Air transportation safety recommendation A07-09

Reassessment of responses to Aviation Safety Recommendation A07-09

Underrated hydraulic cut-off switch

Background

At 1725 local time, the pilot of the Eurocopter AS 350 B2 helicopter (registration C-GNMJ, serial number 2829) with a 120-foot longline attached, entered a stable, out-of-ground-effect hover to begin coiling the longline onto the ground below the helicopter. As the pilot gradually descended, and at a height of about 10 feet above ground level, he experienced significant binding in the flight controls. The pilot was unable to rectify the control binding and had considerable difficulty maintaining attitude and altitude control of the helicopter. During 15 seconds of random, uncontrolled hover flight, the helicopter turned and climbed to about 20 feet above ground level, whereupon the pilot retarded the throttle lever, causing the main rotor rpm to decay rapidly. As a result, the helicopter descended quickly, struck the ground, bounced, and landed upright, causing substantial damage to the skids, the tail boom, and the main rotor head. The pilot was not injured and the impact forces were insufficient to activate the emergency locator transmitter.

The Board concluded its investigation and released report A05F0025 on 28 June 2007.

Board Recommendation A07-09 (28 June 2007)

The hydraulic cut-off (HYD CUT OFF) switch used in the AS 350 B2 is a guarded toggle switch with two positions - ON or OFF - and is mounted on the pilot's collective lever. The switch is normally set to the ON position, allowing the servos to be powered when the hydraulic system is functioning correctly.

In the event of a hydraulic system failure, the pilot selects the HYD CUT OFF switch to the OFF position. This procedure is designed to rapidly deplete the hydraulic system pressure to zero, and ensure that the accumulator hydraulic pressures deplete symmetrically. Both a rapid and symmetrical depletion are required to provide consistent behaviour of the flight controls when transitioning from powered to unpowered flight controls. If, in the presence of a hydraulic system failure, the HYD CUT OFF switch does not function properly, the servos may unpower asymmetrically as the accumulators bleed off. This situation can result in inconsistent and possibly unmanageable forces at the flight controls that in turn may lead to loss-of-control flight. Additionally, TC warns, in its AD CF-2003-15R2, that if the HYD CUT OFF switch becomes defective the abnormal feedback forces may, in some cases, remain for the duration of the flight.

The HYD CUT OFF switch from the accident helicopter was examined and bench-tested serviceable (TSB Engineering Laboratory report LP 036/2005). However, a circuit analysis (TSB Engineering Laboratory report LP 123/2005) revealed that the switch (Honeywell part number 12TW1-3) controls an inductive electrical load of about 4 amperes (A). However, the switch is designed to carry a maximum inductive electrical load of 2 A. Furthermore, Federal Aviation Administration (FAA) Advisory Circular (AC) 43.13-1B states that a switch should be derated (that is, the rated electrical capability is reduced) from its nominal current rating when controlling an inductive circuit because the "magnetic energy stored in solenoid or relay coils that is released when the control switch is opened may appear as an arc." Applying the derating factor, the maximum inductive load for the 12TW1-3 switch would be 2.5 A. Therefore, the switch used in the AS 350 hydraulic cut-off application can be considered underrated as the electrical load of 4 A exceeds its maximum allowable inductive load value.

The present situation is, in part, due to modifications to the electrical and hydraulic systems that have increased the inductive electrical load seen by the 12TW1-3 switch by approximately 33 per cent since certification. Additionally, it is instructive to note that the use of the HYD CUT OFF switch is an emergency procedure, yet the switch manufacturer warns that the 12TW1-3 switch cannot be used as ". . . safety or emergency stop devices, or in any other application. . ." where failure could result in personal injury, and that ". . . failure to comply with these instructions could result in death or serious injury."

When a switch is underrated for its application, it draws too much current and is considered electrically overloaded. This situation can lead to accelerated aging of the switch and consequent premature failure. Service history of the 12TW1-3 switch reveals several failures and instances of intermittent or incomplete performance.

During this investigation, a similar accident occurred in the United States involving a Canadian-registered helicopter that crashed because of control difficulties. On 28 May 2006, at about 1500 eastern standard time, an AS 350 BA (C-GGLM) experienced a loss of hydraulic power in flight and landed heavily in an open field near Goshen, New York, United States. The helicopter sustained substantial damage, but the two occupants were not injured. The National Transportation Safety Board (NTSB) conducted an investigation into this accident (NTSB occurrence NYC06LA121). In concert with the NTSB, the TSB Engineering Laboratory undertook an examination of the collective HYD CUT OFF switch installed in C-GGLM to determine if the operation of this switch had contributed to the accident. The TSB examination (TSB Engineering Laboratory report LP 095/2006) revealed latent defects with this particular collective HYD CUT OFF switch and assessed the switch type as underrated in this application. The collective switch in the AS 350 BA differs from the one installed in the AS 350 B2; however, its function is identical. The switch is a latching, pushbutton type NE-15, manufactured by ITT Composants et Instruments as part number NE15FBAT11TFGNOIR.

There are approximately 360 AS 350 helicopters in Canada and 3000 worldwide that have either the 12TW3-1 switch or the NE-15 switch installed. Although these switches are both approved for use as an AS 350 HYD CUT OFF switch, their underrated value for this specific application may adversely affect in-service performance and play a role in AS 350 loss-of-control occurrences. Therefore, the Board recommends that:

European Aviation Safety Agency response to A07-09 (19 March 2010)

EASA advises that Eurocopter recognizes that the hydraulic cut-off switch experienced a series of problems following the introduction of a design change which increased from 3 to 4 the number of "electrovalves" commanded by the switch. The risk analysis conducted by the manufacturer considers the severity of the failure of the hydraulic cut-off switch which can be detected during the pre-flight check as minor and the loss of the hydraulic cut-off switch together with the seizure of the servo-slide valve distributor as catastrophic. The probabilities associated to both cases have been shown acceptable when compared with the certification safety objectives for the two failure criticality levels.

In addition, Eurocopter developed a new design change which is intended to avoid premature deterioration of the switch. This newly designed switch has been installed on all aircraft manufactured since December 2008. Eurocopter has also issued a non-mandatory Service Bulletin that recommends the retrofit of the hydraulic cut-off switch.

Given the above, EASA considers this issue closed.

Board assessment of the response to A07-09 (09 March 2011)

The Board is pleased with the work EASA and Eurocopter have accomplished to mitigate the risks associated with the deficiency identified in its Recommendation A07-09. Developing a new hydraulic cut-off switch design for production aircraft and encouraging operators to retrofit through a service bulletin are both good strategies to reduce the risks. However, the Board would like to have seen an indication that the Eurocopter supply system has been purged of the existing hydraulic cut-off switch design.

Because EASA's action will reduce, but will not substantially reduce or eliminate, the deficiency raised in Board Recommendation A07-09, the response assessment remains as Satisfactory in Part.

European Aviation Safety Agency response to A07-09

In a letter dated 21 October 2011, the TSB requested that EASA provide an update as to the progress of its activities taken to mitigate the residual risks associated with Recommendation A07-09. To date, EASA has not responded.

Board assessment of the residual risks to A07-09 (07 March 2012)

Because EASA did not respond to the TSB's request, some Canadian operators were contacted to determine if Eurocopter might have provided them with additional information since the issuance of the non-mandatory Service Bulletin that recommends the retrofit of the hydraulic cut-off switch. The TSB did not find any instruction from Eurocopter to Canadian operators informing them to remove the defective switches from existing inventories.

Although the initial EASA and Eurocopter responses reduced the risk of hydraulic control switch failure, without removing the under-rated switches from the parts supply system and existing inventories, the risk still remains that the original switch could be installed in a Canadian-operated helicopter and lead to hydraulic system control difficulties. As no additional information has been received to suggest another strategy to mitigate the risks associated with this aspect of Recommendation A07-09, the actions taken will reduce, but will not substantially reduce or eliminate, the deficiency raised in Board Recommendation A07-09.

The response is considered Satisfactory in Part.

Board review of A07-09 deficiency file status

On 19 March 2010, EASA had indicated that it considered this issue closed. EASA did not respond to last year’s TSB request to provide an update on the progress of its activities taken to mitigate the residual risks associated with Recommendation A07-09, nor did it respond to this year’s request for an update, dated 18 October 2012. The TSB has yet to hear back from Eurocopter on the results of its newly designed switch.

Board assessment of the residual risks to A07-09 (06 March 2013)

EASA’s failure to respond to TSB’s request for an update prevents a meaningful assessment of the residual risk associated with A07-09. In its 07 March 2012 assessment, the Board had pointed out that, without removing the under-rated switches from the parts supply system and existing inventories, the risk still remained that the original switch could be installed in a Canadian-operated helicopter and lead to hydraulic system control difficulties. As no additional information has been received to suggest another strategy to mitigate the risks associated with this aspect of Recommendation A07-09, the actions taken will reduce, but will not substantially reduce or eliminate, the deficiency raised in Board Recommendation A07-09.

The response is considered Satisfactory in Part.

European Aviation Safety Agency response to A07-09 (30 October 2013)

The European Aviation Safety Agency (EASA) responded with a copy of its 19 March 2010 response, which states in part, “Eurocopter has also issued a non-mandatory Service Bulletin that recommends the retrofit of the hydraulic cut-off switch.”

The manufacturer recognizes that the hydraulic cut-off switch experienced a series of problems following the introduction of a design change that increased from 3 to 4 the number of electrovalves commanded by the switch. The risk analysis conducted by the manufacturer considers the severity of the failure of the hydraulic cut-off switch, which can be detected during the pre-flight check, as minor, and considers the loss of the hydraulic cut-off switch together with the seizure of the servo-slide valve distributor as catastrophic. The probabilities associated with both cases have been shown as acceptable when compared with the certification safety objectives for the two failure criticality levels.

On top of that, Eurocopter developed a new design change which is intended at avoiding premature deterioration of the switch. Such design change is applicable on all new aircraft since December 2008, and a retrofit is to be recommended via a non-mandatory service bulletin.

Given the above, EASA partially accepts this recommendation, in that the analysis performed was able to show still an acceptable safety level. In addition, a way ahead has been agreed upon with the manufacturer to introduce an improved design.

Board assessment of the response to A07-09 (02 April 2014)

The Board's 07 March 2012 assessment pointed out that, without removing the underrated switches from the parts supply system and existing inventories, the risk still remained that the original switch could be installed in a Canadian-operated helicopter and lead to hydraulic system control difficulties. Further to that, TSB staff determined that Eurocopter has not issued any service bulletins that recommend the retrofit of the new hydraulic cut-off switch. Therefore, the actions taken will not eliminate the deficiency raised in Board Recommendation A07-09. However, the response suggested that further updates related to the issue are ongoing.

Therefore, the response is considered as Satisfactory in Part.

European Aviation Safety Agency response to Recommendation A07-09 (March 2015)

The issue of the premature deterioration of the HYD CUT-OFF switch was tackled by Airbus Helicopter with the modification AMS 073397 (approved in December 2008) consisting in the installation of Relay “47D”. This modification had been certified on all versions and applied on aircraft in production (AS 350 B2, B3, C3). Only new aircraft (AS 350 B2, B3, C3) were equipped with this modification but a new event reported in 2011 caused the delay of the associated Service Bulletin publication.

The new issue on Relay 47D was identified. To solve this issue a modification which is an adaptation of the 47D switch wiring had been decided by Airbus Helicopter. The subject was addressed through modification AMS 4627 that was approved in June 2012 for models AS 350 B2, B3 and AS 550 C3.

As a result, Service Bulletin 29.00.16 (AS 350 B2, B3) and Service Bulletin 29.00.12 (AS 550 C3) were published in August 2012 to retrofit AMS 4627 on aircraft equipped with AMS 073397. Airbus Helicopter recommended compliance with these Service Bulletins.

The design office of Airbus Helicopter was initially planning to issue a further Service Bulletin to simultaneously retrofit AMS 3397 and AMS 4627, but customer support experts drove the design of a new modification MOD 4688 to be implemented on models AS 550 D, B, B1, B2, B3, BA, BB, E and the activity finally produced the design drawings that were dispatched on January 2014. This modification will update customer aircraft PRE MOD 3397, PRE MOD 4627. The modification was approved under DOA in May 2014.

In January 2015, Airbus Helicopter performed the final internal loop of validation for Service Bulletin AS 350 29.00.18 (B, BA, BB, B1, B2, B3, D) and the Service Bulletin AS 350 29.00.12 (E), link to MOD 4688. These Service Bulletins will be dispatched, in accordance with availability parts, in April 2015.

Board reassessment of the response to Recommendation A07-09 (March 2015)

The Board believes that this latest action taken by EASA, once fully implemented, will eliminate the safety deficiency identified in A07-09.

Therefore the assessment is Fully Satisfactory.

Next TSB action

The deficiency file is Closed.