Bell 525 Prototype N525TA Fatal Flight Test Accident

UPDATE 9 March 2017: 525 Probe Points to Vibration, Frequency Response in Fatal Crash

Three people briefed on the investigation by the National Transportation Safety Board have told R&WI data analysis of a recovered flight-test recorder, telemetry from the accident aircraft and simulations conducted by Bell for the safety board indicate the onset of the vibration and the subsequent response by the No. 1 Relentless prototype.

The three individuals said that Bell had not seen the vibration frequency resonance condition on any previous 525 flight.

Analysis of the aircraft’s cockpit voice recorder was not possible because the device was not powered during the July 6, 2016, test flight. One official said FAA guidance permits a CVR to be unpowered during a test flight.

In regard to its 525 investigation, the NTSB told R&WI Feb. 22 that “we hope to complete it this summer.”

UPDATE 5 June 2017: Bell looks to resume 525 flights as crash anniversary nears

Speaking on a pre-Paris air show media call, Bell chief executive Mitch Snyder said:

“We are preparing for flight and expect to be in the air in the near term,” he says, although declines to offer a specific timeline. Ground runs are also yet to take place, he admits.

Snyder says its “current plan” is to obtain US Federal Aviation Administration in late 2018, leading to first delivery early the following year.

UPDATE 7 July 2017: Flight testing resumes 366 days after the accident: Bell 525 Relentless resumes flight test program

NTSB Final Report

UPDATE 16 January 2018: The NTSB report is released. The NTSB say:

Between May 15, 2015, and the date of the accident, July 6, 2016, 184 flight test events had been completed. Within the previous 60 days prior to the accident, 32 test events were completed, involving approximately 47 flights, totalling 43.6 flight hours. Within the previous 30 days, 16 test events were completed, involving approximately 30 flights, totalling 26.1 flight hours.

The Accident Flight (Test 184)

The purpose of Test 184 was to do:

1. Heavy forward center of gravity (CG) GE (General Electric) engine loads and vibrations at 100% maximum continuous power evaluation.
2. Heavy forward CG longitudinal roll spot-check
3. 2-to-1 Simulated Engine Failures
4. Run-on landings up to 60 knots

Two hazards had been identified for the next flight:

The NTSB say:

At 1036 the helicopter departed for the test area followed by the chase helicopter. All the maneuvers leading up the accident maneuver were performed around 4,000 feet density altitude (DA), approximately 1,800 feet above ground level (agl).

Once in the test area the crew determined the helicopter’s maximum level flight airspeed (Vh) to be 148 KCAS . The crew then performed steady heading side slips at 0.7Vh followed by level turns at 0.9Vh, up to 60° angle of bank.

The flight crew then prepared for the two-engine to one-engine tests where One-engine Inoperative Training Mode (OEI) software simulates the loss of power from one-engine by reducing the power output of both engines to a preset value based on flight conditions that was representative of the power one-engine would provide. The OEI power value was determined by the flight test engineers and relayed to the pilots. Once OEI training mode is engaged and a loss of power is simulated the pilot monitors rotor speed (Nr) and intentionally delays his response by about 1 second before recovering from the maneuver by lowering the collective (reducing power demanded by the rotor).

One critical parameter monitored for this test is the amount of rotor rotational speed decay that occurs between the sudden loss of engine power and the pilot’s control inputs to recover. The first 3 data points were performed in level flight at 120 KCAS, 131 KCAS, and 145 KCAS, all of which resulted in rotor RPM decay of 3-7%. The remaining test points required the helicopter to be an a shallow descent in order to achieve the required airspeed and at the target density altitude of 4,000 feet. The following data points were performed 155 KCAS, 159 KCAS, 158 KCAS, 165 KCAS, and 175 KCAS, all which resulted in a rotor decay of 5-10%.

About 1148, the final test [test point 51] was performed at 185 KTAS, which was the helicopter’s never-to-exceed speed (Vne) at the time of the test flight; the set up and entry were the same as the previous tests. OEI was engaged, and Nr drooped to about 91% within 1.5 seconds. The Nr decay was stopped by the pilot’s reduction of collective, and Nr began to recover and leveled out around 92%. The crew stopped lowering the collective at the 58% collective stick position. About 7 seconds after arresting the Nr decay (about 12 seconds into the test), the structural dynamics engineer noticed increased engine vibrations, at which point he called “knock-it-off.” The test director radioed to the Bell 525 pilots to “knock-it-off,” while other engineers in the telemetry room were receiving warnings and alerts and were reinforcing the “knock-it-off” call.

The crew of the chase helicopter, which was positioned about 100 ft above and on the right side of the Bell 525 about 3 to 4 rotor diameters away, heard the test director call “knock-it-off” about the same time they observed the 525’s rotor blades flying high and the rotor looking wobbly and slow. The chase helicopter [B429] crew radioed, “Hey, you’re flapping pretty good,” but the 525 pilots did not respond. About 21 seconds into the test, the main rotor severed the tail boom, and the telemetry signal was lost. The chase helicopter crew observed the helicopter’s tail and fuselage jack-knife and debris separate from the helicopter. The chase helicopter crew radioed to the test director, “We’ve had a major accident,” and landed near the wreckage to attempt assistance.

Crew

The NTSB final report only lists the crews civil flying experience, excluding their military experience (which has confused some readers).  Information in the public docket states the pilot had 2,898.9 total flight hours (2,744.6 rotary) and the co-pilot 3,957.5 total flight hours (2,589.4 rotary).

Cockpit of Bell 525 FTV2 N525BK (Credit: NTSB)

OEI Training Mode, Instrumentation and Warning

The OEI special training mode that Bell used for the accident flight test did not incorporate an automatic disengagement of OEI training mode for low Nr. Bell modified the production version of OEI training mode software, originally created by GE, to eliminate a safeguard that automatically exited the OEI training mode when Nr fell below 90%. According to Bell, automatic disengagement at 90% Nr was not low enough to allow development and demonstration of OEI recovery across the flight envelope during testing, and a lower Nr value for automatic disengagement was deemed unnecessary due to the highly controlled test environment.

To manually exit OEI training mode, the pilot could (1) press the engine fail button on the GTC (the same button used to engage OEI training mode), (2) exit the OEI training page on the GTC (using the BACK button), or (3) move the COSIF switch to a position other than “Fly” and then return the switch to “Fly.”

The Bell 525 lead test pilot indicated in a postaccident interview that the options to exit OEI training mode were not discussed formally with all the test pilots but were specifically discussed with the accident test pilot. Disengaging OEI training mode would make both engines available to provide full power to restore the reference Nr to 100% if the rotor was in a drooped state.

In the accident helicopter, the aural tone annunciated for “ROTOR RPM LO” was a master warning tone that was not unique to low Nr and was associated with at least 21 other warning messages. The Bell 525 lead test pilot indicated that, during the experimental flight test, many of the aural messages were still under development; the tones had been selected but not implemented.

The test team determined that having some aural indication for low Nr was sufficient for development flight testing. He stated that the accident crew had flown OEI tests previously and had conducted autorotation testing with test conditions that would likely have triggered the low Nr warning. He also stated that the crew was likely exposed to the master warning for low Nr during flight testing and in the Relentless Advanced Systems Integration Laboratory (RASIL).

The NTSB also note that:

The PSI displayed Nr as a vertical scale (center bar in lower right indicator) when Nr was above 90%:

If Nr dropped below 90%, the display changed to an analog needle that displayed a green arc for Nr between 100 and 90%, a yellow arc for Nr between 86 and 89% Nr, and a red arc below 86% Nr:

The visual cues available to the crew included the crew alerting system (CAS) text “ROTOR RPM LO,” PSI numeric display, warning flag, warning push button annunciator (PBA), and the change of the PSI Nr display from a bar to an arc. [PFD example below]

The CAS text, warning flag, and warning PBA would have been flashing until acknowledged by the crew. Because the telemetry did not record crew button presses, it is not possible to know if the crew acknowledged these alerts.

In addition, the change of the Nr display on the PSI [Power Situation Indicator] from bar to arc may have been recognizable; however, reading of the needle would likely not have been possible in the vibration environment.

Thus, the crew was likely unable to read visual information that provided specific low Nr information, although they may have had a generalized cue that Nr was low.

Studies indicate that visual acuity is negatively affected by vertical vibration, particularly in the 5- to 7-Hz frequency range (Lewis and Griffin 1980a; Lewis and Griffin 1980b). Results indicated that reading speed and accuracy degraded for amplitudes as low as 0.1 G (McLeod and Griffin 1989; Griffin and Hayward 1994). Further studies show that visual performance decreases with increasing vibration amplitude (Shoenberger 1972; Griffin 1975; Griffin 2012). {Full references are at the foot of the final report]

Analysis

While at that high airspeed test point, at a heavy gross weight (approximately 9t) and with a forward centre of gravity (CG), a sustained low rotor RPM had allowed high vibrations to develop. This led to adverse control inputs that reduced the rotor RPM to a critical level causing high levels of main rotor blade flapping.  A near full aft cyclic control input led the main rotor severing the tail boom.

Analysis showed components interacted in closed-loop manner: A main rotor scissor vibration mode transmitted vibrations into the airframe via the main rotor mast. In this mode, the lead-lag movement of the blades acts in such a way that adjacent blades move together and apart like scissors.

Scissor Mode (Credit: Bell Helicopter via NTSB)

In forward flight this produces a fore-aft motion of the main rotor mast.  The main rotor scissors mode had been encountered in two previous tests at around 6.7Hz. During the accident flight this was transmitted at, or close to, 6Hz through the airframe, including to the pilot seat and forward cabin. These vibrations were passed to the control sticks through what is termed “an unintentional biomechanical response”. The NTSB explain that:

Biomechanical feedback…refers to unintentional control inputs resulting from involuntary pilot limb motions caused by vehicle accelerations. Biomechanical feedback is usually addressed using control friction and control input filtering.

The accident helicopter did not have a filter on the collective control to address biomechanical feedback. Bell engineers stated that past experience had never shown a need for filtering the collective control. Filters did exist in the cyclic control to address pitch and roll rates in addition to biomechanical feedback.

The vertical vibration amplitude at the pilot seat rose above 1 G from 10 seconds into the test until the end of the test, with peaks as high as about 3 G.

The vibration was also sensed by the Attitude Heading Reference System (AHRS), and a matching 6 Hz signal was passed to the flight control system. The combined 6 Hz biomechanical and AHRS inputs served as “unanticipated excitation amplifiers of the main rotor scissors mode”.

Debris of B525 N525TA (Credit: NTSB)

Organisation, Safety Management System (SMS) and Safety Culture

The NTSB explain that:

The chief engineer for the Bell 525 program was responsible for all 525 testing, certification activity, and structures (drive, rotor, and airframe). Six discipline areas reported to the chief engineer: airframe engineering, systems engineering and certification, rotors engineering and component test, drive systems, flight technology, and flight test/experimental test and evaluation.

The 525 program flight test integrated product team (IPT) consisted of 12 flight test engineers and 3 instrumentation engineers. Six of the 12 flight test pilots in Bell’s experimental test and evaluation department were assigned to support the 525 program.

The chief engineer worked closely with the air vehicle IPT; the air vehicle lead was responsible for flight control system and software, control laws, avionics, electrical system, propulsion, hydraulic system, fuel system, and environmental controls.

The flight test monitoring was conducted through a dedicated telemetry room (TM) located at Bell Plant 6, Arlington, Texas. This room received the telemetry data from the helicopter and distributed that data in real time to nine flight test engineer stations…as follows: Test Director, Rotor Dynamics, Control Laws (CLAWs), IADS manager, Structural Dynamics, Handling Qualities, Data Operations, and the Telemetry Room Operator.

 

The Test Director is the only flight test engineer that communicates with the helicopter via voice radio communications.

The chase helicopter was in radio communications with the test helicopter and the Test Director.

All flight test engineers can communicate with each other through a voice loop system internal to the telemetry room. The Test Director’s duties are to supervise and direct the conduct of the test being performed.

Bell say they were “in the process of developing a Safety Management System as part of the FAA Design and Manufacturing Safety Management System (D&M SMS) Pilot Project” at the time of the accident.  They say:

 The tools of an SMS undergoing implementation at the time of the accident were the Just Culture System, the Confidential Reporting System and the Flight Risk Assessment Tool (FRAT). The Just Culture Process is not germane to this accident and the Confidential Reporting Tool was not implemented at the time… At the time of the accident Bell was in the final stages of implementing a FRAT…

The NTSB say:

In December 2015, the flight test group had put in place a personal risk assessment tool that each pilot could complete before flying. Pilots were encouraged to fill out the risk assessment every day; it was not mandatory. The accident pilots did not have a risk assessment on file for the day of the accident.

The NTSB had made recommendations on flight test SMS after the crash of Gulfstream  GVI (G650)  N652GD at Roswell, New Mexico, on 2 April 2011.  In the Gulfstream case:

The NTSB determines that the probable cause of this accident was an aerodynamic stall and subsequent uncommanded roll during an OEI takeoff flight test, which were the result of (1) Gulfstream’s failure to properly develop and validate takeoff speeds for the flight tests and recognize and correct the V2 error during previous G650 flight tests, (2) the G650 flight test team’s persistent and increasingly aggressive attempts to achieve V2 speeds that were erroneously low, and (3) Gulfstream’s inadequate investigation of previous G650 uncommanded roll events, which indicated that the company’s estimated stall AOA while the airplane was in ground effect was too high.

Contributing to the accident was Gulfstream’s failure to effectively manage the G650 flight test program by pursuing an aggressive program schedule without ensuring that the roles and responsibilities of team members had been appropriately defined and implemented, engineering processes had received sufficient technical planning and oversight, potential hazards had been fully identified, and appropriate risk controls had been implemented and were functioning as intended.

According to NTSB interviews:

…Bell design and test engineers described the pace of the Bell 525 program at the time of the accident as “fast but not unreasonably.” Personnel described specific pressure felt during the time of the first flight test in Amarillo, TX in mid-2015. When personnel supported were supporting first flight, they commonly worked 7 days per week and logged between 60-70 hours of work per week. Many described morale to be low during the first flight.

Once the flight test program moved back to Arlington, TX in September 2015, the pace slowed and many reported improved morale. At the time of the accident, design and test engineers reported working about 10 hours overtime per week on average. Original certification for the Bell 525 was scheduled for mid-2016, but the program had faced various setbacks during initial design.

Most engineers interviewed stated that they had not received undue pressure from management to complete tasks. No monetary incentives (outside of overtime pay) was provided to employees, and employees were not concerned about negative consequences when raising concerns. Employees described Bell’s safety culture as “good.” In particular when the CEO (at the time of first flight) took his position approximately 4-5 years prior, he stressed safety during meetings and specifically transformed the shop floor.

Suggested improvements to Bell’s safety culture made by employees included:

• Focusing on what was best for the pilots and helicopter during flight test as opposed to focusing on what will get to certification the fastest
• Some employees being able to more comfortably speak up with management
• Having a single point of contact for the project
• Having a known process for bringing concerns forward
• Addressing that life cycles for helicopters were long and that the knowledge captured in best practices may not apply when the helicopter was so different from previous helicopters.

Angled cut line at the forward end of the aft section of the tail boom of Bell 525 FTV1 N525TA (Credit: GE Aviation via NTSB)

NTSB Probable Cause

The NTSB determined the probable cause was determined to be:

A severe vibration of the helicopter that led to the crew’s inability to maintain sufficient rotor rotation speed (Nr), leading to excessive main rotor blade flapping, subsequent main rotor blade contact with the tail boom, and the resultant in-flight breakup.

Contributing to the severity and sustainment of the vibration, which was not predicted during development, were (1) the collective biomechanical feedback and (2) the attitude and heading reference system response, both of which occurred due to the lack of protections in the flight control laws against the sustainment and growth of adverse feedback loops when the 6-hertz airframe vibration initiated.

Contributing to the crew’s inability to maintain sufficient Nr in the severe vibration environment were (1) the lack of an automated safeguard in the modified one-engine-inoperative software used during flight testing to exit at a critical Nr threshold and (2) the lack of distinct and unambiguous cues for low Nr.

NTSB Safety Recommendations

Two safety recommendations were raised:

• To the Flight Test Safety Committee: Develop and issue guidance for the use of recording devices for parametric data, cockpit audio, and cockpit images during experimental flight test activities. (A-18-1)
• To Bell Helicopter Textron: Provide information about the lessons learned from the July 6, 2016, accident specific to the benefits of recording devices for parametric data, cockpit audio, and cockpit images during experimental flight test activities to interested manufacturers, flight test industry groups, and other appropriate parties. (A-18-2)

Safety Actions by Bell

Since the accident Bell has:

• designed a software filter for the collective control law to dampen biomechanical feedback due to oscillatory control inputs as the frequency of control input increases;
• adjusted the aero-servo-elastic model with a correlation factor to incorporate the aerodynamic effects observed during flight test and the accident test to preclude such occurrences seen in the accident flight’s telemetry data;
• performed shake tests with pilots using a side-stick collective to determine and incorporate the transfer function for human biomechanical feedback;
• modified the AHRS software filters to further reduce the AHRS response to a 6-Hz airframe vibration;
• indicated that, for the accident helicopter model, cockpit audio is now being recorded by an onboard CVFDR, and communications to and from the ground monitoring station are recorded by the CVFDR and the telemetry system during all flights (cockpit video is also being recorded by the instrumentation system and archived at the ground station);
• issued a company-wide business directive to ensure that cockpit audio is recorded during all telemetered flight test activities across all flight test sites;
• plans to conduct flight testing in the 95% to 100% range of Nr in an OEI condition;
• plans to implement, for the accident helicopter model, the unique low Nr aural tone in their test aircraft, and a software update that includes a larger font size for the Nr numeric display on the PSI;
• plans to implement a separate PBA specifically for low Nr and is incorporating more salient cues into the tactile cueing system;
• plans to incorporate the automatic termination of OEI training mode should Nr fall below a certain limit; and
• incorporated a safety officer for the accident helicopter model test program who will have dedicated safety-related responsibilities.

Key Public Docker Reports

The public docket contains 48 attachments of over 270 pages.  Amongst the most useful documents are:

• Operations
• Aircraft performance (including vibration)
• Human performance
• Airworthiness (mainly concerns the wreckage analysis)
• Bell party submission

A small number of minor additions may be made to this summary in the next few days.