National Transportation Safety Board
Washington, D.C. 20594
Safety Recommendation
Date: November 17, 2005
In reply refer to: A-05-33 through -35
Honorable Marion C. Blakey
Administrator
Federal Aviation Administration
Washington, D.C. 20591
On August 10, 2005, a Sikorsky S-76C+ helicopter,1 operated by Copterline under Finland registration OH-HCI, departed Tallinn, Estonia, for Helsinki, Finland. The helicopter experienced an upset and crashed into the Baltic Sea, killing all 12 passengers and two pilots. Specifically, the recorded data from the aircraft’s flight data recorder (FDR) showed that the helicopter suddenly pitched up and rolled to the left, followed by a series of rotations to the right until striking the water. The Aircraft Accident Investigation Commission (AAIC) of Estonia is investigating the accident with the assistance of accredited representatives from the United States National Transportation Safety Board and the Accident Investigation Board Finland under the provisions of Annex 13 to the International Convention on Civil Aviation. The investigation is ongoing and the cause of the accident has not been determined.
The investigation to date has revealed that one of the hydraulic actuators that control the main rotor blades of the accident helicopter may have extended uncommanded during flight, resulting in the loss of control. There were a number of serious discrepancies found within the forward actuator that are potential sources of uncommanded movement of the forward actuator. The Safety Board believes that the findings to date show that corrective action must be taken immediately to better assure the continuing airworthiness of the main rotor actuators.
On the S-76C helicopter, three hydraulic actuators (forward, aft, and lateral) control the main rotor blades. Each actuator features a side-by-side dual design in which a helicopter’s two independent hydraulic systems (systems 1 and 2) power each side of an actuator.
FDR data and aerodynamic simulations are consistent with an uncommanded extension of the forward actuator. The data suggest that the forward actuator was not properly responding to pilot inputs and its movement could not be controlled. Furthermore, ground tests of the S-76 control system and additional aerodynamic simulations indicate that an uncommanded extension of the forward actuator will result in a large nose-up pitch upset, a large roll to the left, an aft movement of the cyclic control, and an upward movement of the collective control. All of these unexpected aircraft and control movements were recorded by the accident FDR at the time of the upset.
During postaccident testing, the accident helicopter’s forward actuator failed a manufacturer’s acceptance test. Specifically, with both hydraulic systems pressurized, the actuator would extend on command, but the retraction time to the neutral position was much slower than the test protocol specified. With only system 2 pressurized, the actuator extended without an input command and would not retract when commanded. With only system 1 pressurized, the actuator extended and retracted slower than test protocol specified. Further, the actuator greatly exceeded allowable internal hydraulic fluid leakage limits. Additionally, actuator movement was described as “notchy,” with “excessive resistance.” Although failure of the manufacturer’s acceptance test does not necessarily denote an unsafe actuator, the degree and manner in which this actuator failed portions of the test demonstrates that control of the actuator was lost and that an unsafe condition existed in the actuator.
Subsequent disassembly of the actuator revealed the following discrepancies: 1) large pieces of copper/aluminum plasma coating had flaked off the piston; 2) the piston head and balance tube seals had excessive wear and pieces of the piston plasma coating were embedded in the seals and control valve, all of which contributed to internal hydraulic fluid leakage; 3) pieces of plasma coating had blocked one of the return ports in the control valve; and 4) numerous pieces of plasma coating were found throughout the actuator. The role that each of these discrepancies may have played in the operation of the forward actuator is not fully understood. However, the tests and examinations clearly show that the condition of the forward actuator is unacceptable. Because proper operation of main rotor actuators is critical to safe flight, the Safety Board urges the Federal Aviation Administration (FAA) to take immediate action as described further below to ensure the continuing airworthiness of the S-76 fleet.
Internal Leakage of Hydraulic Fluid
There are several potential causes of internal leakage in an actuator, each of which may result in an actuator that fails to operate properly. For example, if the piston head seals are worn or damaged, fluid can leak internally between the extend and retract chambers. Additionally, if the balance tube seals are worn or damaged, fluid can leak internally and the differential force between the extend and retract chambers will be out of balance. Further, the improper operation or jamming of a control valve or bypass valve can result in internal leakage.
The Sikorsky S-76 maintenance manual contains a procedure to measure internal hydraulic fluid leakage within an actuator, but operators are not required to perform this procedure regularly. (According to Sikorsky, operators typically only perform this at installation and as a troubleshooting procedure to identify whether internal leakage is a factor in a problem with an actuator.) The procedure involves application of a known hydraulic pressure to each control valve individually and measurement of the resultant hydraulic fluid flow rate in the return line. A higher-than-normal flow rate in the return line during this test indicates internal hydraulic fluid leakage and the actuator must be replaced before further flight.
As noted above, the forward actuator from the accident helicopter had excessive hydraulic fluid leakage rates. The piston head and balance tube seals had been in use for 2,200 hours, and teardown revealed that they were extremely worn, which the Safety Board believes contributed to the abnormal operation of the actuator during postaccident testing. Although the internal hydraulic fluid leakage tests do not identify the cause of internal leakage, high internal leakage is indicative of an actuator that may not have the redundancy or safety margin required of a critical flight control system. The Safety Board concludes that regular performance of the manufacturer-specified internal leakage test would help operators identify internal hydraulic fluid leakage that could impede effective actuator functioning. Therefore, the Safety Board believes that the FAA should require Sikorsky S-76 helicopter operators to: 1) conduct an immediate internal leakage test of all main rotor actuators with more than 500 hours since new and/or overhaul; 2) conduct subsequent recurring tests at a period not to exceed 500 hours; 3) report the test results to the FAA and/or Sikorsky; and 4) correct any problems as necessary.
Contaminated Hydraulic Fluid
A plasma coating is applied to the piston ends to protect them from wear. This protective coating is expected to wear. However, it was assumed that the pieces of material that were worn off would be microscopic in size and filtered from the hydraulic fluid as it returned to the reservoir. If larger flakes or grit are present, they may become trapped in the ports of the control valve, obstruct flow, cause jams, or create other malfunctions within the actuator. The flakes and grit can cause excessive wear of the seals within the actuator.
Disassembly of the accident helicopter’s forward actuator revealed that two large flakes of plasma coating were substantially blocking a hydraulic port in the control valve, restricting the return of hydraulic fluid to the reservoir. This blockage reduced the return hydraulic fluid flow through the control valve by an estimated 50 percent and likely contributed to the malfunction of the actuator. In addition, fine grit to flake-sized particles were embedded in the worn seals, in the control valve, and in the hydraulic fluid in the piston cavities. Numerous large flakes were found in the filter downstream of the accident actuator. Flakes found in the filters would indicate that unacceptable deterioration has occurred within an actuator and that larger flakes may be trapped inside one or more of the actuators.
The actuator system’s operation can be compromised when larger-than-microscopic plasma pieces, such as those found during the Safety Board’s examination, are present. The Safety Board is concerned because the presence of the large particles and flakes of the plasma coating and resultant blockage of hydraulic ports can interfere with the response of the actuator to control inputs and contribute to seal damage (which, as noted above, can lead to internal leakage and, therefore, further potential loss of functioning). Thus, timely examination of the filter elements is necessary to detect the existence of plasma flakes or other debris. The existence of plasma flakes in the filter should result in the replacement of all main rotor actuators.
Sikorsky recommends an annual hydraulic fluid check of the S-76 for the presence of contaminants. (Copterline helicopters average about 2,600 flight hours per year; other operators achieve up to 5,000 hours of flight time per year.) HR Textron recommends overhauling actuators every 3,000 hours, and HSI recommends replacement based on condition. Testing for hydraulic fluid contaminants could help operators identify abnormal wear within an actuator (including abnormal wear of the plasma coatings) and/or the presence of other contaminants in the fluid that could adversely affect an actuator’s performance.
Sikorsky has defined acceptable levels of contamination in its maintenance manual. This actuator failed at 2,200 hours since overhaul. Since the exact failure mode is not yet known, conservative test periods for fluid checks and filter element examinations need to be established. Thus, more frequent testing of the hydraulic fluid and examination of the filter elements in all S-76 helicopters is necessary to identify potential contamination before fluid flow restriction occurs. Until investigators identify the cause of and a long-term solution for the larger-than-expected plasma flakes, the Safety Board believes that the FAA should require Sikorsky S-76 helicopter operators to: 1) conduct immediate visual and laboratory examinations of hydraulic fluid and filter elements in hydraulic systems with actuators with more than 500 hours since new and/or overhaul for plasma flakes or other contamination that exceeds the manufacturers’ allowable limits of concentration and size; 2) conduct subsequent recurring tests at a period not to exceed 500 hours; 3) report findings of contamination and flakes to the FAA and/or Sikorsky; and 4) correct any problems as necessary.
Unbalanced Hydraulic Pressure
Ground testing and subsequent teardown of the failed actuator in this accident revealed that the piston head seals had worn differently and exhibited different leakage characteristics, resulting in different hydraulic pressures between systems 1 and 2. When the dual hydraulic systems are not balanced, the actuator may experience a loss of control. The Sikorsky S-76 flight manual contains an operational check to identify unbalanced hydraulic pressure at engine start. The S-76 flight manual contains two preflight checks to be performed at every engine start. The first check requires pilots to check for overall smooth function of the flight controls. (Postaccident testing characterized the accident helicopter’s forward actuator to be “notchy.”) The second check requires pilots to switch off first one hydraulic system and then the other, watching for a change (referred to as “stick-jump”) in position of the flight controls. Such a jump would indicate a difference in hydraulic pressure between the systems and repair would be required before further flight. The accident helicopter’s FDR data showed that the stick-jump test had been performed in that aircraft only three times during the previous 14 engine starts. The stick-jump test was not performed at the accident engine start. The Safety Board believes that the FAA should direct the principal operations inspectors of all Sikorsky S-76 helicopter operators to reemphasize the importance of and requirement for a preflight check of control movement smoothness and flight control “stick-jump” at every engine start.
Although the Safety Board’s investigation is still ongoing, the investigation to date has clearly identified a number of actions that can be taken to better ensure the airworthiness of the three main actuators on Sikorsky S-76 helicopters. The Safety Board believes that the accomplishment of these actions is urgent.
Therefore, the National Transportation Safety Board recommends that the Federal Aviation Administration:
Require Sikorsky S-76 helicopter operators to:
Require Sikorsky S-76 helicopter operators to:
Direct the principal operations inspectors of all Sikorsky S-76 helicopter operators to reemphasize the importance of and requirement for a preflight check of control movement smoothness and flight control “stick-jump” at every engine start. (Urgent) (A-05-35)
1 Sikorsky S-76 series helicopters are manufactured and certificated in the United States. According to Sikorsky, S-76 helicopters have been flown more than 4 million hours by more than 220 operators in 60 countries around the world. Sikorsky is scheduled to deliver the 600th aircraft in the series later this year.
2 In addition, representatives from Sikorsky, HR Textron, Honeywell, Helicopter Support Industries (HSI [a subsidiary of Sikorsky]), and the Federal Aviation Administration (FAA) are participating in the investigation as advisors to the U.S. accredited representative.
3 Sikorsky uses two main rotor actuator manufacturers for the S-76: HR Textron and HSI. The actuators can be used interchangeably on all S-76 series helicopters. The accident actuator in which a failure mode was detected during this accident investigation was manufactured by HR Textron (Sikorsky part number 76650-09805).
4 This accident represents the first involving a Sikorsky helicopter or a Safety Board helicopter investigation in which an FDR was onboard, allowing the Safety Board to identify a safety issue that had not previously been identified. An FDR is required for all recently manufactured aircraft capable of seating six or more passengers.
5 The pistons extend and retract with different amounts of force and the balance tubes reduce the differences.6 Piston head seals prevent fluid leakage between the extend and retract chambers, allowing the hydraulic fluid to pressurize the piston appropriately.
7 The actuator is designed with a bypass valve to release pressure from both the extend and retract chambers of the actuator in the event of a control valve jam.
8 The Sikorsky Component Overhaul Manual for the actuators recommends overhauling the actuator, including replacing all seals, every 3,000 hours.9 BBA Aviation, “Copterline Passes 10,000 Hour Milestone in S-76C+” (Orlando, Florida: Oxford Aviation Services Ltd., 2005).
10 “On-condition” replacement of an actuator occurs when either internal or external actuator anomalies are detected.11 A similar procedure is described in the S-76 maintenance manual.
Acting Chairman ROSENKER and Members ENGLEMAN CONNERS and HERSMAN concurred with these recommendations.
By: Mark V. Rosenker
Acting Chairman
