History of the Flight

Image

On April 29, 2016, at 1155 local time in Turoy, Norway, an EC 225 LP Super Puma (LN-OJF) operated by CHC Helicopters as HKS Flight 241 (HKS241), was on a return flight which was inbound to the Bergen Flesland Airport, Norway. The flight was returning from a routine personnel transport mission and had been carrying oil workers from the Gullfaks B platform located in the North Sea about 118 miles from the airport. The flight was normal, and the aircraft had been at cruise maintaining 3,000 feet agl for most of the flight duration during the return leg to the airport. 

As the helicopter approached the coast, the Air Traffic Controllers gave the accident aircraft clearance to descend in altitude to 2,000 feet, maintaining 140 knots airspeed in preparation for their arrival at the intended airport. Approximately one minute after leveling off, the Flight Data Recorder (FDR) revealed that the aircraft engines experienced a significant drop in engine torque, accompanied by erratic and un-commanded tilt movements of the main rotor system. During this moment, the aircraft gained approximately 120 feet in altitude, at which time the main gearboxes epicyclic module experienced a sudden catastrophic failure resulting in the loss of the main rotor assembly. 

Witnesses on the ground from up to a mile away both heard and saw the accident. Many of the witnesses described hearing the helicopter approaching the coast, followed by a loud noise and thunder-like bang before seeing the accident aircraft emerge from low-lying clouds out of control. Other witnesses closer to the accident witnessed parts being ejected from the helicopter and scattering into the water as it was in free fall. Witness accounts were corroborated by cameras which were recording in the vicinity at the time of the accident, capturing both the helicopter and main rotor system falling separately during the accident sequence. 

According to the accident report, no abnormal indications were recorded in the moments preceding the failure which resulted in loss of the main rotor system. Both the Cockpit Voice Recorder (CVR) and FDR terminated recording due to activation of a gravity switch, also known as a G-switch. A G-switch is a device used for crash sensing which is set to detect large accelerations, such as those found when experienced when an aircraft impacts an object or the terrain. The G-switch is designed to turn off the CVR and FDR to preserve data information from being overwritten. Up until the main rotor separated, no abnormal vibrations or indications had occurred during the flight. Investigators believe that one of the 2nd stage planetary gears within the epicyclic module had been accruing damage over prior flights, this damage went unknown to the operators. The violent in-flight breakup exposed the aircraft to significant accelerations which inadvertently activated the G-switch midair, cutting power to the CVR and FDR.

As a result of the catastrophic failure, the aircraft descended uncontrollably until it impacted the small island of Storskora, located in the vicinity of Turoy along the Bergen coastline, before coming to rest submerged in the water. The accident resulted in 13 fatalities, which included two crew and 11 passengers. 

LN-OJF Flight Path

Image

 LN-OJF had already transported personnel during an earlier mission the same morning under flight number HKS240. The second trip was transporting oil workers to the Gullfaks B platform and picking up 11 passengers before returning back to Bergen Airport. The accident aircraft had departed Gullfaks at 1116 local, climbing and leveling off at 3,000 feet agl at approximately 1120 local. At approximately 1153 local, LN-OJF leveled off at 2,000 feet agl as it approached the Flesland coastline. Shortly thereafter, at approximately 1155, the in-flight breakup occurred, resulting in LN-OJF impacting the small island of Storskora.

EC 225 LP Main Gearbox 

The main gearbox (MGB) is a critical component in a helicopter's rotor drive system, transmitting engine power, reducing rpm, and increasing torque for rotor operation. The EC 225 LP is powered by two Safran Makila 2A1 turboshaft engines, with engine power transmitted through a gear reduction system that reduces the shaft speed from approximately 23,000 to 265 rpm at the main rotor. Engine and rotor speeds vary slightly due to flight conditions.

The EC 225 LP MGB is made up of modular sections: left and right input reduction modules, accessory module, main module, and epicyclic module. This modular design simplifies maintenance by allowing easier replacement during inspection and overhaul. Each module plays a key role in reducing RPM while increasing torque and transmitting power to the main and tail rotors. The MGB is also responsible for supporting essential systems like electrical generators, lubrication pumps, and hydraulic pumps.

The reduction modules receive inputs from the turboshaft engines and reduce the speed to approximately 8,011 rpm and include a clutch to allow continued rotor rotation in case of engine failure(s). The reduction modules drive the accessory modules for the electrical and hydraulic systems. The output of the reduction modules is sent to the main module via a combiner gear, which reduces the speed to 4,919 rpm. At the main module, the speed is further reduced by a bevel gear which transmits torque at a 90-degree angle, redirecting torque vertically into the epicyclic module. The bevel gear in the main module reduces the shaft speed to 2,405 rpm.

The epicyclic module, located on top of the main module, has two planetary gear stages. The first stage reduces the 2,405 rpm input to 820 rpm output into the second-stage planetary system. The final speed reduction occurs in the second-stage, the output of which directly drives the main rotor system at 265 rpm.
 

Second-Stage Planetary Gear System

The EC 225 LP’s epicyclic module is responsible for the final reduction of rpm, which reflects the rpm of the main rotor system while significantly increasing torque output, providing the mechanical force to drive the main rotor effectively. The two stages contained within the epicyclic module are composed of eight planet gears, one ring gear, and one sun gear which operate together to evenly distribute the mechanical loads, improving durability and efficiency compared to traditional gear configurations. The unique load-sharing characteristics of planetary gear systems enable rotorcraft gearboxes to withstand the high stresses inherent to rotorcraft drive systems. Planetary gear configurations allow for a more compact and lightweight gearbox design compared to other configurations with similar power and torque capabilities. Due to these benefits, planetary gear systems are commonly employed in rotorcraft gearbox applications. 

The second-stage planetary gear design in the EC 225 LP was based on in-service and design experience from the earlier AS 332 L/L1 and SA 330 Super Puma helicopter gearboxes. The epicyclic module in the AS 332 L2 was based on the AS 332 L1 but was fitted with eight larger diameter planet gears instead of the previous design which employed nine. The eight-gear planetary design was later repurposed and utilized in the EC 225 LP.  

Image

In the second stage of the planetary gear system, eight planet gears are arranged around a central sun gear with the outside of the planet gears meshing with the outer ring gear. The Sun gear drives the planetary gears reducing the RPM and increasing torque proportional to the gear reduction ratio. These planet gears are mounted on stub shafts attached to the carrier, which facilitates the distribution of torque and manages the system rotational dynamics. 

Each second stage planet gear is an assembly composed of the following: 

Gear wheel: Designed and manufactured by Airbus and finished by either Fischer's Automatische Gussstahlkugelfabrik (FAG) or Nippon Thompson Nippon-Société Nouvelle de Roulements (NTN-SNR), the gear wheel features a toothed outer rim that engages with both the sun and ring gears. The inside surface area functions as the outer race for the roller bearings to contact.

Bearing Assembly: Separately designed and manufactured by FAG or NTN-SNR, the bearing assembly is located within the planet gear wheel. It facilitates the smooth rotation around its carrier stub shaft. The bearing assembly is composed of a subassembly that includes:

• Inner Race: Fixed to the stub shaft of the carrier, it provides a surface for the bearing rolling elements to contact.
• Bearing Rollers: Cylindrical bearings that roll between the inner and outer races, minimizing friction during gear rotation, while transferring the load to the inner race and the carrier stub shaft.
• Bearing Cages: Cages that encase the bearing rollers and maintain the proper spacing and alignment, ensuring uniform load distribution.

Image

Chip Detection System

The EC 225 LP chip detection system is designed to monitor the health of the main rotor gearbox by capturing and detecting magnetic particles that indicate wear or damage in the gears and bearings. The system consists of multiple chip detectors placed at strategic locations in the MGB lubrication circuit. The EC 225 LP’s MGB features chip detectors for the mast bearing, epicyclic module, sump, and oil cooler. The mast bearing, epicyclic module, and sump chip detectors are connected to a flight crew warning circuit, which triggers an alert in the cockpit of the EC 225 LP if a sufficient quantity of metallic debris bridges the magnetic gap in the detector. The oil cooler chip detector is not connected to the warning system and requires visual inspection in accordance with the Instructions for Continued Airworthiness (ICA) during each oil change. 

The chip detection system’s effectiveness was assessed following the 2009 G-REDL accident involving an AS 332 L2 Super Puma, a previous variant of the EC 225 LP sharing a similar MGB design. The assessment revealed that only about 12% of the metallic debris was detected by the epicyclic chip detectors, while approximately 44% was trapped in the oil cooler, preventing it from reaching the MGB oil filter. Inspection of a removed MGB oil filter serves as an additional means to detect metallic debris. 

Following the 2009 G-REDL accident, where a failure of a second-stage planet gear led to a catastrophic MGB failure, EASA issued an Airworthiness Directive (AD) mandating enhancements to the chip detector inspections for both the AS 332 L2 and EC 225 LP. The AD required further improvements in maintenance protocols to detect early signs of gear and bearing damage. This included mandatory inspections of all the MGB chip detectors at reduced intervals and enhanced procedures for evaluating metallic particles. 

Image

The main gearbox of the AS 332 L2 and EC 225 LP featured a ring of magnets located between the epicyclic module and main module. The ring of magnets was intended to capture metallic debris originating from the epicyclic module, preventing it from falling down into and contaminating the main module. After the G-REDL accident, investigators suspected that the ring of magnets reduced the probability of particle detection. The AD mandated operators remove the ring of magnets. Removal of the ring of magnets was intended to improve chip detectability originating from the epicyclic module, enhancing the particle detection capability of the sump and epicyclic chip detectors specifically.

Main Gearbox Certification

The EC225 and prior AS 332 L1/L2 were certified and validated using European JARs and United States FARs, which included JAR/FAR 29.571 requirements. The 29.571 regulation has evolved over time to address fatigue, then later damage tolerance. Fatigue assessments consider how the part will withstand repeated operational loads. Damage tolerance assessment assures the part can safely carry loads for as set time, even if a crack or flaw is present.

Although the EC225 helicopter as a whole was certified under the later safety standards — including damage tolerance requirements — the main gearbox (MGB) epicyclic module was treated as an exception. The first- and second-stage planetary gears and sun gear in the epicyclic module were unchanged from the AS332 L2’s design and had previously been certified under FAR 29.571 Amendment 29-20. Airbus requested to use the Changed Product Rule (CPR) under Part 21, which allowed the use of these unchanged components without applying the new damage tolerance testing requirements. Through an Equivalent Safety Finding (ESF), the manufacturer and regulators agreed that the gearbox did not need to comply with the newer JAR 29.571 regulation, requiring a full damage tolerance assessment. The ESF asserted that the epicyclic module parts and components met safety requirements equivalent to JAR 29.571 by demonstrating compliance with earlier FAR 29.571, supplemented by experience from prior certification efforts and in-service experience.  

Although Airbus acknowledged the increased operational loads in the EC 225 LP, they concluded no design changes were necessary for the epicyclic module. They set the Operational Time Limit (OTL) for the second-stage planet gears at 4,400 flight hours, lower than the 6,600 flight hours in the AS 332 L2, based on prior operational experience and testing. This decision regarding the 4400 flight hours reflected concerns about potential spalling in the bearings, a known issue in the AS 332 L2.

The EC 225 LP MGB also complied with JAR 29.917, which mandates that the rotor drive system must minimize failure risks from fatigue, corrosion, and other deterioration. The rotor drive system was subjected to rigorous endurance testing under JAR 29.923, which simulated operational conditions. These tests, including 220 hours of testing with separate gearboxes equipped with second-stage planet gears from FAG and NTN-SNR, confirmed that the MGB met the applicable certification regulations.

Additionally, the EC 225 LP’s MGB featured chip detectors to capture metallic debris, ensuring reliability in identifying potential damage. Following a similar gearbox failure in the AS 332 L2, EASA issued an Airworthiness Directive (AD 2009-099-E) in 2009 to remove magnets from the gearbox oil separator plates. These magnets were believed to have interfered with the detection of metal debris, leading to the modification being classified as a major design change.

Wreckage Examination

The wreckage was recovered and examined by investigators. The investigation determined that the main rotor had detached from the fuselage at altitude before impacting the ground at a separate location, validating witness accounts. Wreckage distribution covered both land and sea, with components fragmented and dispersed over a significant area. The separation of the main rotor system in flight indicated a primary failure in the drive system, specifically the main gearbox. Given the rotorcraft’s normal operating parameters prior to failure, the investigation determined the accident occurred due to mechanical failure.

Upon examining the wreckage, investigators noted extensive damage to the gearbox system, including fractures in the structural conical housing of the epicyclic module and drive components. The epicyclic module conical housing showed evidence of overload failure with primary damage localized to the epicyclic second-stage planet gear system. The retrieved components were subjected to metallurgical analysis, which revealed fatigue failure in one of the eight second-stage planetary gears, specifically within the bearing race interface of the failed gear. The failure mode exhibited characteristics consistent with the G-REDL accident, where a failed planet gear was also responsible for the crash, but the exact reason for the failure was not isolated. This accident marked the second fatal accident due to a main gearbox failure in the Puma series AS 332 L2 and EC 225 LP. Compared to the G-REDL accident, investigators were able to recover more pieces of the failed planetary gear, allowing for a complete metallurgical examination of the failure. Analysis of the failed planet gear sections pointed to evidence of rolling contact fatigue (RCF), a fatigue mechanism driven by repeated cyclic loading of compressive stresses, such as what occurs in bearing applications.

The investigation identified a second-stage planet gear as the critical failure point within the MGB. This gear, which operates within the epicyclic module, exhibited extensive fatigue damage initiating at the bearing raceway. Microscopic examination confirmed the presence of surface micro-pitting, which pointed to RCF. Over time, the surface micro-pits led to localized stress concentrations, enabling crack initiation and propagation beneath the carburized case layer of the planet gear’s race. The subsurface crack developed at the failed planet gear upper outer race. The crack went undetected and continued to propagate until the planet gear suffered a complete fracture formed in the root of the gear, parallel to the teeth.

Investigators determined the most probable scenario was that the failure immediately caused a misalignment of the meshing interface between the fractured planet gear and the sun gear known as “clashing,” which destroyed the planet gear, seizing the epicyclic module. With the epicyclic module seized, the inertia of the main rotor assembly resulted in the gearbox breaking apart, a breakup which subsequently resulted in the fragmenting of the epicyclic housing and the main rotor assembly detaching from the rotorcraft.

Metallurgical Investigation of Second-Stage Planetary Gears

The second-stage planetary gears were designed to function as an integrated gear and bearing assembly. Airbus manufactured each second-stage planetary gear from carburized 16NCD13 steel, which was surface hardened. The bearing rollers and inner race were manufactured from through-hardened M50 steel. The planetary gear material properties were selected for their high surface hardness and fatigue resistance. Carburization is a process that enhances wear resistance by introducing a hardened outer surface while maintaining a ductile core. The process intended to provide residual compressive stress, which helps inhibit crack propagation from surface defects. However, the investigation revealed that, despite the hardened case layer, the planet gear outer race remained vulnerable to rolling contact fatigue. 

Investigators identified surface micro-pitting had developed on the bearing raceway on the failed planet gear. The outer race micro-pitting was an indication that higher-than-expected dynamic contact stresses (referred to as Hertzian stresses) were likely occurring between the roller bearings and the outer race. Contact stresses develop between two contacting bodies pressed together. Contact stress is calculated during the design process to estimate the maximum stress levels in a contact area, and to predict where fatigue damage might occur. Engineers are able to limit these dynamic contact stresses by controlling factors, such as loading distribution, material selection, surface finish, and lubrication. If not explicitly analyzed and controlled in the design process, high contact stresses can lead to failures, such as pitting, cracks, and spalling on the contact surface.  Rolling contact stress arises from the cyclic application of Hertzian contact pressure between curved bodies in relative motion. When this localized, high magnitude stress field is repeatedly applied due to rolling motion, it initiates fatigue damage which can manifest on the contact areas (both surface and subsurface). The degradation mechanism driven by this dynamic Hertzian stress cycling is classified as rolling contact fatigue (RCF).

The micro-pitting found on the outer race was suspected to have initiated a subsurface crack which is characteristic of RCF-induced failure. The residual compressive stress introduced by the carburization process during manufacturing is typically beneficial in inhibiting crack growth, yet the observed failure suggested that the stress distribution within the gear material was insufficient to arrest fatigue progression. The crack propagated radially from the surface, penetrating through the hardened case reaching the ductile core material. The ductile material could no longer sustain the imposed stresses. This ultimately led to rim separation, causing the gear to split between two adjoining teeth in proximity to the root. This caused an immediate misalignment in gear meshing, resulting in the planet gear clashing with the sun gear. The clashing resulted in the catastrophic failure of the planet gear.

Manufacturing and Finishing of Second-Stage Planet Gears 

Airbus was responsible for the initial machining and carburization of the second-stage planetary gear wheels, which were then sent to respective bearing manufactures for finishing and assembly. FAG and NTN-SNR received the gear wheels and performed the final grinding and finishing of the bearing raceway, which Airbus then approved. Each supplier had slightly different finishing processes, particularly in the final surface treatment of the outer raceway of the bearing interface, which impacts the part’s fatigue resistance. 

Investigators looked into the historical in-service reliability data for the two different supplied planet gears and determined that both NTN-SNR and FAG had design issues inherent in the planet gear assemblies. Both bearing manufacturers supplied gears that exhibited high rates of removal from service, with the FAG showing slightly higher cases of in-service spalling and fatigue failure compared to the NTN-SNR gears. Both the EC 225 LP and AS 332 L2 accidents involved FAG planetary gears.

The investigation found that the FAG-manufactured gears featured a smoother bearing surface finishing. FAG and NTN-SNR both used grinding and polishing to finish the bearing raceway, but their final microstructural characteristics differed. FAG-manufactured gears were found to have a smoother finish on the bearing raceway; however, achieving this finish also work hardened the metallic race surface. The increased work hardening was attributed to the grinding and polishing process which FAG utilized to finish the gear wheels before final assembly. It was also noted that this introduced higher compressive residual surface stress into the outer race, a property that is beneficial in preventing fatigue cracks at the surface. 
 

Bearing Design Differences

The investigation revealed important geometric differences between the roller bearings designed and manufactured by FAG and NTN-SNR, which directly impacted fatigue resistance. While both suppliers followed the Airbus Build to Specifications (BTS) requirements, variations in the bearing roller contact profile and geometry resulted in differing levels of in-service reliability. This difference was crucial in determining why planet gears manufactured by FAG exhibited slightly higher rates of removal from service. 

FAG-designed bearings had a steeper contact angle between the rollers and the raceway, resulting in higher, localized stress concentrations at the edges of the bearing contact zone. This acute stress distribution increased the likelihood of micro-pitting initiation, a key indication of rolling contact fatigue. Investigators found that the FAG bearing wear pattern on the outer race had work hardened the material an additional 30% more than the surrounding race surface. Although work hardening can be beneficial in bearing applications, excessive work hardening is problematic and can lead to a brittle surface and fatigue cracking. This geometric difference in roller bearing design exacerbated contact stress irregularities by work hardening the outer race. In contrast, NTN-SNR bearings had a more uniform profile, which promoted better load distribution across the rolling elements and reduced micro-pitting susceptibility.

Further examination revealed the fractured planetary gear from the EC 225 LP exhibited characteristic micro-pitting and subsurface crack propagation and showed similarities with respect to the prior AS 332 L2 accident. Comparative analysis of FAG and NTN-SNR gears removed from service showed that NTN-SNR gears exhibited less severe wear patterns and fewer fatigue-related removals over similar flight hours. Further investigation revealed that none of the FAG planetary gears had made it to their intended operational time limit (OTL), while 10% of the NTN-SNR supplied planet gears had reached OTL. 

Another critical finding was the presence of embedded debris in the FAG bearing cages, which had been observed in previous FAG-related planetary gear removals. The foreign particles’ indentations were thought to have acted as stress concentrators, accelerating micro-pitting and subsurface crack propagation. Investigators concluded that FAG planetary gears susceptibility to early-stage micro-pitting and its steeper contact angle were key contributors to its premature failure.

Chip Detection Monitoring and Limitations

The aircraft was equipped with a chip detection system and a vibration health monitoring (VHM) system, intended to provide gearbox health information to the crew and provide maintenance personnel with additional information regarding the aircraft’s drive system. The investigation determined that these systems failed to detect the progressive fatigue failure within the second-stage planetary gear. The chip detection system was inadequate in detecting metallic debris generated by the fatigue crack and spalling, since this fatigue mechanism did not generate sufficient quantities of debris. In addition, subsurface cracks did not generate any debris. This meant that by the time failure occurred, no warnings had been detected by the chip detection system.

Similarly, the VHM data did not indicate any abnormal vibration signatures leading up to the failure. The fatigue failure developed in a manner that did not produce characteristic vibrational behavior associated with bearing or gear degradation. This highlighted a key limitation in the current gearbox monitoring system design, which can be useful for detecting certain forms of mechanical wear but were insufficient for identifying highly particular forms of wear, such as those driven by fatigue. 

Safety Actions and Mitigations Implemented after AS 332 L2 (G-REDL) Accident

The identified failure mode in the LN-OJF accident closely resembled the 2009 AS 332 L2 G-REDL accident, in which the same second-stage planetary gear failure also led to the in-flight breakup and separation of the main rotor system. According to Airbus and EASA, nothing at the time of the G-REDL accident pointed to the possibility of a crack propagating subsurface with limited spalling. AIBN cited that historical instances of planet gear failure with no prior indication of spalling was not available prior to the EC 225 LP accident. From the G-REDL accident report, it was noted that spalling of the failed second-stage planet gear may have contributed to the failure, but because not all of the failed gear was recovered, the exact cause was not pinpointed. It was suspected the same planet gear likely failed from a fatigue crack in the loaded area of the outer race.  

The G-REDL accident resulted in implementation of safety measures, including enhanced inspection protocols, and increased scrutiny of gearbox reliability. However, the recurrence of a nearly identical failure in LN-OJF revealed that the mitigations were insufficient in addressing the fundamental failure mechanism.

In both cases, the second-stage planetary gears exhibited fatigue cracking at the outer race, leading to catastrophic failure. The design similarities between the two Super Puma variants meant that the failure conditions were replicated despite efforts to improve gearbox reliability. The investigation noted that although changes had been made to maintenance practices and the design of both gearboxes, these changes did not adequately address the underlying material and design factors contributing to the premature fatigue failure.  

Conclusion

Investigators concluded that the catastrophic fatigue failure of the second-stage planetary gear in the MGB’s epicyclic module was caused by RCF, initiated by micro-pitting on the bearing raceway. This fatigue mechanism led to subsurface crack propagation, which ultimately caused the second-stage planet gear rim to separate, leading to clashing with the sun gear and catastrophic failure of the planet gear, resulting in the in-flight detachment of the main rotor system.

Investigators identified significant geometric differences in the bearing design of the second-stage planet gear completed by manufacturers FAG and NTN-SNR, with FAG planet gears demonstrating higher rates of premature fatigue failure. The bearings’ steep contact angles contributed to high localized stresses and accelerated wear, increasing the susceptibility to early-stage micro-pitting and crack initiation driven by RCF. 

The absence of early failure detection was another critical finding. Existing chip detection and vibration monitoring systems failed to provide the pilots or maintenance personnel with timely warnings. The initial debris released when degradation occurred was not captured by the chip detectors, allowing the fatigue process to progress subsurface for an extended period until failure. 

Investigators also discovered that the prior 2009 G-REDL accident involving FAG planetary gears exhibited similar failure characteristics. Yet, post-accident corrective actions did not sufficiently mitigate the underlying fatigue risk.

Back to top

Main Conclusion

• The LN-OJF failure scenario has been identified as the structural degradation of a second stage planet gear, a critical part in which subsurface cracks developed undetected to a catastrophic fatigue failure. The fatigue fracture initiated from a surface micro-pit in the upper outer race of the bearing, propagating subsurface while producing a limited quantity of particles from spalling, before turning towards the gear teeth and fracturing the rim of the gear.
• The investigation has shown that the combination of material properties, surface treatment, design, operational loading environment and debris gave rise to a failure mode which was not previously anticipated or assessed. 

The accident 

• The flight was normal until the second stage epicyclic gear failed.
• None of the monitoring systems on LN-OJF provided any warnings of the impending second stage planet gear failure.
• The helicopter flew level at 140 kt at 2,000 ft when the second stage planet gear fractured and caused an abrupt seizure of the second stage epicyclic gears.

Technical investigation of the second stage planet gear 

• Two segments which formed approximately one half of the failed second stage planet gear were recovered.
• Detailed metallurgical examinations confirmed that the failed second stage planet gear had fractured due to fatigue.
• The fatigue had its origin in the upper outer race of the bearing (inside the second stage planet gear), propagating subsurface towards the gear teeth where it grew to a complete fracture.
• Four spalls were observed on the bearing outer upper race centered along the line with maximum Hertzian stress, 14 mm from the upper edge of the planet gear.
• A subsurface crack initiated at spall 1 and grew subsurface into the carburized layer before deviating into the bulk material. Similar cracks initiated at spalls 2 and 3, and merged with the crack from spall 1. All three spalls are typical of surface initiated rolling contact fatigue observed in bearings.
• The cracks must have developed within a maximum of 260 flight hours.
• All the eight second stage planet gears on LN-OJF had bearings supplied by FAG.
• There were dimensional and production differences between the two bearing designs:
  • The maximum outer race Hertzian contact stress was higher for the FAG
    bearings than the NTN-SNR bearings due to small but significant geometrical differences.
  • Due to a different finishing process, the FAG bearing had generally a harder outer race surface and a higher compressive surface residual stress than the NTN-SNR bearing.
• In-service experience has shown that second stage planet gears with bearings supplied by FAG have experienced more spalling events.

MGB condition monitoring

• The chip detection system had a detection efficiency of 12% for particles coming from the epicyclic module. Because the cracks propagated while there were limited spalling, the probability of detection was inadequate to detect the damage prior to gear failure.
• Analysis of HUMS data for LN-OJF does not show evidence of increasing trends or abnormal vibration behavior for any dynamic parts monitored by the system.
• The present HUMS design is unable to detect fatigue fractures in second stage planet gears.

The G-REDL accident

• The G-REDL accident was not fully understood at that time because the origin of the crack was in a section of the failed gear which was not recovered.
• There was one indication of possible gear fracture in G-REDL. Some 36 flying hours prior to the accident, a magnetic particle had been discovered on the epicyclic chip detector. Due to a misunderstanding or miscommunication, the maintenance task was not carried out and the G-REDL main gearbox was not opened.
• The G-REDL accident was clearly established to be the result of fatigue failure in a second stage planet gear; however, the post-investigation actions were not sufficient to prevent another main rotor loss.

AIBN findings (page 157): View 
AIBN accident report: SL 2018/04

Back to top
 

The AIBN made the following recommendations related to the LN-OJF accident. Each of these recommendations is aimed at addressing the technical and regulatory gaps identified during the investigation, thereby reducing the risk of similar accidents in the future.

• Research into Fatigue and Crack Development (SL No. 2018/01T):

The failure mode, i.e. crack formation subsurface with limited spalling initiated from a surface damage, observed in the LN-OJF accident is currently not fully understood. The investigation has shown that the combination of material properties, surface treatment, design, operational loading environment and debris gave rise to a failure mode that was not previously anticipated or assessed.

The Accident Investigation Board Norway recommends that the European Aviation Safety Agency (EASA) commission research into crack development in high-loaded case-hardened bearings in aircraft applications. An aim of the research should be the prediction of the reduction in service-life and fatigue strength as a consequence of small surface damage such as micro-pits, wear marks and roughness.

• Amendment of Certification Specifications for Fatigue Management (SL No. 2018/03T):

Rolling contact fatigue as observed in the LN-OJF accident was not considered during type certification, neither is it directly addressed in the current certification specifications.

The Accident Investigation Board Norway recommends that European Aviation Safety Agency (EASA) amend the Acceptable Means of Compliance (AMC) to the Certification Specifications for Large Rotorcraft (CS-29) in order to highlight the importance of different modes of component structural degradation and how these can affect crack initiation and propagation and hence fatigue life.

• Improvement of Critical Parts Provisions and Procedures (SL No. 2018/08T):

The investigation into the accident to LN-OJF has found that only a few second stage planet gears in Airbus Helicopters EC 225 LP and AS 332 L2 ever reached their intended operational time limit before being rejected during overhaul inspections or non- scheduled MGB removals.

The Accident Investigation Board Norway recommends that the European Aviation Safety Agency (EASA) review and improve the existing provisions and procedures applicable to critical parts on helicopters in order to ensure design assumptions are correct throughout its service life.

• Enhancement of Monitoring and Detection Methods (SL No. 2018/09T):

  The investigation into the accident to LN-OJF has demonstrated that a critical structural component could fail totally without any pre-detection by the existing monitoring means.

  The Accident Investigation Board Norway recommends that the European Aviation Safety Agency (EASA) research methods for improving the detection of component degradation in helicopter epicyclic planet gear bearings.

• Revision of Type Design for Main Gearbox Durability (SL No. 2018/12T):

  The LN-OJF accident was a result of a fatigue fracture in one of the eight second stage planet gears in the epicyclic module of the MGB, a critical part in which cracks developed subsurface to a catastrophic failure without being detected. With the knowledge from this investigation, all effort should lead to a robust design in which a single load path should demonstrate compliance to CS 29.601(a), 29.602 and 29.571 without compromising its structural integrity and not only by depending on detection systems or maintenance checks.

  The Accident Investigation Board Norway recommends that Airbus Helicopters revise the type design to improve the robustness, reliability and safety of the main gearbox in AS 332 L2 and EC 225 LP.
   

  AIBN recommendations (page 165):  View 

Back to top

Code of Federal Regulations 14 CFR Part 29 – at time of certification

14 CFR 29.571 (Amdt. 29-20) – Fatigue Evaluation of Structure

Joint Aviation Requirements (JAR) 29 Large Rotorcraft Change 1, effective 1 December 1999.

JAR 29.601 – General Design

• CS_29.601.pdf (290.79 KB)

JAR 29.602 – Critical Parts

• CS_29.601.pdf (290.79 KB)

JAR 29.917 – Rotor Drive System - Design

• CS_29.917.pdf (87.73 KB)

JAR 29.927 – Rotor Drive System – Additional Tests

• CS_29.927.pdf (537.78 KB)

JAR 29.1337(e) Powerplant Instruments: Installation, Chip Detection

• CS_29.1337.pdf (284.15 KB)

CS 29.1465 (Amdt. 3) – Vibration Health Monitoring 

• CS_29.1465.pdf (289.13 KB)

JAR 29.1529 – Instructions for Continued Airworthiness

• CS_29.1529_AppA.pdf (89.8 KB)

 Back to top

Several cultural and organizational factors played a role in the lead-up to both the G-REDL and LN-OJF accidents, particularly in the areas of maintenance practices, regulatory compliance, and oversight within the industry.

The decision to retain previously certified components from the AS 332 L2 in the EC 225 LP. 

Even though the EC225 LP operated under different conditions with higher operational loads, the planetary gears and components in the epicyclic module were not subject to the updated fatigue evaluations and damage tolerance requirements introduced in later regulations. This reliance on established designs, while compliant with the standards at the time, did not fully account for the evolving operational environment or the need for re-evaluation in light of newer safety standards. The use of these unchanged components and the application of the Changed Product Rule (CPR) allowed the certification process to proceed without incorporating the more stringent fatigue analysis and damage tolerance assessments that could have identified potential risks.

The lack of systematic analysis of in-service failures.  

Premature removals of planet gears due to damage contributed to missed opportunities for reassessing the safety and performance of these components. These early signs of potential issues were not consistently evaluated for their broader implications on safety, which might have led to a more comprehensive review of the gear design and maintenance procedures.

Limitations of the chip detection system.

Designed to detect debris caused by spalling, the chip detectors were ineffective against detecting small traces of material released by limited spalling. The failure of the second-stage planet gear went undetected by the system, highlighting a gap in the industry's approach to reliability and safety. While existing detection technologies were effective for certain types of damage, they were not effective at detecting these specific types of fatigue failure, which had not been well understood in earlier designs.

Back to top
 

• Stepping up to current certification regulations – Certification of the EC225 LP’s MGB planetary gear system did not require damage tolerance in the fatigue evaluation. The failure that occurred was initiated from damage to the outer race which resulted in micro-pitting and limited spalling of the carburized outer race. This damage led to a subsurface crack driven by rolling contact fatigue which caused the crack to propagate through the gear wheel until rim separation occurred. Because the fatigue evaluation of the second-stage planet gears did not include specific damage criteria, fatigue-driven failure and real-world performance were not accurately predicted.
   
• Need for a robust reliability program – Post-accident review of service data revealed a high incidence of removal from service for both the FAG and NTN-SNR planet gears. Airbus did not have a suitable system in place to adequately assess any trends regarding planet gears removed from service by operators. This inhibited Airbus from identifying that reliability issues existed and taking the appropriate action.
   
• Inadequate fatigue analysis and deficient design – The removal data indicated that the operational time limit of 4,400 flight hours for the second-stage planet gears in the EC225 LP overestimated the actual fatigue service life. These removals suggested a possible issue with the design or manufacturing of these gearbox components.
   
• Inadequate chip detection – The chip detection system performance was inadequate as substantiated by testing done after the G-REDL accident, where tests showed the epicyclic module chip detector was only 12% effective. Actions taken to improve detectability of gearbox degradation in the wake of the G-REDL accident did not address the system design issue and limitations that affected both the AS 332 L2 and EC 225 LP helicopters, and therefore did not prevent a similar failure from occurring.
   

Back to top

Certified parts have adequate durability and meet their intended life limit.

• MGB components, particularly the planetary gears, should withstand normal operational stress without failure. The EC 225 LP certification relied on the certification approach for FAR 29.571 used during the AS 332 L2 program and did not utilize the latest amendment of the damage tolerance regulation. Therefore, the original certification basis did not account for the effects of damage, which led to the catastrophic failure of the second-stage planet gear. 

Chip detectors are a mitigating provision for fatigue and damage and should be effective.

• The design assumed that the chip detection system would reliably detect metallic debris from the MGB and provide early warnings of potential failure. However, the design and implementation of the chip detectors within the MGB made the system ineffective. The initial spalling did not produce significant debris, which was not captured by the chip detector. Since sub-surface fatigue cracks do not produce chips, the system was not capable of detecting subsurface degradation. This exposes a critical flaw in the system's ability to detect damage at early stages, allowing the damage to progress until failure. 
   

Fatigue testing correlates to real world operating conditions.

• The fatigue evaluation and testing did not fully represent the operational loading conditions experienced by the MGB components, such as rolling contact fatigue in the planetary gears, which led to the failure. The assumption that the rotor drive system components, including the MGB, could handle operational loads without significant degradation was not representative of actual operating conditions. 

Required scheduled maintenance and inspections are sufficient to detect any significant wear or fatigue.

• The failure occurred in a second-stage planet gear that developed micropitting which led to a subsurface crack which was not detectable by the manufacture’s required maintenance program.

Components that perform reliably in a previous model will continue to perform reliably in newer model aircraft.

• The design of the EC 225 LP's MGB was based on the AS 332 L2 MGB, which utilized the same planetary gear designs. This assumption overlooked the potential risks for different operating conditions on the EC 225 LP.

Back to top

Airbus Helicopter, AS 332 L2 Super Puma, Peterhead, Scotland, April 1, 2009 

Image

The G-REDL accident occurred on April 1, 2009, when an Airbus AS 332 L2 Super Puma suffered a catastrophic main gearbox failure while returning from an offshore platform in the North Sea. At 2,000 feet, a second-stage planet gear in the epicyclic module failed due to fatigue cracking, leading to the loss of the main rotor system, which detached from the helicopter. The aircraft then entered an uncontrolled descent and crashed into the sea, fatally injuring all 16 people aboard.
The investigators suspected that fatigue cracking originated in the outer race of the second-stage planet gear and propagated subsurface, eventually causing the failure. The failure did not trigger chip detector alerts during the accident flight, as the cracking did not produce significant debris. This accident exposed a critical limitation in the chip detection system, which was designed to sense metallic particles due to surface degradation but was ineffective in detecting subsurface fatigue cracks. Subsurface cracking did not produce detectable debris until the planet gear ultimately failed, resulting in loss of MGB function. Additionally, while premature removals of second-stage planet gears had been noted, these issues were not systematically analyzed for safety implications.
As a result of the accident, EASA issued an AD mandating stricter MGB inspections and prohibiting fuzz burn-off systems to ensure debris was properly captured and analyzed. However, due to the extensive damage and inability to recover critical components, including the suspected failed planet gear, investigators could not conduct a full metallurgical analysis. The failure was only fully understood after the LN-OJF accident, which involved the same planetary gear systems in the epicyclic module.
The G-REDL accident also highlighted gaps in gearbox design certification and debris detection systems. After the LN-OJF accident, investigators reviewed the G-REDL accident findings, which reinforced concerns over the epicyclic planetary gear system’s reliability. Both accidents led to regulatory changes aimed at improving fatigue analysis and gearbox monitoring systems, including enhanced chip detection provisions.   

AAIB accident report: 

Back to top

Regulatory initiatives

AMC1 29.571 Fatigue tolerance evaluation of metallic structure - Rolling Contact Fatigue 

EASA updated AMC 29.571 to require explicit evaluation of rolling contact fatigue (RCF) in principal structural elements (PSEs), such as rotorcraft gear systems. This followed LN-OJF’s failure mode of subsurface initiated cracking in a planet gear that wasn’t well vetted or understood during initial type certification. The new guidance requires fatigue life substantiation to include RCF failure mechanisms such as micro pitting, spalling, and other similar damage which can lead to fatigue cracks. 

CS 29.1337(e) – Chip Detection Effectiveness

After LN-OJF, EASA revised CS 29.1337(e) and the associated AMC at amendment 10 to require chip detection systems demonstrate effectiveness in capturing metallic chip material, which indicate degradation and could preclude a catastrophic gearbox failure. Before the accident, there was no requirement to prove that chip detectors could detect debris in time to prevent a failure. The EC225’s second stage planet gear failed from fatigue cracking that progressed undetected, with the chip detectors failing to trigger any alerts due to poor performance, and inability to effectively capture trace amounts of metallic debris as they passed by chip detector magnet. The updated regulation requires that applicants demonstrate that the chip detectors perform their associated function indicating MGB degradation. The chip detectors must demonstrate that they can capture metallic debris of all possible sizes and concentrations which could occur in service. This requires gearbox designers to consider whether factors in the gearbox design prevent detection. It also requires designers to place chip detectors within the lubrication circuit to maximize performance of particle detection, a design consideration which was not captured by previous regulations and guidance. 

EASA MGB Integrity Study

In response to AIBN recommendations, EASA sponsored a study conducted by Airbus Helicopters Technik. The study aimed to identify design improvements that reduce the risk of catastrophic gearbox failures in helicopters. The study evaluated existing MGB architectures, particularly epicyclic systems which have been linked to serious accidents and compared them with alternative designs.

The study identified single points of failure that could lead to rotor detachment, loss of drive, or jamming. Common causes included fatigue cracks, gear tooth breakage, spline wear, and fragment-induced blockages. Epicyclic gear systems were found to be more vulnerable than collector-type gearboxes, which showed no known catastrophic failures.

To mitigate these risks, the study proposed various alternative design concepts such as crack-arresting interfaces, internal jamming preventers, and redundant load paths. The study found that while catastrophic failure risks can be reduced through improved MGB architecture, implementation would require tradeoffs in weight, reliability, and compliance with current rotorcraft certification standards.
 

EASA MGB Integrity Study

Back to top
 

Following the LN-OJF accident, EASA, as the state of design for Airbus helicopters, issued several ADs to address unsafe conditions in the EC 225 LP and AS 332 L2 helicopter fleets. The FAA, as the validating authority, also issued ADs. These include:

EASA AD 2016-0089-E: Mandated one-time inspections of key components—including MGB suspension bars, chip detectors, the oil filter, and the vibration health monitoring system—to detect signs of fatigue and degradation that could lead to sudden failure.

EASA AD 2016-0103-E: Required replacement of MGB suspension bar fittings, addressing structural vulnerabilities identified during the investigation that could compromise gearbox integrity.  

EASA AD 2017-0042: Mandated a one-time, detailed inspection of the oil cooler to ensure that its performance was not impaired by particulate contamination.  

EASA AD 2017-0050-E: Introduced mandatory periodic inspections of the oil cooler to enhance ongoing monitoring of the gearbox lubrication system and its debris management.  

EASA AD 2017-0111: Superseded AD 2017-0050-E and required installation of a Full Flow Magnetic Plug (FFMP) device, enabling collection of MGB particles upstream of the oil cooler, and establishment of new Service Life Limits (SLL) for critical gearbox components, reflecting updated fatigue and degradation assumptions. 

EASA AD 2017-0134R2: Required parts removal from service, part service life reduction, modification to include the installation of an FFMP device, amending the rotorcraft flight manual to prohibit in-flight MGB particle burning (fuzz burn-off), and repetitive inspections of the MGB chip detectors, and MGB oil filter and oil cooler inspections.

FAA AD 2016-12-51: Emergency AD prompted by the EC 225 LP accident which prohibited flight of all Model AS 332 L2 and EC 225 LP helicopters in the U.S. The Emergency AD is intended to prevent failure of the main rotor system and subsequent loss of control of the helicopter.

FAA AD 2021-16-05: Superseded FAA AD 2016-12-51, and terminated the flight prohibition of the EC 225 LP and AS 332 L2. Required replacing certain affected second-stage planet gear assemblies, removing certain affected epicyclic modules, and installing an FFMP device. In addition, this AD required revising the existing rotorcraft flight manual (RFM) emergency procedure prohibiting MGB particle burning in flight. Required repetitively inspecting the MGB chip detectors, oil filter, and oil cooler as specified in EASA AD 2017-0134R2.

These directives form part of a comprehensive safety action designed to restore and enhance airworthiness by replacing critical structural elements, improving early detection of component fatigue, enforcing more robust maintenance and inspection protocols, and revising flight crew procedures.

Back to top
 

Rotorcraft Life Cycle

• Design/Manufacturing
   

Accident Threats

• System / Component Failure or Malfunction (non-powerplant) (SCF–NP)

Industries

• Offshore
   

Accident Common Themes

• Organizational Lapses
• Flawed Assumptions
  
   

Back to top

Flawed assumptions

• Investigators determined that Airbus assumed at the time of certification that if rolling contact fatigue occurred, spalling would result and be detected prior to gear failure. Therefore, spalling of a planet gear would function as a mechanism of early detection.
• Investigators determined that chip detection devices were assumed to be effective in detection of all metallic material but were found to perform poorly, with the epicyclic module chip detector found to be only 12% effective.
• Actions taken resulting from the G-REDL accident, which increased inspections as well as required the removal of the ring of magnets between the epicyclic module and main module, did not prevent the occurrence from happening on LN-OJF, and did not improve chip detection in the epicyclic module.
   

Organization Lapses
 

• AIBN investigators noted that only a few second-stage planet gears ever reached the intended operational life limit. 
• Airbus Helicopters was not routinely examining and analyzing parts rejected after failing predefined inspection criteria, even though it concerned critical parts.
• This lack of systematic analysis led to a situation where in-service reliability of the 2nd stage planetary gears went underexamined and not realized until the G-REDL and LN-OJF accidents occurred. 
• Certification standards at the time required gearboxes to be equipped with chip detectors, which are relied on to mitigate catastrophic failures in the gearbox design, without requirements for performance and reliability.
   

Back to top 

Boeing Vertol 234LR Chinook Helicopter, British Int. Helicopters, G-BWFC, Shetland Islands, November 6, 1986

A Boeing 234LR Chinook helicopter operated by British International Helicopters crashed into the sea during approach to Sumburgh Airport, Shetland Islands.  The aircraft was returning from Brent oilfield with 44 passengers and 3 crew. It suffered an in-flight breakup approximately 2.5 miles from the runway, fatally injuring 45 of the 47 people on board.

The Air Accidents Investigation Branch (AAIB) determined that the forward transmission failed catastrophically due to the fracture of its bevel ring gear. The failure originated from fatigue cracking that progressed from multiple origins at the roots of the gear teeth. The failure led to desynchronization of the rotor system causing a collision of the forward and aft rotor blades. As a result, the aircraft disintegrated midair and impacted the ocean.

The root cause was traced to an inadequate design modification where the failed gear had been changed from a carburized steel alloy to a nitrided steel alloy. This design change, classified as a minor modification, was approved without the appropriate level of certification testing usually required for such a change. Additionally, visual inspections prescribed in the maintenance manuals were found to be insufficient to detect early-stage fatigue cracking.

Report: Boeing Vertol 234 LR, G-BWFC Accident

Sikorsky S-92, Cougar Helicopters, C-GZCH, St. John's, Newfoundland, Canada, March 12, 2009

Image

A Sikorsky S-92A helicopter was transporting workers to a production platform in the Hibernia oil field approximately 120 nautical miles offshore. It experienced a rapid and complete loss of oil from the transmission's MGB approximately 47 nautical miles from land. The flight crew declared an emergency and reversed course. The pilot descended the helicopter to approximately 800 feet ASL and leveled off. Approximately 11 minutes after the rapid loss of oil pressure and during an attempted ditching, the helicopter struck the water at a high rate of descent. One passenger survived with serious injuries and the other 17 occupants of the helicopter were fatally injured.

The Transportation Safety Board of Canada (TSB) listed the failure of two of the three oil filter mounting studs for the MGB as one of the main accident findings. This resulted in a rapid loss of oil, causing overheating and the eventual failure of the pinion gear, which is connected to the tail rotor drive.
 

Library module: Sikorsky S-92A
 

Back to top

Technical Related Lessons

The design of critical internal main gearbox (MGB) components must ensure sufficient strength and durability to prevent failure during service. (Threat Category: System/Component Failure or Malfunction (NON-POWERPLANT))

• In accordance with 14 CFR 29.602, a critical part is a part, the failure of which could have a catastrophic effect upon the rotorcraft and for which critical characteristics have been identified, which must be controlled to ensure the required level of integrity.
   
• The certification basis of the EC 225 LP utilized the Changed Product Rule, which allowed use of the AS 332 L2 certification basis for unchanged Principal Structural Elements (PSE) on the EC 225 LP. The AS 332 L2 certification basis used earlier regulatory amendments to demonstrate compliance.
   
• The fatigue evaluation of the EC 225 LP planetary gears utilized an earlier amendment of 14 CFR 29.571. The manufacturer showed compliance using a regulation that did not require accounting for damage tolerance in the fatigue assessment.
   
• The performance and reliability of the planetary gear with incurred damage was not required at the time of initial certification. Subsequently, the parts' vulnerability to rolling contact fatigue damage ultimately led to failures in service.
   

Degradation of critical parts or components, such as the main gearbox, should be detected by scheduled maintenance or annunciated to the flightdeck before a catastrophic failure occurs. (Threat Category: System/Component Failure or Malfunction (NON-POWERPLANT))

• Chip detectors collect ferrous particles which are generated due to wear and degradation. Maintenance personnel can regularly inspect chip detectors to monitor for signs of gearbox degradation. 
   
• At the time of the certification of the EC 225 LP, there was no requirement to specifically demonstrate by test the effectiveness of chip detectors.
   
• The investigation showed that the EC 225 LP chip detection system had poor performance and was inadequate for detecting or annunciating warnings of impending failure.
   
• Investigators found evidence of metallic chips trapped in the MGB oil cooler and oil filter. However, maintenance records did not indicate that personnel had discovered chips on preceding flights. The FDR, CVR, and VHM did not include any indication of system degradation (e.g. vibration) nor flight deck annunciation of chip detection.

Common Theme Related Lessons

Manufacturers must have a robust component reliability program with appropriate fidelity that can identify safety concerns so they can be addressed. (Common Theme: Organizational Lapse)

• Manufacturer reliability programs collect data on in-service component removals and replacements. If this data includes details on which parts degraded or failed, time in service, the nature of the failure, etc., the data can be used to identify areas of concern and potential corrective actions.
   
• Investigators noted that only a limited number of second-stage planetary gears reached their intended operational life while the rest were prematurely removed from service due to failure or wear identified during overhaul or unscheduled maintenance.
   
• The FAG and NTN-SNR bearings, of which either were installed in the planetary gears, both met manufacturer requirements. However, reliability issues observed with FAG and NTN-SNR bearings were not fully realized until after the G-REDL and LN-OJF accidents. This occurred because there was no structured approach to validate the in-service performance of the two types of installations.
   
• Implementing a standardized, closed-loop review process for critical parts that fail in service can help manufacturers identify trends and improve design and manufacturing practices, as well as identify safety concerns.

Certification regulations must ensure that chip detection systems are both reliable and effective in identifying degradation and impending gearbox failures. (Common Theme: Flawed Assumption)

• At the time the EC 225 LP was certified, regulations required the use of chip detectors in gearboxes but did not specify that their function must be effectively demonstrated. This lack of standardization created a gap in safety, as chip detection systems varied in effectiveness depending on the design and implementation.
   
• Establishing a required performance threshold for chip detectors would enhance reliability and ensure chip detectors provide meaningful safety benefits. Without defined performance criteria, some detection systems may be inadequate for providing timely failure warnings, leaving the gearbox health unknown to operators, and reducing effectiveness in preventing catastrophic failure. 
   

Back to top