Full Report:

History of the flight The pilot and two police observers (legally designated as passengers but referred to as crew in this report), were tasked to conduct an operation, close to the village of Muirkirk, in support of the police. The helicopter lifted off from its Glasgow base at 2137 hrs and climbed to an altitude of 1,500 feet. The pilot later received clearance from air traffic control to climb to 2,000 feet. As the helicopter settled onto an initial direct track of 165 M towards Muirkirk the pilot could see clearly the lights of East Kilbride about 8 miles ahead and assessed the visibility to be greater than 10 km with a cloud base between 3,000 and 3,500 feet. As the helicopter approached the high ground to the south of Eaglesham it unexpectedly entered snow showers and encountered reduced visibility. The pilot immediately turned onto a reciprocal heading and soon regained visual flight. He then discussed with his crew the option of flying to the east, towards Hamilton, following the M74 motorway to Douglas and from there flying west towards Muirkirk. This route was intended to avoid the high ground and any associated poor weather. The flight continued at an altitude of approximately 2,000 feet, and from overhead the village of Douglas the pilot could see the lights of Muirkirk. Shortly afterwards the helicopter unexpectedly entered cloud. The pilot immediately turned to the left, away from the high ground to the north, rapidly regained visual flight and re-located the lights of Muirkirk. The helicopter continued towards the village and the crew commenced their task maintaining an altitude of about 1,800 feet (approximately 1,000 feet agl). The task was completed after approximately 15 minutes during which time the weather remained good. Whilst orbiting the village the crew utilised a very powerful, steerable, searchlight mounted on the left side of the helicopter. When the task was complete this light was extinguished. The helicopter was also equipped with a fixed, forward facing, high intensity light fitted to the nose of the aircraft; the pilot left this light illuminated for the return journey. The pilot initially intended to return to Glasgow via Douglas and the M74, however, as soon as the helicopter turned towards Douglas he could see an extensive area of cloud ahead. He therefore decided to fly west along the valley, towards lower ground, and then return to Glasgow via Kilmarnock. As the crew set off on a westerly track at an altitude of approximately 2,000 feet (1,200 feet agl) they could see beyond the town of Cumnock, 9 miles ahead. The helicopter then unexpectedly entered thick cloud once more and the police observer, occupying the front left seat, recalled that the airspeed indicator showed approximately 80 kt. The pilot, who was aware of the high ground on either side and reluctant to turn, decided that the safest option was to maintain his present track and descend using the radio altimeter as his height reference. When passing 1,000 feet agl, and still in cloud, the pilot selected the 'ALTITUDE' (ALT) and 'HEADING' (HDG) modes of the autopilot with the intention of maintaining his current altitude and heading. He then noticed that the helicopter had entered a turn to the right with approximately 15 angle of bank (AOB). He manually overrode the autopilot and regained a westerly heading, but the helicopter re-commenced the turn to the right causing him to intervene once more. Following this second manual intervention the pilot recalled seeing discrete 'AP' and 'A.TRIM' red warnings and red 'P' and 'Y/R' annunciations. These warnings indicate that the autopilot has disconnected. The helicopter then entered a steep nose down attitude whilst turning to the right at about 45 AOB. The descent was rapid and despite his corrective control inputs the pilot was unable to prevent the helicopter striking the ground. After impact the pilot, in the front right seat, and the police observer, in the front left seat, were able to release their harnesses and vacate the helicopter via the disrupted area on the right side of the fuselage. The pilot then returned to the cockpit to shut down the engines that were still running. The police observer, seated in the rear of the helicopter, was seriously injured and required assistance from his two colleagues to vacate the wreckage. Once the injured observer had been dragged clear of the helicopter the pilot remained with him whilst the other observer sought assistance from a nearby farm. The emergency services arrived at 2235 hours, approximately 10 minutes after the accident. Prior to take off an 'ACTUATION' message had appeared on the Caution and Advisory Display (CAD) with an associated 'R' (roll axis) warning on the pilot's Primary Flight Display (PFD); the warning had remained illuminated throughout the flight. This warning indicates a reduction in roll control authority due to a failure of one of the two roll control actuators. The pilot considered this warning to be a false warning since it had appeared on a number of recent occasions and the higher modes of the autopilot had still been available. (These modes would not have been available if the warning had represented a flight critical failure). Eye witness accounts Four eye witnesses, at separate locations, saw the helicopter fly towards the west in a controlled manner with its searchlight illuminated. They then described the helicopter turning rapidly two or three times whilst descending in a nose down attitude before striking the ground. Some of the witnesses described unusual sounds from the engine variously described as "grinding", "slowing down" or "dying". In practice, it is difficult to differentiate the sound of a helicopter's engines from the sounds of the main and tail rotors. These latter sounds vary significantly if a helicopter is manoeuvred aggressively and it seems likely that it was these variations in rotor blade noises that were heard by the witnesses. This possibility is supported by the lack of comment by the crew on abnormal engine behaviour and by the results of the post crash investigation, which indicated that the engines had behaved normally up to the point of impact. Meteorological situation An aftercast was obtained from the Meteorological Office at Bracknell. The synoptic situation showed a moderate, showery, north-westerly air flow covering the area south of Glasgow with a visibility greater than 10 km outside of the occasional showers. The cloud was generally broken strato-cumulus with a base of 3,500 to 4,000 feet and large cumulus or occasional cumulo-nimbus clouds with an associated base of 1,500 to 2,000 feet. In addition cloud was likely to be covering hills in the area of Muirkirk above approximately 1,500 to 2,000 feet. The estimated wind at 1,000 feet in the area was 280/25 kt. This aftercast shows good correlation with the meteorological forecast provided to the crew prior to departure and accords with the conditions reported by the crew during the flight. Impact parameters The aircraft crashed in a field on farm land located in a valley, approximately two miles south-west of Muirkirk. It had narrowly missed a dry stone wall and came to rest just short of power lines which transected the field. It was deduced from examination of the wreckage and the ground contact marks, that the helicopter was travelling at a moderate forward speed and descending on impact. Ground impact marks from the main rotor blades and the horizontal stabiliser showed that the helicopter was in a nose-down attitude and banked about 30 to the right when it struck the ground. The helicopter contacted the ground right side first, detaching the infra-red camera pod, the landing gear skid and the cabin door on the right side of the helicopter. The force of the impact caused significant disruption of the structure on the right side of the aircraft, including the fracturing of the substantial engine/transmission support frame. The tail boom was partially severed just forward of the horizontal stabiliser. The outer sections of the main rotor blades were shattered on striking the ground, causing fragments of foam and fibreglass to be widely spread over the accident site. The helicopter travelled on its right side for about 25 metres before rolling over and coming to rest on its left side, with all four main rotor blades trapped underneath the cabin. The grass was scorched where the exhaust from the left engine, which was still running, had impinged on the ground. There was minimal fuel leakage from the bag-type fuel tank, which had remained intact and there was no post-crash fire. Survival aspects Although the cabin structural integrity was severely compromised in the impact, there was no significant intrusion into the cabin space. The helmets worn by all occupants, which all showed evidence of heavy contact with cabin structure, had been effective in preventing serious head injuries. The front and rear crew seats were made by the same manufacturer and were designed and certificated to the latest crashworthiness specifications of the Joint Airworthiness Requirements (JAR) 27.561 and 27.562 for the design of Light Helicopters. JAR 27.561 specifies the static load certification requirements and requires that an occupant in the cabin and each item of mass within the cabin which could cause injury to an occupant, must remain restrained when subjected to load factors of 4 g upward, 16 g forward, 8 g sideward and 20 g downward. JAR 27.562 specifies the dynamic loading certification requirements of the seat and restraint system. In simple terms, this requires that the seats provide reasonable protection to an occupant (simulated by a 77 kg anthropomorphic test dummy) when subjected to a vertical deceleration of 30 g and a longitudinal deceleration of 18.4 g. Examination of the pilot and front observer's seats showed that although they had been exposed to large vertical and lateral loads in the impact, they had remained attached to floor structure. The energy absorbers in the vertical seat members had compressed considerably, reducing the vertical loads experienced by the occupants and protecting them from serious spinal injury. The seats incorporate a four-point harness, with adjustable lap straps and inertia-reel shoulder straps. The harnesses, which were being correctly worn, had remained intact and had provided effective restraint for the occupants. Severe crush damage to the headrest hoops showed that they had absorbed a significant amount of energy during the roll-over, further protecting the occupants. The overall level of protection afforded by the seats was such that, despite the severity of the impact, the pilot and front observer suffered only minor injuries and were able to exit the wreckage unaided and assist the other crew member. The rear observer's seat was located on the right side of the rear cabin. The seat (part number 9603- 560-L), which is designated as a 'passenger' seat, is certificated to the same requirements as the front ('crew') seats, however its design differs to that of the crew seats in a number of areas. The seat is equipped with a three-point harness, incorporating an inertia reel unit for the shoulder harness. It is mounted high up, on the left side of the carbon fibre-reinforced fibreglass seat back. The inertia reel unit on the front crew seat is located centrally near the base of the seat. The method of attachment of the seat to the cabin floor also differs. The rear observer's seat had become detached from the cabin floor during the accident and had also experienced a failure of the seat back. The fact that the seat became unrestrained may have been a contributory factor to the rear observer sustaining more serious injuries than the front occupants. It was therefore considered important to determine how these failures had occurred and whether they were associated with the seat design. The passenger seat was examined at the manufacturer's facility in Germany, in the presence of the AAIB. It was subjected to detailed examination to determine the failure mode of the seat back and the attachments of the seat to the floor. It was clear that the seat had experienced a large vertical loading due to the initial impact, as evidenced by the compression of the energy absorbers in the seat vertical members and damage to the underside of the seat pan where it had contacted the upper edge of the right hand seat leg. The relative amounts of compression of the left and right energy absorbers (20 mm and 90 mm, respectively) was indicative of greater forces being experienced by the right side of the seat, which is consistent with the helicopter having a right roll attitude on impact. This would have produced large inertial forces in the vertical plane acting downward and from left to right. Confirmation of this was provided by the locations of the tensile and compressive failures of the seat diagonal braces. Examination of the failure of the seat back itself however, indicated that it had failed as a result of the application of a large lateral load acting in the opposite direction from right to left. The fact that a sufficiently large lateral load could be applied in this direction to fail the seat back shows that the seat must have still been attached to the floor structure immediately after the initial impact. The failures of the cross members, carrying the seat attachments to the floor, were consistent with a large rearward loading having been applied to the seat. This is once again inconsistent with the expected direction of the loads associated with the impact. Signs of ground contact were found on the top of the headrest. Impacted soil in the fabric of the upper right side of the seat back showed that the seat had made heavy contact with the ground on its upper right side. This could only have occurred after the right hand cabin door had been torn off, some time after the initial impact. It was therefore possible to conclude that failures of the rear observer's seat had occurred when the seat contacted the ground during the ground slide and subsequent roll over. They were not associated with any deficiency in the seat design or construction. The fact that there was no post-crash fire was a further major contributory factor to survivability, given that the badly injured rear observer was unable to exit the wreckage without assistance. The fuel tank on the EC135 is constructed of a rubberised nylon material and is designed to absorb energy in an impact by deforming, without rupturing. In this accident, the fuel tank had performed as designed in preventing any significant fuel leakage. Given the severity of the impact and the amount of damage to the helicopter, it was surprising that the injuries to the occupants were not more severe. The fact that they were not illustrates the effectiveness of the latest, more stringent crashworthiness requirements contained in JAR 27 in improving the survivability of occupants of light helicopters in a severe impact. Aircraft description The Eurocopter EC135T is a modern, twin-engined, multi-purpose, light helicopter that is characterised by the extensive use of integrated digital avionics for flight control, engine management and systems failure monitoring. The Automatic Flight Control System utilises a combination of computer controlled electro-hydraulic and electro-mechanical actuators that are mounted in series and / or in parallel with the flight control linkages. The basic helicopter is equipped with an analogue Stability Augmentation System (SAS) to reduce the pilot's workload. When equipped with a digital autopilot the helicopter is certificated for Single Pilot IFR operation. When the autopilot is selected to ON (the normal configuration for flight), the basic digital SAS and auto trim ('A.TRIM') modes of the auto pilot automatically engage, providing enhanced stability augmentation. This enables the helicopter to be flown 'hands-off', allowing the pilot to perform other essential tasks. Autopilot higher modes may then be selected to provide navigation and approach functions, in addition to heading, altitude and speed hold capabilities. Primary flight and autopilot mode data are displayed on an electronic Primary Flight Display (PFD). Navigation information, including selected heading, is displayed on an electronic Navigation Display below the PFD. Two electronic display units in the centre console provide systems status information. The Caution and Advisory Display (CAD) unit displays cautions, advisory messages and fuel status information. It has a non-volatile memory which stores failure information for the previous 60 seconds of flight. The Vehicle and Engine Monitoring Display (VEMD) unit has two screens that display engine and aircraft system parameters. The VEMD features a maintenance page facility that can be accessed on the ground to recall systems performance data for previous flights. Critical system failures are annunciated by illuminated captions on a separate Warning Unit (WU) located at the top of the centre console. G-SPAU was configured for the police air support role and was additionally equipped with a steerable searchlight, a Forward Looking Infra-Red (FLIR) camera and police role-specific communications equipment. The aircraft, in its police role, was being operated by three personnel: the pilot, seated in the right front seat, the front police observer, seated in the left front seat and the rear police observer, seated on the right side of the main cabin. SAS / autopilot description The standard EC135 is equipped with an analogue 3-axis SAS and is approved for VFR operation. The addition of a pitch damper is intended to allow the aircraft to be operated in an IFR environment with two pilots. G-SPAU was configured for Single Pilot IFR operation and as such, was further equipped with a 3-axis 'SFIM APM 2000' digital autopilot. At the time of the accident however, the helicopter was only approved for VFR operation because of the unsatisfactory ADF system performance. This is a navigation aid that has no effect on the handling qualities of the helicopter. The normal mode of operation of the helicopter is with the digital autopilot permanently selected 'ON' in flight. If the pilot does not engage the autopilot prior to flight, an 'AP' warning appears on the CAD as a reminder to select it. Analogue SAS operation The analogue SAS improves the stability of the helicopter so that the pilot's workload is reduced. This does not however enable the helicopter to be flown 'hands-off'. On helicopters fitted with the digital autopilot, analogue SAS acts in a 'standby' mode, ready to take over from the digital SAS should the autopilot fail. In analogue SAS mode, data from rate gyros are fed to a pitch/roll SAS computer and an independent yaw SAS computer. These command the pitch/roll Electro-Hydraulic Actuators (EHAs) and the yaw Smart Electro-Mechanical Actuator (SEMA) to counteract any uncommanded perturbations, thereby improving the pitch, roll and yaw damping characteristics of the helicopter. Analogue SAS is designed to engage automatically whenever the helicopter is poweredup and does not require the autopilot to be selected 'ON'. The system is not normally turned off, except in the event of a failure. It can only be disengaged by selecting the red 'AP/SAS DCPL' fast decouple switch on the left side of the cyclic control grip. This switch allows the pilot to simultaneously disconnect the analogue SAS, pitch damper and the autopilot in the event of an emergency, such as a SAS or auto pilot runaway. This switch is not normally used during operation of the helicopter. If the auto pilot is also engaged at the time, operating this switch will produce the following warnings:- a) 'A.TRIM' red caption flashing on the Warning Unit for 10 seconds, accompanied by an audio alert. b) 'P' and 'Y'/'R' flashing red on the PFD for 10 seconds, followed by 'OFF' in amber. c) 'AUTOPILOT', 'DECOUPLE', 'P/R SAS', 'YAW SAS' and 'P DAMPER' are displayed in amber on the CAD. The 'DECOUPLE' warning appears for 10 seconds. When the autopilot, pitch damper and analogue SAS are disengaged, the EHAs and SEMAs no longer receive any computed commands and return to their null positions. As they are mounted in series in the mechanical control circuit, this can result in uncommanded control inputs being applied. Flight tests have demonstrated that this can result in an uncommanded pitch up or pitch down response, together with an uncommanded left or right roll. The direction of the pitch and roll are dependent on the position of the EHAs and SEMAs at the time that the 'AP/SAS DCPL' switch is pressed and are thus unpredictable. The pilot must however, anticipate and correct the resulting control inputs. Digital autopilot operation Normal operating procedures require the autopilot to be switched 'ON' in flight. It is controlled via the Autopilot Mode Selector (APMS) on the instrument panel. The 3-axis SAS and pitch damper systems must be operating for the autopilot to engage. The autopilot is selected and de-selected via the 'AP' push button switch on the APMS. When engaged, it automatically assumes its basic mode of control; digital SAS and auto trim ('A.TRIM'). Digital SAS is similar to the analogue SAS mode, except that the controlling function resides within the Autopilot Module (APM). The 'A.TRIM' mode introduces additional control functions to provide the long term stability augmentation necessary to allow the helicopter to be flown 'hands-off'. The higher modes of the auto pilot, including indicated airspeed hold, barometric altitude hold, navigation, approach and heading modes are also selected via push button switches on the APMS. The mode(s) currently selected are displayed on the PFD. A 'TEST' switch on the APMS allows the pilot to initiate the autopilot self-test procedure on the ground during the pre-flight checks. Heading select and altitude modes Heading select and altitude modes were the only higher modes in use during the accident flight. When the 'ALT' mode is selected on the APMS, the autopilot takes as its reference the barometric altitude of the helicopter at the time the mode is selected and seeks to maintain that altitude, thereby providing an altitude hold function. The 'HDG' mode is used to turn the aircraft onto and maintain a selected heading. The heading select knob on the APMS is rotated to the desired heading, as indicated by a green heading select bug on the pilot's Navigation Display. When the heading mode is engaged the autopilot rolls the helicopter onto the selected heading in a balanced rate one turn. On avionics power-up, the heading select bug will always default to north and will remain there unless reset to a new heading. Unlike the 'ALT' mode, it is not a 'hold' function since the heading select bug does not automatically synchronise to the helicopter's current heading. The autopilot system has dual independent processors and power supplies and utilises independent sources of air data and rate gyro data. It is designed so that no single failure within the system will result in a flight critical fault. Pilot inputs during autopilot operation The auto pilot system is designed so that the pilot can at all times override the automatic control using normal control inputs. If the cyclic stick is moved, position sensors on the parallel actuators sense the motion of the stick and command the APM to suspend automatic control, but the autopilot does not disconnect and a degree of stability augmentation is retained. Once the stick is returned to the trim position, the autopilot resumes control. For example, if 'HDG' mode is engaged and the pilot makes a roll cyclic input the helicopter will respond to the pilot's input, but on release of the cyclic the auto pilot will roll the helicopter back towards the selected heading. The EHA and SEMA control authority is limited so that there is sufficient cyclic stick authority remaining to allow the pilot to override the autopilot or SAS should a runaway occur. The higher modes of the autopilot can be de-coupled by use of the 'APMD DCPL' button on the left side of the cyclic control. On pressing this button, the higher modes are disengaged and the autopilot reverts to A.TRIM and digital SAS modes only, but does not disconnect completely. When the 'APMD DCPL' button is pressed a 'DECOUPLE' message illuminates on the CAD. The autopilot is normally deselected via the 'AP' button on the APMS. This will disengage the higher modes, A.TRIM and digital SAS functions, with the flight control system reverting to analogue SAS, yaw SAS and pitch damper modes in an orderly fashion. This is designed to be a benign transition and should not produce any uncommanded control inputs. As previously mentioned, in an emergency, the autopilot may also be disengaged using the fast decouple button ('AP/SAS DCPL') on the cyclic control. However, this also disconnects the analogue SAS and the pitch damper, in which case no stability augmentation functions are then available. The pitch/roll EHAs and the yaw SEMA will return to their null positions, with possible associated and unpredictable control inputs which must be corrected by the pilot. Wreckage examination Continuity of the main and tail rotor controls was confirmed and no evidence was found of any preimpact damage to the controls or a control jam due to loose objects becoming trapped in the controls. To investigate the cause of the 'ACTUATION' and 'R' (roll axis) warnings on the CAD and PFD at the beginning of the flight, the roll SEMA and pitch/roll EHAs were bench tested by the helicopter manufacturer in the presence of the AAIB. When connected to the test equipment, the roll SEMA failed to respond to electrical inputs. Internal examination revealed a small quantity of moisture inside the unit and evidence of moisture contamination and corrosion of the main circuit board which would have affected the units ability to function. A general build-up of dust and dirt at the acutator ram and body interface suggested that the unit had been inoperative for some time. The roll SEMA was sent to the manufacturer for more detailed examination. The pitch/roll EHAs were tested satisfactorily, with no fault found. The CAD and VEMD were also examined by the helicopter manufacturer under AAIB supervision. These revealed that up until the point of impact, the engine parameters were normal and no significant system faults were present. This is borne out by the extensive damage to the main rotor blades, which suggests that the engines were developing considerable power on impact. Rules of the Air Rule 22 of the Rules of the Air (Air Navigation Order 2000) requires night flights to comply with Instrument Flight Rules (IFR) whilst operating outside of controlled airspace. Flights operating within controlled airspace are required to comply with IFR or Special Visual Flight Rules (SVFR). The EC135 helicopter is certificated for Single Pilot IFR operation. G-SPAU, however, along with other early production EC135 helicopters, was downgraded to Day/Night VFR operation only, due to a limitation imposed by the characteristics of the Automatic Direction Finding (ADF) system antenna. Consequently, while outside of controlled airspace the flight had to be conducted in accordance with Rule 26 which is, in effect, a dispensation to operate an IFR flight in much the same way as a day VFR flight. This meant that the flight had to remain clear of cloud and in visual contact with the ground. The pilot was unable to achieve these objectives on three occasions during the flight for whilst it is easy to avoid cloud during daylight it is difficult to do so in the dark and particularly so when there is little cultural or celestial lighting. Pilot experience and training The pilot held a current UK Airline Transport Pilot's Licence for Helicopters (ATPL(H)); this did not include an Instrument Rating (IR). He had however, previously held an ATPL(H), issued by the Federal Aviation Administration in the USA, which did include an IR and he had recorded close to 100 hours of instrument flying. Furthermore he had completed the training and testing required at the time to conduct both Public Transport and Police operations at night. His previous flying had been on helicopters that were not equipped with an autopilot and he thus had no previous experience of operating them. His initial training on the EC135 was conducted by the operator in December 2001. This training, conducted in the benign environment of a structured training programme, included night flying, use of all modes of the autopilot and a flight of 1.5 hours, on instruments, in which he completed instrument approaches as well as recovery from unusual attitudes. Analysis Engineering factors The possibility of an autopilot or analogue SAS system runaway having occurred leading to a loss control of the aircraft was considered. However, based on the wreckage examination findings and a review of the autopilot / SAS system operation, this appeared unlikely, for the following reasons: (i) Evidence from the accident site and analysis of the VEMD and CAD memories provided confirmation that both engines were developing adequate power at the time of impact and that no significant flight control system defects had occurred prior to impact. (ii) The absence of any critical autopilot system warning messages when the pilot engaged the autopilot during the pre-take off checks indicates that the digital SAS and 'A.TRIM' modes engaged satisfactorily. (As previously discussed, the 'ACTUATION' warning observed by the pilot during the pre-flight checks would not have prevented the autopilot from engaging and operating in any of its modes). When the 'ALT' and 'HDG' modes were selected following the inadvertent entry into IMC the response of the helicopter appears to have been consistent with these upper modes having correctly engaged. The settling of the helicopter in a 15-20 banked turn to the right, suggests that it was acquiring a selected heading to the right of the helicopter's current (westerly) heading. As the autopilot upper modes had not been selected prior to this point, the heading select bug may still have been in its default position of north, which could account for the helicopter turning immediately to the right. Further evidence that the auto pilot was operating correctly is provided by the fact that when the pilot released the cyclic, following his initial intervention, the helicopter immediately rolled back into a right turn, as if attempting to acquire the selected heading. When the pilot applied a further corrective left roll cyclic input, he recalled the 'A.TRIM' caption on the WU appearing, together with 'P/R/Y' warnings on the PFD. These warnings indicate that the auto pilot has failed or has been disconnected and that the analogue SAS has either failed in the pitch, roll and yaw axes, or has been disconnected. The helicopter then pitched steeply nose down and turned to the right with approximately 45 angle of bank. (iii) Given the fact that the roll SEMA was known to be defective during the flight, consideration was given to the possibility that a further failure had occurred in the roll channel. With the roll SEMA failed and with the autopilot engaged, with the 'HDG' and 'ALT' upper modes selected, failure of the roll EHA would result in the loss of the ability of the autopilot and analogue SAS to control the helicopter in roll. This would result in the disconnection of the upper modes of the autopilot and the 'A.TRIM' function since both roll actuators (the roll EHA and roll SEMA) have failed. This would also result in a loss of the analogue SAS control function in the roll axis. The following warnings would be indicated:- a) 'A.TRIM' red warning light flashing for 10 seconds on the WU. b) 'P' and 'Y/R' flashing red on the PFD for 10 seconds, followed by a steady amber 'P' while flashing 'R' in red for 5 seconds, followed by a steady amber 'P' and steady amber 'R' indicating a double roll actuation failure and loss of SAS on the roll axis. c) On the CAD the following messages would be displayed in amber:- 'DECOUPLE' (10 seconds), 'TRIM' and 'ACTUATION' Although stability augmentation would be lost in the roll axis, the pitch and yaw SAS would still be operational, together with the pitch damper function. Hence the helicopter pitch and yaw stability characte