EASA Launch Helicopter Gearbox Lubrication Rule Making
The first meeting was held last week of a new European Aviation Safety Agency (EASA) Rule Making Team (RMT.0608) on helicopter gearbox lubrication. The Terms of Reference (ToR) and Group Composition (GC) are here. This activity follows European/US/Canadian dialogue after the loss of Cougar Sikorsky S-92A C-GZCH Flight 491 off Newfoundland, Canada on 12 March 2009 in which 17 people died, although one passenger, Robert Decker, survived.
The Canadian Transportation Safety Board (TSB) reported on that accident in 2011.
On 06 August 2002, Sikorsky carried out its initial certification loss of lubricant test by draining the MGB and using only the remaining residual oil (approximately 1.3 gallons) then continuing operation in accordance with the requirements of AC 29-2C.
The purpose of this test, outlined in the test documentation, was to demonstrate that the S-92A transmission could provide, “continued safe operation for a minimum of 30 minutes following a complete loss of lubricating oil in accordance with the requirements of FAR 29.927(c)(1).”
… Sikorsky and the FAA expected that, based on the similarities between the S-92A’s MGB and the Sikorsky S-60 [sic: H-60 / S-70] Black Hawk‘s MGB, the S-92A’s MGB would successfully operate for 30 minutes after draining the lubricating oil. The FAA indicated that the initial test was thought to be a low risk test, and Sikorsky scheduled it very late in the overall S-92A certification program.
This original S-92A test matched the way other manufacturers conducted such a loss of lubrication test. TSB explain that:
EASA indicated that applicants in its jurisdiction normally complied with Part 29.927(c)(1) by draining the MGB and continuing operation with only residual oil. Prior to the S-92A certification validation it had already tested and certified at least four helicopters using this criterion.
Aerossurance is aware that Canadian manufacturers also followed the same interpretation as the European manufacturers. Unfortunately with just 1.3 gallons of oil the S-92A MGB:
…suffered a catastrophic failure about 11 minutes after the test was started.
TSB go on:
Following the loss of lubricant test resulting in catastrophic failure, instead of taking steps to redesign the transmission to provide a 30 minute run dry capability [sic: this term is not used in regulation] for the MGB, Sikorsky re-visited the requirements of Part 29.927(c)(1). Relying on guidance from AC 29-2C and the FAA [Federal Aviation Administration] Rotorcraft Directorate, Sikorsky and the FAA concluded that, except for a potential failure of the oil cooler and its exterior plumbing, all other MGB failures leading to a total loss of oil were extremely remote.
…the MGB lubrication system was redesigned to incorporate a bypass valve. The loss of lubricant test was repeated on 16 November 2002 with the bypass system installed.
This test was carried out by draining oil from a leak in the oil cooler system. The leak was isolated and further oil loss was prevented when the bypass valve was activated. About 4.3 gallons or 40% of the maximum oil quantity remained in the MGB.
The S-92 was certified by the FAA on 17 December 2002, one month after the second test and in time to be awarded the prestigious Collier Trophy for “the greatest achievement in aeronautics or astronautics in America” of 2002.
Just one day before that certification, another Sikorsky product, an S-61N C-FHHD, was involved in an accident in Canada after a loss of main gear box oil, which should have helped demolished the fallacy that oil loss from any where other than the oil cooler was remote and allowed time for a rethink before the type entered service in 2004.
The European Joint Aviation Authorities (JAA) team however were not able to recommend certification until June 2004, by which time that recommendation went to EASA rather than individual national authorities in Europe. TSB report that the JAA had:
…required Sikorsky and the FAA to substantiate that all other possible failures of the MGB that could result in a rapid loss of oil were extremely remote.
Despite FAA and Sikorsky expectation that the disastrous original test was low risk because of Black Hawk experience, the justification made to JAA was also:
…based on relevant Black Hawk airworthiness data, the inclusion of the bearing monitoring system in the S-92A basic design configuration, and the assumption that service experience on the S-92A would prove to be similar to, or better than, that of the Black Hawk.
The fatal failure in Canada and a serious incident in Australian in August 2008, further highlighted that claim of ‘extremely remote’ failures and Black Hawk experience was a fallacy as the component that failed, the oil filter, was configured very differently to the smaller military Black Hawk. Consequently the bypass system had no benefit in the and in the Canadian S-92A accident drive to the tail rotor was lost approximately 10.5 minutes after the oil pressure warning, fairly consistent with the time to failure in the original, failed, August 2002 test.
In response to the Canadian accident EASA, the FAA and Transport Canada formed a Joint Cooperation Team (JCT) on the Review of Helicopter Main Gearbox Certification Requirements.
Subsequently EASA issued a draft Certification Memo to clarify EASA interpretation of this requirement in March 2012 for public consultation and prepared a Special Condition to use in the interim. Sixteen of the 19 comments submitted in the consultation came from Sikorsky, just two from AgustaWestland and one, of ‘no comment’, from the UK CAA. The Certification Memo, with only minor revisions, was formally issued in November 2013.
According to EASA, when this new rule making task is complete, expected in early 2016, a harmonised US/Canadian/European rule will require that:
…all CS-29 Category A rotorcraft undergoing a new type certification, or a significant change under Part 21.101, should comply with a loss of oil test and ‘extremely remote’ should be removed from the requirement.
UPDATE 2 February 2016: Other manufactures have had more design success: Airbus (nee Eurocopter’s) approach is described in this 2003 paper: Loss of Oil Behavior of Eurocopter Gearboxes from AS350 to EC225. Finmeccanica (now Leonardo’s) approach on the AW family is described here: Leonardo Strives For Greater Gearbox Loss of Lube Capability
UPDATE 31 May 2017: NPA 2017-07 Rotorcraft gearbox loss of lubrication is issued for consultation (until 31 July 2017).
…this NPA proposes to amend CS 29.917(a) to include rotor drive system gearbox lubrication systems in the definition of the rotor drive system. This means that these lubrication systems will be considered to be within the scope of the design assessment of 29.917(b).
As the design assessment CS currently addresses the risk of single hazardous and catastrophic failures, additional material has been added to complement the Federal Aviation Administration (FAA) Advisory Circular (AC) 29-2C, supporting 29.917(b), specifically in the domain of lubrication systems. CS 29.927(c) on ‘loss of lubrication’ has been completely revised and replaced by a more objective-based CS that requires substantiation of the gearbox ability to continue safe operation (for at least 30 minutes) after a loss of lubrication to be followed by a safe landing. This is supported by substantial changes to the associated acceptable means of compliance (AMC).
Finally, CS 29.1521 has also been amended to include an additional power plant limitation that describes how the RFM emergency procedures should reflect the test evidence relating to a loss of lubrication.
UPDATE 27 July 2017: UK CAA comments on NPA 2017-07.
UPDATE 31 July 2017: Aerossurance comments