N373RLBell 407 · 1999

On November 11, 2014, about 1355 central standard time, a Bell 407 helicopter, N373RL, was landed on the Gulf of Mexico, Louisiana, following a droop in engine power. The pilot and three passengers were uninjured. The helicopter sustained no damage during the water-landing. The helicopter was registered to and operated by Rotorcraft Leasing Company LLC, under the provisions of 14 Code of Federal Regulations Part 135, as a passenger flight. Day visual flight rules (VFR) conditions prevailed for the flight, which operated on a company VFR flight plan. The flight originated from Viosca Knoll 989 (VK 989), an offshore platform in the Gulf of Mexico, and was destined for Main Pass 301 (MP 301), another offshore platform in the Gulf of Mexico.

According to the operator's incident report, the pilot reported that approximately 30 seconds after takeoff at about 400 feet above sea level, a series of compressor stalls and engine surges began. The pilot adjusted the collective pitch and began a slow decent. After lowering the engine power, the surges and stalls ceased and the pilot's plan, at this point, was to try to attempt to fly the helicopter back to VK 989. At approximately 250 feet – 300 feet, the pilot began increasing the collective to regain some power, but the engine surges and stalls reoccurred. The pilot reported hearing the low RPM horn and when he observed the rotor RPM gauge (Nr), the Nr was about 90 percent and the power turbine gauge (N2) indicated it was running high; at or near redline. At this point, the pilot made the decision to land the helicopter in the water in the Gulf of Mexico. He fully lowered the collective to salvage the RPM. The engine was still surging at flat pitch so he rolled the throttle to idle and entered an autorotation. The pilot prepared the passengers for the landing and radioed a mayday notification to the operator's flight following station. He then activated the float inflation handle, pressed the aircraft quick position button, flared the helicopter, and landed on the water. The pilot estimated from the time of the initial compressor stall to water contact was approximately 15 to 30 seconds.

The helicopter did not sink. The pilot subsequently deployed the life rafts and got a verbal response from all the passengers that they were "ok." He directed the passengers to collect their belongings and a first aid kit in case it was needed. They got into the life raft on the left hand side of the helicopter.

The pilot, age 30, held a commercial pilot certificate with airplane single engine land, rotorcraft-helicopter, and instrument helicopter ratings. His most recent second-class medical certificate was issued on December 9, 2013, with no limitations. The most recent pilot's flight review was accomplished on January 20, 2014. According to the operator, the pilot had accrued a total of approximately 2,211 hours of flight time, including 1,064 hours as pilot-in-command in the Bell 407. He accumulated 145 hours of flight time in the Bell 407 in the 90 days prior to the accident and 67 hours of flight time in the Bell 407 in the 30 days prior to the accident.

N373RL was a 1999, Bell 407 helicopter with serial number 53373. The single-engine helicopter was powered by a Rolls-Royce model 250-C47B turbo shaft engine with serial number CAE847835, which drove a four-bladed main rotor system and a two-bladed tail rotor. The engine's type certificate data sheet indicated it had a takeoff rating of 650 shaft horsepower for five minutes and a rating of 600 shaft horsepower for continuous operations. The helicopter was configured to carry one pilot and six passengers. The operator reported its maximum gross weight was 5,250 pounds and that it weighed 4,306 pounds at the time of the incident.

According to the operator, the helicopter was maintained in accordance with an approved inspection program. The helicopter's last inspection was completed on October 27, 2014. The operator indicated that the helicopter's total time at the time of the incident was 7,216 hours.

A FAA major repair and alteration form, dated February 6, 2012, showed that the helicopter was fitted with a FDC Aerofilter engine inlet barrier filter.

The Rolls Royce Model 250-C47B engine incorporates a Triumph Engine Control Systems model EMC-35R Full Authority Digital Electronic Control (FADEC) system that electronically controls engine fuel flow via a Hydro-mechanical Unit (HMU), and Electronic Control Unit (ECU).

The function of the FADEC System is to assist the pilot by controlling the engine RPM as a part of maintaining the rotor rpm as variations in engine loading result from helicopter operational maneuvers. At any time, the pilot may de-select the FADEC System and acquire complete control of engine fuel modulation (a back-up mode of operation).

The FADEC ECU contains two embedded processor systems that execute application specific engine control software. The primary system operates by sensing the pilot controlled, collective twist-grip throttle position (Power Level Angle -PLA), among other engine sensor inputs to determine the engine fuel flow requirements necessary to maintain efficient engine operation. The reversionary system is a second level of electronic fuel control governing that will be automatically switched to, should certain fault conditions be detected in the primary system. Both the ECU primary and reversionary systems control an electric motor in the HMU that modulates fuel flow to the engine.

In addition, the FADEC ECU monitors engine condition and will record and store engine operating exceedances and system fault information in a non-volatile memory device in the ECU. For certain system failures, the FADEC systems will automatically de-select the FADEC operation and transition to back-up (pilot control) operation.

The HMU consists of a gearbox mounted fuel pump, a motor driven fuel metering valve, a back-up fuel control system, a PLA input shaft, and feedback position sensors. The HMU contains components that receive electrical signals to/from the ECU as a part of the FADEC operation and is the point of fuel flow in the FADEC or back-up modes of operation.

At 1350, the recorded weather at the Houma-Terrebonne Airport, near Houma, Louisiana, was: Wind 190 degrees at 7 knots; visibility 7 statute miles; sky condition scattered clouds at 4,200 feet, broken clouds at 6,500 feet; temperature 26 degrees C; dew point 16 degrees C; altimeter 29.96 inches of mercury.

N373RL was a 1999, Bell 407 helicopter with serial number 53373. The single-engine helicopter was powered by a Rolls-Royce model 250-C47B turbo shaft engine with serial number CAE847835, which drove a four-bladed main rotor system and a two-bladed tail rotor. The engine's type certificate data sheet indicated it had a takeoff rating of 650 shaft horsepower for five minutes and a rating of 600 shaft horsepower for continuous operations. The helicopter was configured to carry one pilot and six passengers. The operator reported its maximum gross weight was 5,250 pounds and that it weighed 4,306 pounds at the time of the incident.

According to the operator, the helicopter was maintained in accordance with an approved inspection program. The helicopter's last inspection was completed on October 27, 2014. The operator indicated that the helicopter's total time at the time of the incident was 7,216 hours.

A FAA major repair and alteration form, dated February 6, 2012, showed that the helicopter was fitted with a FDC Aerofilter engine inlet barrier filter.

The Rolls Royce Model 250-C47B engine incorporates a Triumph Engine Control Systems model EMC-35R Full Authority Digital Electronic Control (FADEC) system that electronically controls engine fuel flow via a Hydro-mechanical Unit (HMU), and Electronic Control Unit (ECU).

The function of the FADEC System is to assist the pilot by controlling the engine RPM as a part of maintaining the rotor rpm as variations in engine loading result from helicopter operational maneuvers. At any time, the pilot may de-select the FADEC System and acquire complete control of engine fuel modulation (a back-up mode of operation).

The FADEC ECU contains two embedded processor systems that execute application specific engine control software. The primary system operates by sensing the pilot controlled, collective twist-grip throttle position (Power Level Angle -PLA), among other engine sensor inputs to determine the engine fuel flow requirements necessary to maintain efficient engine operation. The reversionary system is a second level of electronic fuel control governing that will be automatically switched to, should certain fault conditions be detected in the primary system. Both the ECU primary and reversionary systems control an electric motor in the HMU that modulates fuel flow to the engine.

In addition, the FADEC ECU monitors engine condition and will record and store engine operating exceedances and system fault information in a non-volatile memory device in the ECU. For certain system failures, the FADEC systems will automatically de-select the FADEC operation and transition to back-up (pilot control) operation.

The HMU consists of a gearbox mounted fuel pump, a motor driven fuel metering valve, a back-up fuel control system, a PLA input shaft, and feedback position sensors. The HMU contains components that receive electrical signals to/from the ECU as a part of the FADEC operation and is the point of fuel flow in the FADEC or back-up modes of operation.

Under the supervision of the National Transportation Safety Board (NTSB) investigator-in-charge, the incident engine was examined at Rolls Royce, near Indianapolis, Indiana, on December 2, 2014. The examination revealed that the engine was shipped without its ECU and T1sensor. The engine was subsequently fitted with an exemplar ECU and sensor. The engine was test run in a test cell and was found to be operational during testing where at no time was it observed that the ECU requested maximum fuel flow. The bleed valve was found during the test run to be closing early prior to its schedule. Additionally, the engine was found to be seven percent below new engine performance standards, which is two percent below the minimum required by the power assurance chart when the engine is in service. Engine accelerations and decelerations during the test run did not produce any surging.

The incident ECU, part number 115220-2A5-24, serial number JG8ALK0486, was sent to Triumph Engine Control Systems, near West Hartford, Connecticut, by its operator for repairs. The ECU was subsequently examined there under the supervision of a FAA inspector. The examination revealed that the ECU sustained no physical damage and both of its tamper seals were intact. An acceptance test procedure was completed with no discrepancies noted. The unit passed a vibration test. A pressure check was conducted, which the unit did not pass. The effect of this failed pressure test would be a lower acceleration schedule and an approximate five percent reduction in the maximum fuel flow limit. The sensor was recalibrated and it subsequently passed the pressure test. The recorded incident data indicated that the engine encountered an engine surge condition during its last flight. The data also showed that N2 and Nr rpm remained joined throughout the flight with no evidence of a split between the two. N2/Nr rpm both initially droop to about 89 percent. Message coding in the incident recorder data indicated the ECU was requesting maximum fuel flow but an expected increase in N2/Nr did not occur. When collective is reduced, both N2/Nr rpm return to 100 percent and above. The N2/Nr remained joined and begin to droop again when the collective was increased near the end of the flight. The incident recorder data showed that the throttle was not rolled to idle until after touchdown on the water.

The bleed valve was bench tested by the operator. Testing revealed the bleed valve closed early. Disassembly revealed corrosion was present in the bleed valve and corrosion flakes were found in the bleed valve exit orifice. Witness marks consistent with wear were found on the bleed valve bellows face near the exit orifice.

According to the engine manufacturer, the bleed valve closing early would only reduce surge margin in the Ng (N1) speed range where it would normally be open. The incident recorder data from this event depicts Ng initially at 95 percent and decelerating to 91 percent, at which time the main rotor has drooped enough to trigger the incident recorder (<92 percent Nr). Based on the bleed valve closure chart, the bleed valve would be closed at 95 percent and would not open until just below 88 percent for the given T1 (80 F). The bleed valve would have been closed per specification during the sequence of events leading up to the rotor droop. The engine is decelerating at this point, it is not a surge-inducing condition even with a prematurely closed bleed valve. The potential concern, in reference to engine surging, for a bleed valve, stuck closed, is during engine acceleration. An early closing bleed valve could contribute to surging in the Ng range where it would normally be open, engine power at two percent below power assurance chart levels could contribute to engine surging, and a faulty ECU or T1 sensor could contribute to engine surging. Based on the information available, it cannot be concluded that they had an effect on the subject engine during the incident event.

Subsequent to the incident, the operator made the decision to revise the bleed valve overhaul schedule from 1,500 hours to 750 hours to mitigate recurrence of a similar incident. Additionally, the operator's managers will increase surveillance on engine water wash and chemical wash procedures to insure proper techniques are used when performing these tasks.