pilot was unable to control the horizontal
trajectory of the helicopter.

15. Cross-coupling of forces generated around the helicopter’s normal axis

by the high yaw rate, led to large deviations in pitch and roll.

16. Startle, surprise, disorientation and reduced visual cues due to the
darkness were likely to have been performance shaping factors for the pilot
response time; nonetheless, it was within the range expected considering
simulator research, previous accidents and the circumstances when the
failure occurred.
Conclusions

17. The position of the helicopter above the stadium roof at the point of loss
of yaw control, may also have influenced the pilot’s response.

18. The pilot lowered the collective to reduce main rotor thrust, thereby
reducing its contribution to the destabilising torque which was driving the
departure in yaw.

19. With the collective lowered the helicopter no longer had enough lift to
maintain height and began to descend.

20. As the helicopter approached the ground, the pilot reduced the rate of
descent by fully raising the collective lever.

21. The helicopter struck the ground across a 0.5 m step in the concrete
surface of an area of rough ground and came to rest on its left side.

22. The analysis of the impact forces, experienced by the helicopter when
it struck the step, indicated that they probably exceeded the design
requirements of the helicopter.

© Crown Copyright 2023 198 Section 3 - Conclusions

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

23. The impact absorption features of the passenger cabin seats operated as
designed and their condition indicated that the vertical deceleration force
experienced by the passengers exceeded 30 g.

24. All the occupants suffered significant impact injuries; for one occupant
these were likely to have been fatal.

25. Impact with the step resulted in disruption of the helicopter’s fuel tanks
allowing fuel to pool around the fuselage. This subsequently ignited.

26. The damage caused to the helicopter and its orientation provided
numerous potential ignition sources for the leaking fuel.

27. First responders arrived at the accident site within one minute of the
helicopter striking the ground and attempted to gain access to the cockpit
and cabin. They were unable to do so due to the orientation of the
fuselage, the strength of the cockpit windscreen and the rapid increase
in the intensity of the fire.

28. The helicopter was rapidly engulfed by fire and the occupants who
survived the initial impact died from inhaling the products of combustion.

29. Simulator trials confirmed to the investigation that the loss of yaw control
was irrecoverable.

Conclusions
30. The helicopter was compliant with all applicable airworthiness
requirements, had been correctly maintained and was appropriately
certified for release to service prior to the accident flight.

31. The condition of the tail rotor duplex bearing could not have been
predicted or identified by existing maintenance requirements prior to the
accident.

32. The condition of the tail rotor duplex bearing began to deteriorate well
before the accident flight.

33. An increase in contact pressure and temperature within the bearing

races from a combination of axial and bending moment loads likely
resulted in lubrication starvation events and degradation of the grease
through aging.

34. High contact pressures and deterioration of the grease likely contributed
to increased sliding of the ceramic balls leading to high surface shear
stress and the development of surface initiated rolling contact fatigue.

© Crown Copyright 2023 199 Section 3 - Conclusions

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

35. The surface initiation of the cracks, shallow DER and the zone of changed
material properties directly below the race surface were all indicative of
the ceramic balls sliding rather than rolling.

36. The rolling contact fatigue resulted in distinctive surface initiated cracking
which then progressed to extensive liberation of the race surface material.

37. The increased friction between the balls and the damaged race surface
resulted in further heat generation which degraded the grease until it
became powdered carbon and created a zone of changed material
properties below the race surface.

38. The erratic movement of the balls across the rolling surface placed high
loads on the bearing cage, resulting in wear and fatigue fractures.

39. Failure of the cage allowed the balls to move unrestrained across the
race surface increasing the extent of the damage.

40. Released material from the cage and race surfaces was ground to dust
by the action of the balls and combined with the carbon dust to be re-laid
as a new rolling surface for the race.

41. The non-homogeneous and extensively cracked new rolling surface

suffered further rolling contact fatigue, causing large sections of material
Conclusions

to be released.

42. Eventually the dimensional clearances were reduced by the released

material to the extent that the bearing seized.

43. Once the level of damage reached a certain threshold it became self-
perpetuating under all operational loads, with an accelerating rate of
progression towards ultimate failure of the bearing.

44. Rig test data analysis conducted during the investigation identified that
high contact pressures within the bearing were sufficient to initiate a
damage cycle that could result in incipient seizure of the bearing before
the discard life of 2,400 hours.1

1 The 2,400 hour life was based on assessment of the original development load spectrum. The highest
actual contact pressure during the test was higher than the highest development spectrum contact
pressure after the spectrum had been reassessed using the latest standard of modelling software. See
section 1.16.1.4.

© Crown Copyright 2023 200 Section 3 - Conclusions

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

45. Rig and flight test data analysis identified that a limited subset of
manoeuvres within the normal operating envelope of the helicopter
generated combined loads sufficient to cause potentially damaging
contact pressures within the bearing.

46. Based on all the evidence available, it was likely that the accident
helicopter tail rotor duplex bearing failed due to premature grease
deterioration and accumulation of race damage, caused by high contact
pressures, resulting from routinely conducted manoeuvres within the
approved operating envelope of the helicopter.

47. The extent of damage observed on all the bearings investigated was
not consistent with a simple relationship with increasing flight hours: the
accident bearing showed the maximum level of distress, whilst having
the lowest service life.

48. The inherent flexibility in helicopter manoeuvres and diversity of

atmospheric conditions in which they operate, results in significant
potential variability in the duration, magnitude and frequency of
exposure to the potentially damaging contact pressures associated with
this subset of manoeuvres.

49. These differences in the timing and severity of exposure to high contact
pressures, for each individual helicopter affected, resulted in significant

Conclusions
potential variation in the accrued bearing life at which accumulation of
damage was initiated, the rate at which the damage progressed towards
failure and the extent of the damage observable at the time when they
were inspected, following removal from service due to a maintenance
inspection or as the result of an incident or accident.

50. In addition to the bearings chosen to be part of the investigation, it’s

possible that others removed from service had developed damage to
some degree but were either not returned to the manufacturer or were not
subjected to the same disassembly inspection to identify and document
the damage.

51. Some helicopters in the AW169 and AW189 fleet may never have been
subject to manoeuvres which generated contact pressures sufficient to
cause premature damage, prior to the bearing being removed at the
required discard life or replaced by the new standard bearing.

52. Findings 46-49 in combination may help to explain why only a relatively
small number of tail rotor hybrid bearings operated in AW169s and
AW189s either failed or were confirmed to have suffered damage.

© Crown Copyright 2023 201 Section 3 - Conclusions

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

53. Certification testing for the tail rotor duplex bearing on both the AW169
and AW189 was compliant with the regulatory requirements.

54. There were no certification design or test requirements explicitly

addressing rolling contact fatigue in bearings used on helicopters certified
to CS 29.

55. The duplex bearings fitted to the flight test helicopters during certification
flight testing of the AW169 and AW189 were not removed for detailed
inspection at the end of the certification flight test programme, nor were
they required to be for certification of the tail rotor control system.

56. The flight test results for tail rotor axial and bending moment loads were
not shared with the bearing manufacturer in order to use their proprietary
modelling software to validate the original analysis of the theoretical
load spectrum and assess the continued suitability of the bearing for this
application, nor were they required to be.

57. The failure analysis work conducted by the helicopter manufacturer

during certification correctly identified that failure of the duplex bearing
by seizure would be catastrophic.

58. The castellated locking nut on the tail rotor actuator end of the control
shaft was identified as a catastrophic single point of failure, but only
Conclusions

fracture of the nut or release due to vibration were considered.

59. Once the failure of any component was classified as catastrophic by the
manufacturer, no further analysis of the failure mode was required by the
airworthiness authority to meet certification requirements.

60. The failure mechanism of the shaft rotating in the opposite direction to
the thread on the actuator end locking nut, allowing the pin carrier and
nut to be released, was not identified by the AW169 certification analysis
as a potential outcome of the bearing seizing.

61. The pin carrier and actuator on the AW139 were designed with a reverse
thread to address the risk of bearing seizure and shaft rotation.

62. This failsafe design worked successfully during a tail rotor bearing failure
on an AW139 in 2012, around the same time the design of the AW169
and AW189 actuator was being developed.

© Crown Copyright 2023 202 Section 3 - Conclusions

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

63. Compliance with the various certification risk assessment requirements

during development offered opportunities to identify and mitigate the
failure sequence seen in the accident, but these opportunities were not
realised at the time, in part due to a reliance on statistical analysis to
mitigate risk.

64. Although classed as a critical part, prior to the accident, the manufacturer
of the helicopter did not require bearings removed from service to be
returned to facilitate an inspection of their condition; nor was there any
regulatory requirement or guidance that required them to do so.

65. No requirements or guidance were provided in the regulations about how

critical part theoretical load spectrums should be calculated to ensure
adequate safety margins.

66. From the extensive accident helicopter flight data recovered, no flight
system problems were evident before the accident flight.

67. Logged faults were shown to be nuisance faults, evident on other

serviceable aircraft and prior to successful flights.

68. The recorded data showed a number of alerts were triggered during the
accident flight and related to the high yaw rate which developed after the
tail rotor failure.

Conclusions
69. Of the internally logged system faults that occurred during the accident
flight, only one could not be definitively attributed to nuisance issues, the
high rotation rate or impact. Time alignment indicated this occurred just
prior to impact and was not associated with the bearing failure or flight
controllability.

70. The high yaw rate, peaking at 209°/s, would have generated significant
forces on the occupants of the cockpit given their distance from the centre
of gravity of the helicopter.

71. HUMS was installed capable of identifying increasing vibration trends in

key components, but its use was not required for NCC operations.

72. The accelerometers fitted at the time for the purpose of vibration
monitoring were not positioned to detect vibrations on the critical bearing
that failed and were unlikely to do so.

73. The data from the closest accelerometer to the failed bearing was lost in
the fire.

© Crown Copyright 2023 203 Section 3 - Conclusions

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

3.2 Causal Factors

1. Seizure of the tail rotor duplex bearing initiated a sequence of failures in the
tail rotor pitch control mechanism which culminated in the unrecoverable
loss of control of the tail rotor blade pitch angle and the blades moving to
their physical limit of travel.

2. The unopposed main rotor torque couple and negative tail rotor blade
pitch angle resulted in an increasing rate of rotation of the helicopter in
yaw, which induced pitch and roll deviations and made effective control
of the helicopter’s flightpath impossible.

3. The tail rotor duplex bearing likely experienced a combination of dynamic

axial and bending moment loads which generated internal contact
pressures sufficient to result in lubrication breakdown and the balls sliding
across the race surface. This caused premature, surface initiated rolling
contact fatigue damage to accumulate until the bearing seized.

3.3 Contributory Factors

1. The load survey flight test results were not shared by the helicopter
manufacturer with the bearing manufacturer in order to validate the
original analysis of the theoretical load spectrum and assess the continued
suitability of the bearing for this application, nor were they required to be
Conclusions

by the regulatory requirements and guidance.

2. There were no design or test requirements in Certification Specification

29 which explicitly addressed rolling contact fatigue in bearings identified
as critical parts; while the certification testing of the duplex bearing met
the airworthiness authority’s Acceptable Means of Compliance, it was
not sufficiently representative of operational demands to identify the
failure mode.

3. The manufacturer of the helicopter did not implement a routine inspection

requirement for critical part bearings removed from service to review their
condition against original design and certification assumptions, nor were
they required to by the regulatory requirements and guidance.

4. Although the failure of the duplex bearing was classified as catastrophic

in the certification failure analysis, the various failure sequences and
possible risk reduction and mitigation measures within the wider tail rotor
control system were not fully considered in the certification process; the
regulatory guidance stated that this was not required.

© Crown Copyright 2023 204 Section 3 - Conclusions

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

4 Safety Recommendations and Actions

4.1 Safety Recommendations

The following Safety Recommendations were made:

Safety Recommendation 2023-018

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to require type design
manufacturers to provide the results of all relevant system and flight
testing to any supplier who retains the sole expertise to assess the
performance and reliability of components identified as critical parts
within a specific system application, to verify that such components
can safely meet the in-service operational demands, prior to the
certification of the overall system.

Safety Recommendation 2023-019

It is recommended that the European Union Aviation Safety Agency

introduce additional requirements to Certification Specification 29
to specifically address premature rolling contact fatigue failure
across the full operating spectrum and service life of bearings used
in safety critical applications.

Safety Recommendation 2023-020

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to define the airworthiness
status of life limits on non-structural critical parts and how they
should be controlled in service.

Recommendations
Safety Recommendation 2023-021
Safety
It is recommended that the European Union Aviation Safety Agency
define the airworthiness status of life limits and how they should
be controlled for existing non-structural critical parts approved to
Certification Specification 29.602 requirements, already in service.

Safety Recommendation 2023-022

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to require manufacturers
to implement a comprehensive post removal from service

© Crown Copyright 2023 205 Section 4 - Safety Recommmedations

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

assessment programme for critical parts. The findings from this

should be used to ensure that reliability and life assumptions in the
certification risk analysis for the critical part or the system in which
it operates remain valid.

Safety Recommendation 2023-023

It is recommended that the European Union Aviation Safety

Agency require manufacturers to retrospectively implement a
comprehensive post removal from service assessment programme
for critical parts, approved to Certification Specification 29.602
requirements, already in service. The findings from this should
be used to ensure that the reliability and life assumptions in the
certification risk analysis for the critical part or the system in which
it operates remain valid.

Safety Recommendation 2023-024

It is recommended that the European Union Aviation Safety Agency

amend Certification Specification 29.602 to provide guidance and
set minimum standards for the calculation of design load spectrums
for non-structural critical parts. They must encompass, with an
appropriate and defined safety margin, the highest individual
operating load and combination of dynamic operating loads, and the
longest duration of exposure to such loads that can be experienced
in operation.

Safety Recommendation 2023-025

It is recommended that the European Union Aviation Safety Agency

Recommendations

amend the relevant requirements of Certification Specification 29

and their Acceptable Means of Compliance to emphasise that
Safety

where potentially catastrophic failure modes are identified, rather

than rely solely on statistical analysis to address the risk, the wider
system should also be reviewed for practical mitigation options,
such as early warning systems and failure tolerant design, in order
to mitigate the severity of the outcome as well as the likelihood of
occurrence.

© Crown Copyright 2023 206 Section 4 - Safety Recommmedations

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

4.2 Safety action

This report presents the following safety actions:

Safety action by the airworthiness authority

Emergency AD 2018-0241-E was issued 7 November 2018 to

mandate ASB 169-120 and 189-213. This required a one-time visual
inspection of the servo-actuator installation to identify movement of
the castellated locking nut.

Emergency AD 2018-0250-E was issued on 19 November 2018. In

addition to the requirements of the first AD, a precautionary one-off
inspection of the duplex bearing was introduced.

EASA issued Emergency AD 2018-0252-E on 21 November 2018

to mandate ASB 169-125 and ASB 189-214. This introduced a
one‑time inspection and breakaway torque check of the duplex
bearing, inspection and reinstallation of the servo-actuator
castellated locking nut.

EASA issued Emergency AD 2018-0261-E on 30 November 2018

to mandate ASB 169-126 and ASB 189-217 to introduce repeat
inspections.

EASA issued AD 2019-0023 on 1 February 2019 to mandate

ASB 169-135 and ASB 189-224. These introduced a modification
developed by the helicopter manufacturer to install and repetitively
inspect a thermal strip on the bearing end of the tail rotor actuator
control shaft.

Recommendations
EASA issued AD 2019-0121 on 3 June 2019, later revised to
AD 2019-0121(R1), to require accomplishment of ASB 169-148 and
189-237, which provided instructions for more in-depth inspections Safety
of the duplex bearing.

EASA issued AD 2019-0193 on 7 August 2019, which

mandated reporting from the new Vibration Health Monitoring
modification introduced by the helicopter manufacturer, it also
included all the other inspection requirements and superseded
AD 2019‑0121(R1).

The EASA issued Airworthiness Directive 2020-0048 on

6 March 2020, which superseded AD 2019-0193. This AD

© Crown Copyright 2023 207 Section 4 - Safety Recommmedations

 Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

mandated the fitment of the new standard control actuator, with

one-way interchangeability1. Fitting of the modified actuator
alleviated the requirement to conduct an inspection of the lock nut
every 10 flight hours. All the additional inspections were retained
in the new AD.

EASA issued AD 2020-0197 on 24 September 2020 to mandate

the replacement of the tail rotor duplex bearing with a new design
which used steel ball bearings rather than ceramic. The new
bearing was introduced with a life limit of 400 flight hours. This
allowed an extension of the inspection intervals on the thermal strip
and bearing.

Safety action by the helicopter manufacturer

ASB 169-120 and 189-213 were issued on by the helicopter

manufacturer. This required a one-time visual inspection of the
servo-actuator installation to identify movement of the locking nut.

The helicopter manufacturer published ASB 169-125 and

ASB 189‑214. This introduced a one-time inspection and breakaway
torque check of the duplex bearing, inspection and reinstallation of
the servo-actuator castellated nut.

The helicopter manufacturer published ASB 169-126 and

ASB 189‑217 to introduce repeat inspections of the bearing and
lock nut.

A modification was developed by the helicopter manufacturer to

install and repetitively inspect a thermal strip on the bearing end
Recommendations

of the tail rotor actuator control shaft. This was introduced in

ASB 169‑135 and ASB 189-224.
Safety

Operator feedback from the repetitive tail rotor inspections

allowed improved techniques to be developed and the helicopter
manufacturer published ASB 169-148 and 189-237, to provide
instructions for more in-depth inspections of the duplex bearing.

The helicopter manufacturer introduced into service a modification

to the Vibration Health Monitoring (VHM) system fitted to the
AW169 and AW189 by issuing SBs 169-140 and 189-227. The
modification relocated an existing accelerometer sensor on the

1 The old part number actuator can be replaced by the new part number actuator, but not the other way
around.

© Crown Copyright 2023 208 Section 4 - Safety Recommmedations

Aircraft Accident Report: 1/2023 G-VSKP AAIB-25398

tail to the servo‑actuator control lever, to allow monitoring of the

vibration signature of the duplex bearing as an optional aid to
continued airworthiness.

In early 2020 the helicopter manufacturer issued modification

Service Bulletins 169-153 and 189-249. These introduced a
new standard of tail rotor actuator with a left-hand thread on the
castellated lock nut and a washer, fitted to the actuator end of the
shaft.

The manufacturer introduced a new tail rotor duplex bearing into

service by issuing Service Bulletins 169-162 and 189-254 on
4 August 2020. Replacement with the new bearing was required
within 400 flight hours or 4 calendar months of the SB issue date.
The new bearing replaced the ceramic balls with steel balls. The
new bearing had an introductory life limit of 400 flight hours. The
Service Bulletin also required time expired bearings to be returned
to the manufacturer for inspection following replacement.

Service Bulletins 169-178 and 189-272 were also issued on

4 August 2020 to increase the inspection intervals for the new
bearing. The 10 hour repeat inspections of the thermal strip and
the bearing were extended to 50 hour repeat inspections. While
the 20 and 50 hour checks were extended to 100 hours and the
200 hour check reduced to 100 hours.

Safety action by the helicopter operator

The operator grounded all company operated AW169 the day after
the accident and, in accordance with its SMS procedure, did not

Recommendations
resume operations until the 30 November 2018 when they were
satisfied that sufficient action had been taken to establish the
airworthiness of the aircraft. Safety

© Crown Copyright 2023 209 Section 4 - Safety Recommmedations

Intentionally left blank
Unless otherwise indicated, recommendations
in this report are addressed to the appropriate
regulatory authorities having responsibility for
the matters with which the recommendation is
concerned. It is for those authorities to decide
what action is taken. In the United Kingdom the
responsible authority is the Civil Aviation
Authority, Aviation House, Beehive Ringroad,
Crawley, West Sussex, RH6 0YR.
 AIRCRAFT ACCIDENT REPORT 1/2023

AAIB
Air Accidents Investigation Branch

AIRCRAFT ACCIDENT REPORT 1/2023

Report on the accident to
Leonardo AW169, G-VSKP
at King Power Stadium, Leicester
on 27 October 2018

G-VSKP

Aircraft Accident Report 1/2023

Report on the accident to
Leonardo AW169, G-VSKP
at King Power Stadium, Leicester
on 27 October 2018