Safety Recommendation A-04-069

Rolls-Royce announced on February 26, 2006, that it had obtained FAA certification for a modification of the Model 250 series IV engine control system that would enable backup engine control to be available immediately following loss of the primary FADEC, so that the backup system does not impose an undue workload on the pilot. The announcement also indicates that this modification will be provided without cost to all owners of the affected engines. With the certification of this revision, the FAA has met the intent of Safety Recommendation A-04-69, which is classified Closed Acceptable Action.

Letter Mail Controlled 9/25/2007 8:18:55 AM MC# 20705181: FAA Comment. The Board’s response letter, dated October 7,2005, indicates that Rolls Royce Corporation’s (RRC) introduction of a product improvement to the Model 250 Series IV Full Authority Digital Electronic Control (FADEC) engine control system is responsive to this safety recommendation. The Board also indicated that an Airworthiness Directive (AD) mandating the incorporation of the improved Electronic Control Unit (ECU) is needed.

The Federal Aviation Administration considers the addition of the Reversionary Governor to the ECU to be a FADEC control system product improvement that will reduce the frequency of reversions to manual mode. The reversionary governor function allows the ECU to continue to provide uninterrupted automatic fuel flow control if the ECU primary governor cannot function.

Rolls-Royce Corporation published Commercial Service Letter CSL-6 1 13R1, New Configuration Electronic Control Unit, dated September 2 1, 2005, notifying operators of the Model 250-C47 Series IV FADEC engine control system product improvement for single engine installations. This commercial service letter notified operators that RRC was offering a new configuration of the ECU with a reversionary governor function without cost to all operators who registered before December 31, 2005.

To support this effort, the FAA’s Aircraft Certification Service issued Special Airworthiness Information Bulletin (SAIB) NE-06- 12, dated December 2, 2005, strongly recommending operators to take advantage of the no cost product improvement being offered by RRC. Ninety percent of the eligible owner-operators have registered for the ECU control upgrade. As a result of the FAA and the RRC activities, RRC has a pool of units ready for retrofit, and expect to complete an upgrade of the fleet by December 3 1,2008. This implementation plan is acceptable to the FAA.

While the Model 250 series IV control system complies with FAA certification requirements without the incorporation of the ECU reversionary governor upgrade, the engine’s control system’s electronic components have undergone product improvements over the years continuously improving reliability. A review of RRC’s FADEC control system’s loss-of-thrust control (LOTC) service history for the previous 5 years has revealed that the LOTC rate has remained below the certification basis of 10 LOTC failures per million engine hours (as established under Advisory Circular, Compliance Criteria for 14 CFR Part 33

Letter Mail Controlled 2/26/2006 8:18:55 AM MC# 2070434: Rolls Royce Press Release 2/26/06 Rolls-Royce has achieved FAA certification of an enhanced full-authority digital engine control (FADEC) system for the Model 250-C47B turboshaft. This enhanced FADEC will benefit operators of the Bell 407 helicopter. The new EMC-35R FADEC system is identical to the original EMC-35A with the exception of the Electronic Control Unit (ECU). The major difference between the two units is that, while the original EMC-35A ECU utilizes a single electronic channel unit, the new EMC-35R ECU features a dual electronic channel unit.

The EMC-35R’s Primary Governor (PG) channel is functionally similar to the EMC-35A’s single channel, while the use of a Reversionary Governor (RG) channel introduces a back-up electronic control. When fitted with the new EMC-35R ECU, the Model 250 FADEC system still retains its manual hydraulic back-up control system. The effort to certify this new Model 250-C47B FADEC results from an extensive and detailed engineering test program, during which Rolls-Royce was able to demonstrate that the probability of a ‘reversion to manual’ scenario is reduced by 60 percent.

This improvement will provide an increased operational benefit to the pilot, allowing continued flight in an automatic governed mode. To assist with the introduction of the new FADEC system, Rolls-Royce has issued two Customer Supportters (CSLs 6113 and 6117) which provide further details, and which request that affected operators register in order to allow all affected operators to be identified. The new EMC-35R ECU will be provided to operators at no cost, provided that they have registered in accordance with these CSLs and that the existing core ECU is returned. The new ECUs will be supplied with a new 24-month / 1,000-hour (whichever comes first) warranty.

This new FADEC system will also be certified on the Model 250-C47M turboshaft later in 2006, extending the same benefits to operators of the MD Helicopter Inc. MD 600N.

The FAA's March 24, 2005, letter provided a detailed analysis of this recommendation. In that letter, the FAA indicates that it could not find in advisory circular (AC) 27-1B the requirement, referenced in the Safety Board's December 15, 2004, letter that transmitted this recommendation to the FAA, that the backup system "be available immediately following loss of the primary system." Page MG 4-6 of AC 27-1B, paragraph (iii) provides the information that the Board referenced. That paragraph is shown below, with relevant portions emphasized.

(iii) Capability of back-up system: Section 27.1143 requires that each power control provide a positive and immediately responsive means of controlling its engine. Additionally, § 27.903 requires that the powerplant systems associated with engine control systems are designed to give reasonable assurance that the engine operating limitations will not be exceeded in service. Although back-up control may be somewhat degraded, the system should allow for control of the engine and the aircraft within their operating limits.

It should be demonstrated that upon failure of the primary control the aircraft can continue to be operated safely and execute a controlled power-on landing without creating an undue pilot workload. This includes demonstration of the ability to maintain rotor speed within acceptable limits while transitioning to the backup mode and while using the backup control.

The FAA referenced other portions of the AC (on pages MG 4-6 and MG 4-9) that indicate that it should be confirmed during the flight test program that is part of the aircraft's certification that any time delays and power variations associated with transfers between the primary and backup modes are acceptable. The FAA stated that during the Bell 407 flight test program, Transport Canada pilots evaluated transfers from the primary to the backup mode and found that these transfers can be successfully made and the rotorcraft can be operated in the backup mode without an undue increase in flight crew workload. The FAA stated that it has validated Transport Canada's helicopter certification.

Letter Mail Controlled 3/30/2005 10:51:13 AM MC# 2050138: The FAA has reviewed this safety recommendation and other information contained in the Board's letter dated December 15, 2004. On page 4, the Board states: "According to FAA Advisory Circular (AC) 27-1B, Chapter 3 Airworthiness Standards Normal Category Rotorcraft, Miscellaneous Guidance (MG), modified or new backup systems for FADEC-equipped engines should be available immediately following loss of the primary system, be independent such that failure in the primary portion of the system will not propagate to the backup portion, and provide the pilot with a means to verify its availability at will.

The Board is concerned that the manual mode of the FADEC system in Rolls-Royce Model 250 series IV engines does not meet these guidelines. Therefore, the Board believes that the FAA should require Rolls Royce to modify the Model 250 series IV engine control system so that backup engine control is available immediately following loss of primary full authority digital electronic control (FADEC) function and such that the backup system does not impose undue workload on the pilot." The FAA could not find the referenced requirement that the backup system "be available immediately following loss of the primary system...." However, AC 27-1B does contain the following relevant information:

On page MG 4-6: (v) Transfer to backup: The transfer to the back-up mode from the primary control mode or an intermediate mode (fixed position) should occur without excessive time delay or variation in power. Time delays and power variations experienced during the transfer should be evaluated during flight test for acceptability. A means should be provided to alert the pilot that transfer to the back-up mode has occurred. On page MG 4-9: (B) Manual Backup: Additional aircraft operational testing is required to specifically evaluate the manual backup system for compliance with the FAR requirements.

The acceptability of the manual backup system depends substantially on its installation and interface with the airframe. The following items need to be demonstrated in accordance with 14 CFR 27.927 and 14 CFR 27.939

Letter Mail Controlled 2/1/2005 3:15:53 PM MC# 2050036. *This letter is NOT from the FAA, but from Rolls-Royce, and is directly pertinent to implementation of the recommendations*: On December 15,2004, your office released a five-page letter regarding Safety Recommendations A-04-68 and A-04-69, These recommendations and the associated information within your letter pertain to an incident involving the Rolls-Royce Model 250-C47B engine installed in a Bell 407 helicopter (N491 PH) operated by Petroleum Helicopters, Inc. (PHI). This incident was initiated by a capacitor short in the Electronic Control Unit (ECU) -15 volt power supply, which rendered the ECU inoperative.

The inoperative ECU transferred control of the engine to the backup hydromechanical system. This system requires the pilot to manually control the engine speed, torque and temperature. In this particular incident, the pilot did not believe that the engine was properly responding to his control inputs and consequently elected to perform an autorotation into the Gulf of Mexico. The autorotation was successful and the pilot and passengers were subsequently retrieved. The purpose of this letter is to clarify some information contained in your December 15, 2004 letter and provide additional context regarding some of the conclusions.

In addition, Rolls-Royce would like to acknowledge some of your concerns, which are contained within A-04.68 and A-04-69. Lastly, Rolls-Royce would like to raise concern over recent trends regarding NTSB recommendations associated with the Rolls-Royce Model 250 engine and request improvement in coordination between the NTSB, FAA and industry. On December 15,2004, your office released a five-page letter regarding Safety Recommendations A-04-68 and A-04-69, These recommendations and the associated information within your letter pertain to an incident involving the Rolls-Royce Model 250-C47B engine installed in a Bell 407 helicopter (N491 PH) operated by Petroleum Helicopters, Inc. (PHI).

This incident was initiated by a capacitor short in the Electronic Control Unit (ECU) -15 volt power supply, which rendered the ECU inoperative. The inoperative ECU transferred control of the engine to the backup hydromechanical system. This system requires the pilot to manually control the engine speed, torque and temperature. In this particular incident, the pilot did not believe that the engine was properly responding to his control inputs and consequently elected to perform an autorotation into the Gulf of Mexico. The autorotation was successful and the pilot and passengers were subsequently retrieved.

The purpose of this letter is to clarify some information contained in your December 15, 2004 letter and provide additional context regarding some of the conclusions. In addition, Rolls-Royce would like to acknowledge some of your concerns, which are contained within A-04.68 and A-04-69. Lastly, Rolls-Royce would like to raise concern over recent trends regarding NTSB recommendations associated with the Rolls-Royce Model 250 engine and request improvement in coordination between the NTSB, FAA and industry.