Flight For Life: Anatomy of an Accident

Earlier this week, the U.S. National Transportation Safety Board (NTSB) convened to determine the cause of a fatal helicopter accident in Frisco, Colorado, in 2015.

The crash of the Flight For Life helicopter — an Airbus Helicopters H125 (AS350 B3e) — killed Air Methods pilot Patrick Mahany and seriously injured two flight nurses, David Repsher and Matthew Bowe. In a horrific post-crash fire that was captured on video, Repsher sustained burns to over 90 percent of his body and was hospitalized for over a year.

The dramatic footage of the accident prompted a national conversation about civil helicopter crashworthiness that has already led to a commitment by major U.S. helicopter air ambulance (HAA) operators, including Air Methods, to retrofit their fleets with crash-resistant fuel systems. It also lent urgency to the creation, by the Federal Aviation Administration (FAA), of a Rotorcraft Occupant Protection Working Group — a first step toward mandating wider adoption of crash-resistant technology.

But the NTSB’s investigation into the Flight For Life crash highlights additional far-reaching issues. It reveals the serious challenges of managing the world’s largest air medical operator, Air Methods, as well as persistent shortcomings with the FAA’s oversight of HAA operators. It calls into doubt official FAA guidance on conducting maximum-performance takeoffs.

And it returns attention to the design of the AS350 “AStar” hydraulic system, which has been implicated in previous incidents and accidents. In its March 28 ruling of probable cause, the NTSB placed the blame for the Flight For Life crash squarely on Airbus. However, in failing to aggressively address a known safety issue, the FAA and Air Methods missed opportunities to prevent the tragedy as well.

In an industry in which design compromises abound, the Flight For Life accident highlights a complex question. To what extent should a regulator, manufacturer, operator, or individual pilot be responsible for compensating for the potential for pilot error in an aircraft’s design?

A Less-Than-Ideal Solution

The aircraft system at the center of the Flight For Life crash is the yaw load compensator, which is installed in parallel with the tail rotor servo on AS350 B1 and higher models.

As the manufacturer made each successive AS350 variant more powerful, the necessary tail rotor authority was provided by increasing the aft tail rotor blade surface area with progressively larger trim tabs — rather than redesigning the tail rotor entirely. This solution was effective, but it came at the cost of a stronger tendency for the blades to return to zero pitch during flight.

In normal, hydraulically-boosted flight, the tail rotor servo actuator pressure cancels out this tendency, and loads on the pilot’s anti-torque pedals are light. But if the aircraft were to lose hydraulic pressure, the pedal loads would increase to unacceptable levels without another form of assistance.

That alternate form of assistance is what the yaw load compensator provides. By trapping some hydraulic fluid in an accumulator using a check valve, the yaw load compensator allows the average pilot to control the helicopter in the event of a hydraulic system failure, as required for aircraft certification. When relying on the yaw load compensator, pedal loads increase significantly, but remain manageable.

The yaw load compensator has always been a design compromise; an expedient solution, not an ideal one. And with its latest AS350 variant — the AS350 B3e, now known as the H125 — Airbus did attempt to move away from it.

The H125 was originally designed with additional tail rotor balancing weights in lieu of the yaw load compensator, but the weights ended up putting excessive stress on the tail rotor’s laminated half-shell bearings. Following an accident in September 2012 that led to an emergency airworthiness directive, the H125 was redesigned to remove the extra balancing weights and revert to the yaw load compensator.

In dual-hydraulic AS350 models, including the H125, the tail rotor servo and yaw load compensator are powered only by the lower, or No. 2, hydraulic circuit. In the event of a tail rotor servo malfunction, the pilot can cut off pressure to the tail circuit by turning a collective-mounted yaw servo isolation switch to “off.” If the check valve is functioning properly, then the pilot will receive assistance from the yaw load compensator following the loss of hydraulic pressure.

Until procedural changes were implemented in the wake of the Flight For Life crash, testing this functionality in a dual-hydraulic AStar was part of a pilot’s pre-takeoff checks. The pilot would turn the collective-mounted isolation switch to “off” and feel for increased but manageable loads in the pedals.

Then, the pilot would test for the ability to depressurize the yaw load compensator’s accumulator by pressing the ACCU TEST button on the control console and verifying that the pedals became very stiff. (The ability to depressurize the accumulator is necessary in order to return the tail rotor blades to zero pitch in the event of certain tail rotor control failures.)

The pilot would conclude the pre-takeoff test by resetting the ACCU TEST button, restoring the collective-mounted isolation switch to “on,” and feeling for normal hydraulic assistance to the pedals.

The test sequence was straightforward for any pilot with a thorough understanding of the system. But it also contained a potential pitfall. If a distracted pilot depressurized the yaw load compensator accumulator without resetting the collective switch to “on,” there was no warning light to alert him or her to the oversight — and the pilot could take off without any hydraulic assistance to the pedals.

An accident in Albuquerque, New Mexico, in April 2014 called attention to this possibility in the dual-hydraulic H125. In that event, which was captured by a nearby security camera, a PHI Air Medical H125 began spinning to the left as it lifted from the University of New Mexico Hospital’s rooftop helipad. The aircraft impacted the rooftop and came to rest next to the helipad, luckily causing only minor injuries to the pilot and two medical crewmembers on board.

According to the NTSB’s report on the accident, the pilot recalled that the anti-torque pedals “felt jammed or locked in the neutral position.” The pilot added that during the spin, he looked for a warning light but did not see one.

The pilot’s collective-mounted yaw servo isolation switch was found in the “on” position, the correct position for flight. But examination of the aircraft did not find any abnormalities that could have explained the loss of yaw control, and without a cockpit video recorder, investigators were unable to establish the position of the switch prior to takeoff.

The NTSB declared the probable cause of the accident to be “the pilot’s loss of yaw control during takeoff due to the absence of hydraulic boost to the tail rotor pedals for reasons that could not be determined based on the available information.” A finding in the accident was the lack of a caution indicator to alert the pilot of the lower hydraulic system configuration.

While the PHI accident was inconclusive, an incident in Temple, Texas, two months later provided stronger evidence that the “switchology” in dual-hydraulic AStars could be problematic. In that event, an AS350 B3 operated by Air Methods began to spin to the left upon lift-off following refueling at a local airport. The pilot executed a hovering autorotation and was uninjured, as were the two crewmembers on board.

This time, the yaw servo isolation switch was found in the “off” position. In subsequent testing using a hydraulic mule, the hydraulic system was found to be fully functional, and normal assistance was restored to the pedals when the switch was returned to “on.”

In its report on the incident, the NTSB found the probable cause of the accident to be “the pilot’s failure to reposition the yaw servo hydraulic switch to the ‘on’ position during the pre-takeoff hydraulic system check, which resulted in a complete lack of hydraulic boost to the tail rotor system and increased the load required to move the control pedals.”

In August 2014, motivated by the Texas incident and one other event, Airbus Helicopters issued a safety information notice for operators of dual-hydraulic AS350 B3, AS550 C3, and AS355/AS555 aircraft, calling attention to the possibility of taking off without hydraulic assistance to the tail rotor, and carefully explaining each step of the pre-takeoff hydraulic checks.

The notice also announced a modification to new-production H125s to incorporate a flashing warning light when the yaw servo isolation switch is in the “off” position. A service bulletin to retrofit existing dual-hydraulic AS350 models with the warning light followed in February 2015, but it was not mandatory, and the FAA did not adopt it as an airworthiness directive — leaving it up to operators to decide whether or not to comply with the bulletin.

Organizational Blind Spots

This is where accounts of who at Air Methods knew what, and when, become confused and contradictory.

In late August 2014, Vertical contacted Air Methods to ask how the company was responding to the incident in Texas and the associated safety information notice, “perhaps through changes to training or operational procedures?” An Air Methods spokesperson responded, “This is an open NTSB investigation, so it wouldn’t be appropriate to discuss the details at this time.”

However, it is not clear that key operations personnel were even aware of the incident and safety notice, let alone responding to them actively. In interview transcripts included in the NTSB’s public docket, Air Methods’ interim chief pilot at the time of the Frisco crash said he was aware of the 2014 safety notice and also aware of the company’s “hard landing” in Texas, but said he “did not study” the Texas incident.

The director of operations said he was aware of the safety notice prior to the Frisco crash. However, as to whether safety information was communicated to Air Methods pilots following the Texas incident, he said, “I’m not aware if there was or there wasn’t . . . other than what I was told, that the training cadre had a document that they were sharing with the pilots.”

One Air Methods pilot told the NTSB that he was aware of the safety notice when it came out, and that it was highlighted during differences training by the check airman who also conducted Pat Mahany’s initial differences training for the H125. However, when that check airman was interviewed by the NTSB, he said that he was not familiar with the safety notice prior to the Frisco crash, and he did not include it in his differences training before the accident.

The assistant chief pilot who conducted a checkride for Mahany in March 2015 said he would have received the safety notice when it came out in 2014. However, he added that he was a new check airman at the time and “I was not training in a dual-hydraulics aircraft, so I would have been aware of that and not really immersed myself.”

The assistant chief pilot said he spent some extra time discussing the dual hydraulic system with Mahany prior to his checkride. But the checkride itself was conducted in a single- rather than a dual-hydraulic AS350, and by the time of his NTSB interview in October 2015, the assistant chief pilot had still logged only around 80 flight hours in AStar helicopters.

Meanwhile, the director of safety at the time of the Frisco crash, who is no longer with the company, said he wasn’t aware of the safety notice until after the accident. Regarding the incident in Texas, he said, “I recall hearing about it, but that’s about it.”

Air Methods has long touted the fact that it was the first air medical operator to enter the FAA’s Safety Management System (SMS) voluntary implementation program — an initiative that is intended to help operators proactively identify and address risks before they result in accidents. Yet, despite Air Methods having attained the highest level of that program in 2013, NTSB transcripts suggest that its high-level operations managers were only vaguely aware of an incident within their company that prompted a manufacturer’s safety notice.

That’s not to say that no one within the company was aware of the incident or safety notice. Individual pilots who subscribed to Airbus Helicopters’ Technical Information Publication on Internet (TIPI) service would have been alerted to the safety notice by email. Beyond that, some of the company’s safety communications are issued by regional managers.

For example, a couple of weeks after the Texas incident, one regional manager emailed pilots with an account of the incident and the note, “Good read and reminder . . . We’ve had an issue or two in our own region. Please follow the checklist and understand that in a [dual-hydraulic aircraft] the switch on the collective can make the main rotor system seem perfectly normal while the load on the pedals can become significant.”

Based on interviews with Pat Mahany’s friends and family, NTSB investigators concluded that Mahany was “aware of the issue with not having the switch in the ‘on’ position.” Nevertheless, it became apparent after the accident that Air Methods lacked a reliable system for receiving and disseminating manufacturers’ safety notices and service bulletins (SBs).

“I think one of the holes we found out after the accident was that [the] SBs would come into a single location, and whether they were operationally-oriented or maintenance-oriented, they were still handled through one central location and didn’t necessarily get distributed, because there was no process to distribute them out at that time,” the former director of safety said.

In his own interview with the NTSB in October 2015, the director of safety’s acting replacement confirmed, “There has been a review, certainly, of how information flows since this accident, and that process broadened. . . . Safety notices now go to the training department as well as maintenance. How they made it to the field before was through the maintenance department.”

This change was formalized in May 2016, when Air Methods revised its Technical Publications Procedures to ensure that all safety information notices and special airworthiness information bulletins are forwarded to the chief pilot, director of operations, and aviation compliance evaluator.

Air Methods’ systemic difficulties in distributing safety notices are suggestive of the challenges associated with managing an organization of 1,300 pilots spread across 300 bases, each base with its own local operational challenges and practices. Air Methods’ former safety director described the company’s culture as “fragmented and distributive . . . There was a disconnect, I think, between the corporate expectation and what was talked about at [headquarters in Englewood, Colorado] and how it translated to the individual base employee.”

Perhaps the only thing more daunting than managing an aviation organization like Air Methods is providing it with regulatory oversight. And transcripts of interviews with the FAA inspectors responsible for Air Methods suggest that they were not well positioned to understand the technical reasons for the company’s incident in Texas, or its implications for the wider organization.

In his interview with the NTSB in October 2015, Air Methods’ principal operations inspector (POI) said that he was largely absorbed with managing the company’s transition to a new SMS under 14 Code of Federal Regulations part 5. “There’s a lot of work there,” he said. “One of our main focuses right now is trying to keep that process on track.”

Regarding manufacturers’ safety notices and service bulletins, he said that seeking them out was not part of his “regular daily routine.” He said he was not familiar with the 2014 safety notice prior to the Frisco accident, and although he was aware of the incident in Texas, he was not part of the investigation into it, or aware of any concerns that were brought out during the investigation.

Of the other inspectors assigned to Air Methods, he said, “not all of them are even capable right now of going out and conducting checks for Air Methods due to the lack of currency or qualification.” Due to FAA resourcing decisions, his inspectors were no longer able to attend airframe qualification courses, and some of them were conducting surveillance on aircraft with which they have “no experience whatsoever,” he told NTSB investigators.

These concerns weren’t new. An April 2015 audit report by the Department of Transportation’s Office of Inspector General had called attention to deficiencies in the FAA’s training program for HAA inspectors, pointing out that “without the proper training, inspectors cannot conduct flight proficiency evaluations on the type or model of aircraft they oversee.”

This was true for members of the Air Methods certificate management team. As the POI observed, “I personally would not be comfortable for an inspector who’s never sat in an AS350, let alone an AS350 B3e with a dual hydraulic system, to actually go out and have to administer an initial checkride to an Air Methods pilot.”

When asked by Vertical what steps the FAA has taken to improve the training and qualifications of its inspectors overseeing the Air Methods certificate, an FAA spokesperson initially declined to comment, and then did not respond to follow-up questions before deadline.

‘A System With Traps’

On March 28, 2017, the NTSB ruled the probable cause of the Flight For Life accident to be “Airbus Helicopters’ dual hydraulic AS350 B3e helicopter’s (1) preflight hydraulic check, which depleted hydraulic pressure in the tail rotor hydraulic circuit, and (2) lack of salient alerting to the pilot that hydraulic pressure was not restored before takeoff.”

Board member Robert Sumwalt pushed for this probable cause declaration, rather than the version originally proposed by NTSB staff — that the accident was due to “the pilot’s failure to reset the yaw servo hydraulic switch to its correct position during the pre-flight hydraulic check.”

“This has to be more than pilot error,” Sumwalt said at the NTSB’s hearing. “There has to be something deeper, and I think if you design a system with traps, sooner or later, you’re going to snare somebody, and unfortunately, this pilot and the two flight nurses were caught in that trap on July 3, 2015.”

The NTSB recommended that Airbus Helicopters, for both newly manufactured and existing dual-hydraulic AS350 helicopters, “assess and implement changes to the dual hydraulic system that would both ensure pedal control hydraulic assistance and mitigate the possibility of pilot error during any check of the hydraulic system.” It also recommended that the FAA require existing dual-hydraulic AS350s to be equipped with a visual and an aural alert for the loss of hydraulic boost to the pedal controls.

In fact, it is impossible to conclusively say that Mahany took off with his yaw load compensator depressurized. The collective stick control block and the ACCU TEST push button were submitted to the NTSB Materials Laboratory for X-ray scans, but they were so badly damaged in the post-crash fire that their positions could not be conclusively determined. Although there was a cockpit video recorder on board the aircraft, that, too, was so badly damaged that no files could be extracted from it (which led the NTSB to reiterate a previously issued recommendation that crash-resistant flight recorders be required on all newly manufactured turbine-powered aircraft).

In email correspondence with Vertical prior to the NTSB hearing, Air Methods rejected any insinuation that Mahany contributed to the cause of the accident. However, the company has certainly proceeded as though he did.

Since the Frisco crash, Air Methods has increased emphasis in differences training for pilots flying both single- and dual-hydraulic AS350 helicopters. This has been part of a generally strengthened commitment to training that has included partnering with FlightSafety on a new Learning Center in Denver, Colorado, which recently added an AS350 B3 Level D simulator (the second of four Level D full-motion simulators planned for the facility).

By the end of 2015, the company had also modified all 19 eligible AStars in its fleet with the flashing hydraulic warning light — a process that was initially held up by a shortage of kits and then by the lack of an approved rotorcraft flight manual supplement from Airbus. Air Methods’ acting director of safety told the NTSB that the company’s engineering department had planned on doing this even before the accident, but it “was not in the priority pile because it was not a mandatory bulletin.”

Air Methods has additionally committed to retrofitting 100 percent of its Airbus AS350 and EC130 fleet with crash-resistant fuel systems (CRFS) as certified systems become available for all models. This, too, had previously been on the company’s radar screen. In 2010, an Air Methods-operated AS350 B2 crashed shortly after takeoff in La Monte, Missouri; the fuel tank ruptured during impact, but there was no post-crash fire.

“It was kind of like, OK, we dodged the bullet on that one,” the former director of safety recalled in his interview with the NTSB. But he said that subsequent discussion with Airbus about developing a CRFS “got pushed back somehow,” and no CRFS retrofit solution was available for the H125/AS350 B3e at the time of the Frisco crash.

Airbus began offering a CRFS on new-production H125s in March 2015 and introduced a retrofit option for the H125 last year. Meanwhile, Vector Aerospace has been developing a retrofit CRFS solution for older AS350 and EC130 models in partnership with Robertson Fuel Systems. Although that project is a year behind its original schedule, Vector recently reported that the companies have been conducting “diligent testing and modification work” on the system, which is now expected to be available in late 2017.

The Last Link in the Error Chain

If the accident in Frisco really was due to an incorrect switch position, then better training or a flashing warning light might have averted it, and the presence of a CRFS almost certainly would have lessened the consequences.

But any helicopter pilot who has seen video of the crash knows there’s one other thing that might have prevented it: a slow, careful lift-off to the hover, rather than Mahany’s significant application of power from the ground. Whether the loss of yaw control was due to an incorrect switch position or a mechanical failure, had Mahany increased power more gradually, he likely would have noticed the discrepancy in time to set the aircraft back down. The NTSB found that Mahany’s “failure to perform a hover check after lift-off” was a contributing factor to the accident.

Most of the Air Methods pilots interviewed by the NTSB endorsed slow lift-offs and hover checks as best practice. That makes Mahany’s takeoff perplexing, because this 13,000-hour pilot was by all accounts a consummate professional, dedicated to his job and committed to safety. Moreover, the accident flight was for a public relations event with Boy Scouts of America, so there was none of the time pressure associated with a medical scene call.

A hint as to why Mahany might have taken off as he did can be found in the interview with Air Methods’ former director of safety, who said that during the company’s investigation of the accident, it was discovered that some pilots at the Flight For Life base were in the habit of performing maximum-performance takeoffs from the ground. The base had only recently upgraded from an older AS350 model to the more powerful H125, and “so their takeoff profile — because the pad was around 9,000 feet, 9,100 feet, I think it was — with the older aircraft, a little less power, they would just take off: bring max power in, do a max performance takeoff,” he said.

This was not a technique that was endorsed by Air Methods, and the company’s training materials explicitly call for pilots to perform a hover power check prior to departure. But the surface takeoff is common enough in the industry that it is enshrined in the FAA’s own Helicopter Flying Handbook, which describes a maximum performance takeoff as being normally initiated from the surface (emphasis added), with no mention of taking off from a low hover. The handbook notes that the “large collective movement” in a max performance takeoff “requires a substantial increase in pedal pressure to maintain heading.”

Granted, the handbook instructs pilots to perform a controllability and power check in a hover before returning to the surface to initiate takeoff. However, is there any good reason to endorse surface takeoffs for normal civilian operations in which the possibility of whiteout or brownout is no factor?

Dave Schwartzenberger, a pilot instructor at HNZ Topflight (previously known as the Canadian Helicopters School of Advanced Flight Training) in Penticton, British Columbia, doesn’t believe that there is. The school specializes in training students for high-altitude and mountain operations in power-limited aircraft, so Schwartzenberger has plenty of experience taking off at altitudes above 9,000 feet.

“The style of takeoff where you pull max power while in contact with the ground is very dangerous and can lead to loss of control/dynamic rollover with no power benefit compared to the low hover,” he wrote in an email to Vertical. “Even if you lifted into the hover, checked power/controllability and landed, and then did this style of takeoff, the risks are still present and this is not a technique we ever use.

“Slow and smooth in all of our operations is always a focus so that any undesired trends can be identified and corrected right away,” he continued. “If you do not have the power and controllability in a stabilized low hover to conduct a published departure or depart vertically over obstacles, then the aircraft is out of proper configuration or is too heavy for conditions.”

Kevin Bredenbeck, a former Sikorsky experimental test pilot who is now director of operations for the helicopter training academy FX LLC, agreed. “Aerodynamically and from a performance standpoint, I cannot see a reason for the max performance takeoff to normally be conducted directly from the ground,” he said.

In an extended email exchange with Vertical, the FAA acknowledged that a maximum performance takeoff can be conducted from a hover. Moreover, the agency was unable to provide an example of a situation in which a hover check would be possible (e.g. not precluded by brownout or whiteout conditions) and the aircraft would be operating within its performance limitations, yet a takeoff from the surface would still be required.

Nevertheless, an FAA spokesperson said that the agency is not considering revisions to the guidance in its Helicopter Flying Handbook at this time.

In a civilian context, it seems likely that the maximum performance surface takeoff is a practice that dates from an earlier age of rotorcraft operations, when helicopters were more routinely operated beyond their limits, and manual throttle controls made it possible to use excess main rotor rpm to “jump” a helicopter into the air.

Otherwise, the primary relevance of the technique is to rapidly depart an area in which people are shooting at you — and as a decorated Vietnam veteran with a reported 1,200 combat hours, Mahany had likely had plenty of opportunities to do exactly that. He also had the skill to conduct surface takeoffs, until the clear summer day when, lifting off from a smooth, level pad, he was confronted with an unexpected loss of yaw control.

The Flight For Life crash was undeniably tragic. But it also presents valuable lessons for the entire helicopter industry. No aircraft is perfect; no regulator, company, or pilot is, either; and occasionally their weaknesses and blind spots combine in a way that leads to needless suffering and loss of life. The hope is that if we learn from these tragedies, they won’t happen again.