The matters of concern set out below all relate to the systems and procedures for design and safety supervision of aircraft, specifically helicopters. They are founded upon specialist technical evidence given to the court during the inquests. They take full account of action taken by EASA to date of which the court is aware. I should stress at the outset that the matters of concern set out below remain valid irrespective of whether the AAIB’s causal explanation of the accident is correct. Each one is based on a safety concern which exists even if the points raised by EASA in response to that causal explanation have merit. It should also be stressed that none of these matters of concern should be interpreted as levelling implicit criticism at the aircraft or component manufacturers involved in this case. They are all concerned with achieving safety improvements for the future. Given the potentially catastrophic consequences of failure of an individual component or system in a helicopter, I hope that this report will be considered carefully.

(1) Provision of system and flight-testing data by aircraft manufacturers to suppliers In the inquests, the AAIB investigation team explained that they had recommended that EASA amend Certification Specification 29.602 to require type design manufacturers to provide the results of all relevant system and flight testing to any supplier who retains the sole expertise to assess the performance and reliability of components identified as critical parts within a specific system application, to verify that such components can safely meet the in-serve operational demands, prior to the certification of the overall system. This was AAIB safety recommendation SR-2023-018. As (AAIB Principal Inspector) explained in his evidence, in this case the bearing manufacturer (SKF Aerospace) was the only party which could fully assess the contact pressures that loads experienced during flight tests generated on the duplex bearing which ultimately failed. He further explained that it would have been a desirable improvement to the design and certification process if the aircraft manufacturer had been required to provide system and flight-testing data to the bearing manufacturer, so that it could have used its unique expertise to identify risks arising from in-service use. explained that EASA had responded to this recommendation by saying that another part of the relevant regulations required the aircraft type certificate holder to be responsible for demonstration of compliance (i.e. for showing that critical parts and systems met performance requirements). He said that this was an inadequate response, because it did not meet the intent of the safety recommendation by introducing the specific improvement proposed. of SKF gave evidence in relation to this safety recommendation. He said that the data his company would receive from manufacturers if the recommendation were implemented would be useful to SKF. He said that his company would not find it difficult to manage being provided with data as required. He noted that data of this kind had been made available in relation to the duplex bearing as a result of the AAIB investigation. In these circumstances, I am concerned by EASA’s rejection of the AAIB safety recommendation, which would appear to propose a meaningful improvement to requirements for aircraft design work.

(2) Requirements for Certification Specification to address rolling contact fatigue failure In the inquests, the AAIB investigation team explained that they had recommended that EASA introduce further requirements to Certification Specification 29 so as specifically to address premature rolling contact fatigue failure as a failure mechanism across the full bearing operating spectrum and service life of bearings used in safety-critical applications. This was AAIB safety recommendation SR-2023-019. explained in evidence that this safety recommendation was not prescriptive. It asked EASA to propose requirements which would address risks of premature rolling contact fatigue in bearings, the form of failure which the AAIB concluded had caused the catastrophic accident in this case. As explained, EASA is undertaking work which looks at the fatigue tolerance of principal structural elements and at the possibility of changing acceptable means of compliance (AMC) for those items. As part of this work, EASA is considering adding clarification and detail which might meet the AAIB recommendation. This reflects the position stated by EASA in its letter of 6 February 2024. I am concerned that an issue raised by the AAIB to the effect that CS-29 and/or AMC may be improved to address risks of rolling contact fatigue failure in critical part bearings has not been addressed by EASA by a time over 18 months after the AAIB report on this crash was issued.

(3) Airworthiness status and control of life limits for non-structural critical parts of aircraft designs already in service In the inquests, the AAIB investigation team explained that they had recommended that EASA should define the airworthiness status of life limits on non-structural critical parts and how they should be controlled in service. They said that they had recommended this in relation to aircraft designs not yet in service (safety recommendation SR-2023-020) and in relation to aircraft designs already in service (safety recommendation SR-2023-021). in his evidence pointed out that this recommendation did not raise an issue of causal relevance to this particular accident, but that it was nevertheless important to ensure greater clarity as regards the life limits of non-structural critical parts. He said that new AMC introduced by Amendment 11 of Certification Specification 29 had adequately addressed the recommendation in relation to aircraft designs to be put into service in future, but that EASA had decided not to make any changes which would secure the requisite additional clarity in relation to designs already in service. As he put it “those aircraft already in service will not benefit from the Amendment 11 changes to life control.” In these circumstances, I am concerned that EASA has not implemented the recommendation in relation to designs already in service. Although said that EASA had explained that it considered that issues with non-structural critical parts would be picked up as part of continued airworthiness review, that does not strike me as a response which meets the recommendation.

(4) Comprehensive programme for assessment of critical parts after removal from service In the inquests, the AAIB investigation team explained that they had recommended that EASA amend CS 29.602 to require aircraft manufacturers to implement a comprehensive programme for assessing critical parts after removal from service. AAIB safety recommendation SR-2023-022 addressed this topic for aircraft yet to be put into service, while safety recommendation SR-2023-023 addressed the topic for designs already in service. As explained this recommendation, it was “for EASA to require a closed-loop system for critical components removed from helicopters so that anything that is removed that is classified as a critical part has some form of… assessment programme carried out on it to ensure that… it is progressing throughout its service life in the manner that was expected at the design stage using the design assumptions.” He told the court that such a system would have meant that, when duplex bearings were removed from the AW-169 helicopter at the end of their service life, at least a sample would have been reviewed by Leonardo and/or SKF to verify design assumptions. As I understand it, EASA has responded positively to the recommendation as regarding aircraft designs yet to be put into service. It has published a notice of proposed amendment to CS 29 with a view to implementing a Continued Integrity Verification Programme (CIVP). This work is still ongoing. However, EASA has indicated to the AAIB that it does not intend to make any regulatory change for in-service aircraft, because existing procedures are sufficient. told the court that this response from EASA did not allow in-service helicopters to benefit from the proposed CIVP. He acknowledged that there were some existing requirements which could identify adverse trends or deficiencies in relation to critical parts (such as the duplex bearing which failed in this case) but he stressed that they were not prescriptive enough, given the safety issues underlying the recommendations. of SKF told the court that the safety recommendation with retrospective effect which the AAIB had made, and which EASA was resisting, “would be very beneficial” (although he commented that his company was already acting in accordance with the recommendation at least for some components). I am concerned that EASA does not intend making changes which would allow in-service helicopters to benefit from the proposed new CIVP requirements.

(5) Guidance and minimum standards for the calculation of design load spectrums for non-structural critical parts In the inquests, the AAIB investigation team told the court that they had recommended that EASA amend CS 29.602 so as to provide guidance and set minimum standards for calculating design load spectrums for non-structural critical parts (like the duplex bearing which failed in this accident). Under this recommendation, the standards would have to include highest individual operating loads and combination of dynamic operating loads, as well as the longest duration of exposure for such loads that could be experienced in operation. This was safety recommendation SR-2023-024. As put it, this recommendation represented an attempt to ensure that the design process took into account what the AAIB had learned from this investigation. He acknowledged that major manufacturers would have procedures for considering design load spectrums for parts such as the bearing which failed in this case. However, his concern was to have a comprehensive and uniform set of standards for such safety-critical parts. According to the latest information provided by the AAIB, EASA has issued a Certification Memorandum (CM)-RTS-003, which gives guidance on demonstration of compliance with applicable CS-27 and CS-29 requirements for hybrid bearings (i.e. bearings involving steel races and ceramic balls). EASA claims that this adequately addresses the findings from the accident. The AAIB does not consider this an adequate response. It points out that there is no guidance or requirement to calculate loads for non-structural critical parts (such as the tail rotor bearing), as distinct from a principal structural element (such as the entire tail rotor). It further notes that Certification Memorandum (CM)-RTS-003 focusses on issues with one type of bearing and does not address the broader issue raised by this recommendation. I am concerned that EASA has responded to this AAIB recommendation by citing action it has taken which does not appear to meet the AAIB’s concerns.

(6) Failure modes analysis at a system level In the inquests, the AAIB investigation team explained that they had recommended that EASA make amendments to requirements in CS-29 and to AMC in order to stress that, where potentially catastrophic failure modes are identified, the wider system should be reviewed for practical mitigation options, such as early warning systems and failure-tolerant design, rather than relying solely on statistical analysis to address the risk. This was safety recommendation SR-2023-025. explained that, in the present case, it may have been helpful to consider failure modes in relation to the tail rotor bearing and actuator as a single or conjoined system. He said that, if this had been done, “it may have been possible to mitigate the catastrophic nature of the tail rotor duplex bearing failure”. He told the court that EASA’s initial response to the recommendation had not covered any of the points the AAIB had raised and had not addressed the intent of the recommendation at all. He said that, after further engagement, EASA had given a more comprehensive reply which stated that Amendment 11 to CS-29 and the provision of guidance material sufficiently addressed the recommendation. However, said that even that reply had quoted features of CS-29 which did not meet the requirements of the recommendation. There remained no provision for failure analysis to be conducted at a system level. In those circumstances, the AAIB assessed EASA’s response to the recommendation as not being adequate. I am concerned that the AAIB’s apparently sensible suggestion of requiring failure modes analysis to be conducted at a system level continues to be rejected.