When the Cabin Lights Shared a Box With the Floats: The AS350/EC130 LACU AD (2026-14-02) Through an ARP4761A CCA and DO-160G Lens

Read the unsafe-condition paragraph of FAA AD 2026-14-02 slowly, because the whole engineering story is in one sentence. Dust gets inside a box called the "lighting and ancillaries control unit." The dust causes a short circuit. The short circuit can cause the loss of the emergency flotation system, so the floats do not inflate when the helicopter goes into the water. A housekeeping problem in a lighting panel is on the same fault path as a drowning.

That is not a maintenance story. That is a partitioning story — and the terminating action the FAA mandates tells you so, because the permanent fix is not a better filter or a cleaner box. It is moving the emergency flotation switches somewhere else. This post re-frames the AD as a missing ARP4761A Zonal Safety Analysis row, a DO-160G Section 12 qualification gap, and a segregation requirement that never got written down until a regulator wrote it for the fleet twenty-two years into the type's service life.

1. The public record

On July 10, 2026, the FAA published final rule AD 2026-14-02 (Amendment 39-23402, Docket FAA-2026-2292, 91 FR 42644), effective August 14, 2026. It applies to all Airbus Helicopters Model AS350B2, AS350B3, EC120B, and EC130B4 helicopters, certificated in any category. (Federal Register / Justia)

The unsafe condition paragraph, verbatim:

"This AD was prompted by a short-circuit due to foreign object debris or dust inside the lighting and ancillaries control unit (LACU) in a Model EC130B4 helicopter. The FAA is issuing this AD to prevent this malfunction. This unsafe condition, if not detected and addressed, could lead to loss of the emergency floatation system (EFS) and result in failure of the EFS to activate during an emergency water landing."

The originating event is older and more vivid than the AD language admits. Per the Mandatory Continuing Airworthiness Information, an EC130B4 in flight produced a strong burnt smell and smoke in the cockpit. Investigation traced it to a short circuit inside the LACU, probably caused by FOD or dust on the printed circuit board. EASA issued AD 2021-0168 on July 16, 2021, then superseded it with AD 2024-0018 on January 11, 2024 — the MCAI the FAA has now adopted. (EASA AD 2024-0018)

The required actions have a shape worth noticing:

| Action | Nature | Labor | Cost per aircraft | Fleet cost (U.S.) | |---|---|---|---|---| | Clean and inspect LACU for FOD | Repetitive interim | 2 hr | $170 | $97,920 per cycle | | Modify EFS activation switches | Design change, terminating | 16 hr | $1,360 | $783,360 | | Revise the RFM | Procedural | 1 hr | $85 | $48,960 |

576 U.S.-registry helicopters are affected. The FAA also prohibits installing an affected LACU on any helicopter unless certain conditions are met, and after the switch modification the aircraft is reclassified from Group 1 to Group 2 — at which point the repetitive cleaning obligation ends.

That table is the entire safety argument in cost form. The recurring inspection is not the fix; it is the bridge. The fix is architectural separation, and it costs sixteen work-hours a ship. Nobody spent those sixteen hours during design because no work product ever demanded them.

The consequence side is not hypothetical for this airframe family. On March 11, 2018, a Liberty Helicopters AS350B2 on a doors-off photo flight over the East River ditched after an inadvertent engine shutdown. The pilot pulled the float activation handle. The floats did not fully inflate — the left skid floats were found more inflated than the right — the aircraft rolled right, inverted, and submerged roughly 11 seconds after touchdown. The pilot survived. All five passengers drowned. NTSB report AAR-19/04 issued 20 findings and 16 recommendations, five of them touching the emergency flotation system. (NTSB AAR-19/04)

Different failure mechanism, same lesson: on a light single, the EFS gets exactly one chance, and it gets it during the worst eleven seconds of the flight.

2. The standards lens

The AS350/EC120/EC130 family is certificated under 14 CFR Part 27 (normal category rotorcraft), with the EASA equivalent CS-27. Four requirement threads should have converged on this box, and the record suggests none of them did with enough force.

14 CFR 27.1309 — Equipment, systems, and installations. Part 27 §27.1309 is materially weaker than its Part 29 sibling: it requires that equipment be designed and installed so that it does not adversely affect the continued safe operation of the rotorcraft. The word doing the work is adversely affect. A lighting control unit whose failure can also disable a ditching-survival function adversely affects continued safe operation by any reading. AC 27-1B is where the applicant is expected to demonstrate that failure of non-required equipment cannot propagate into required equipment. The propagation path here was a shared enclosure and a shared PCB.

14 CFR 27.1357 and 27.1359 — Circuit protective devices and electrical system fire protection. A dust-initiated short that produced smoke in an occupied cockpit is a §27.1359 finding on its own terms, independent of the EFS. Note that the burnt-smell event was the reported event in 2021; the EFS loss is the analyzed consequence that took until 2024 to become the stated unsafe condition. The smoke was the symptom people could smell. The float loss was the one that would have killed somebody, and it was latent.

14 CFR 27.801 and 27.1415 — Ditching and ditching equipment. Where an EFS is installed to support ditching credit, the flotation function is not an accessory. It is the means of compliance for a survivability claim. Its activation path deserves the same design assurance treatment as any other emergency-only, one-shot function.

ARP4761A Common Cause Analysis. This is the clause that should have caught it, and it has three parts, each of which independently flags this design:

Zonal Safety Analysis (ZSA). ZSA asks what is physically installed together, what environment that zone actually sees, and what a single physical event in that zone can take out. A cockpit console zone on a light single flown into unimproved landing sites sees dust, grit, rotor-wash debris and operator-introduced FOD as a routine condition, not an exceptional one. A ZSA row for that zone with "dust ingress on energized PCB" as the event should have produced the finding "EFS activation loses its command path."
Particular Risks Analysis (PRA). FOD and dust ingress in utility, tour, HEMS and offshore rotorcraft operations is a textbook particular risk — external to the system, capable of defeating independence claims across multiple functions at once.
Common Mode Analysis (CMA). CMA is where you prove that two functions you claimed were independent actually are. Lighting and EFS activation sharing an enclosure, a ground, a connector and a board is a common-mode coupling factor of the most basic kind: co-location.

RTCA DO-160G Section 12 — Sand and Dust. This is the qualification gap and it is the least discussed. DO-160G Section 12 exists precisely to establish whether equipment tolerates blowing sand and dust representative of the installed environment. A unit that shorts on accumulated dust either was not subjected to a Section 12 category appropriate to a rotorcraft operating from unpaved sites, or was qualified against a category that did not represent the real duty cycle. The remedy embedded in the AD — periodic cleaning of the PCB — is the operational admission that the enclosure never met the environment.

ARP4754A/B derived requirements. The relocation of the EFS switches is, in ARP4754A terms, a derived requirement discovered by safety analysis: a requirement with no functional parent, existing only because an analysis said the architecture must change. It is exactly the class of requirement ARP4754A §5.4 tells you to feed back into the aircraft-level requirements set and re-validate. Here it was derived in 2023 by EASA, not in 2003 by the applicant.

3. A worked snippet

Here is the FHA row and the Zonal/Common Mode rows nobody wrote, followed by the fault tree the AD implicitly asserts.

3.1 Functional Hazard Assessment excerpt

| ID | Function | Failure condition | Flight phase | Effect | Classification | Detection | Existing means | |---|---|---|---|---|---|---|---| | FHA-EFS-01 | Deploy emergency flotation on command | Loss of EFS activation command path | Ditching / emergency water landing | Floats do not inflate; rollover and inversion within seconds of water contact; occupant escape prevented | Catastrophic (in combination with ditching) | None in flight — latent | Pre-flight visual of handle only | | FHA-EFS-02 | Preserve cockpit environment | LACU internal short produces smoke in occupied cockpit | All | Crew distraction, possible in-flight fire | Hazardous | Smell / smoke — crew, late | Circuit protection | | FHA-LGT-01 | Provide cockpit and ancillary lighting | Loss of lighting control | Night | Increased crew workload | Major (night) / Minor (day) | Immediate, crew | Backup lighting |

Two observations. First, FHA-EFS-01 is latent — there is no in-flight indication that the float command path has been lost, which is what makes the pairing with a ditching so dangerous. Latent-failure-plus-triggering-event is the exact pattern that demands either a periodic maintenance check with an interval derived from exposure time, or a design change removing the coupling. The AD ordered both, in that order.

Second, FHA-LGT-01 is a Major-at-worst function. A Major function and a Catastrophic-contributing function were sharing a housing. That is the whole defect.

3.2 Zonal Safety Analysis and Common Mode Analysis rows

| ID | Zone | Installed items | Zonal hazard | Coupling factor | Independence claim | Verdict | |---|---|---|---|---|---|---| | ZSA-C12-04 | Center console / instrument panel | LACU (lighting + ancillaries), EFS activation switch | Dust and FOD accumulation on energized PCB | Shared enclosure, shared PCB, shared connector | "EFS activation independent of lighting" | Not substantiated | | CMA-EFS-02 | — | LACU, EFS arm/fire path | Single short circuit disables both | Co-location, common ground, common power feed | Independence assumed, never analyzed | Falsified by field event | | PRA-DUST-01 | Cabin / cockpit | All console-mounted LRUs | Rotor-wash debris, unimproved-site operation, doors-off configurations | External environment | DO-160G §12 category as qualified | Category not representative |

3.3 Fault tree

                    TOP: Occupants unable to evacuate after
                         emergency water landing
                         (Catastrophic)
                                |
                              [AND]
                    ____________|____________
                   |                         |
          Emergency water landing      EFS fails to inflate
          occurs (initiating event)    on command
                                              |
                                            [OR]
                    __________________________|__________________________
                   |                    |                    |           |
        Loss of activation      Reservoir / valve    Float bag or     Activation
        command path            failure             hose damage      force excessive
                   |                                                 (ref. AAR-19/04)
                 [OR]
        ___________|___________
       |                       |
  LACU internal short     Wiring / connector
  (FOD or dust on PCB)    failure downstream
       |
     [AND]
   ____|________________________
  |                             |
Dust/FOD ingress            LACU energized,
past enclosure              no ingress-tolerant
(DO-160G §12 gap)           creepage/clearance
                            or conformal coat

Note where the AD's two remedies attach. Repetitive cleaning attacks the bottom-left basic event — it lowers the probability of dust ingress reaching a damaging accumulation, but does nothing to the structure of the tree. Relocating the EFS switches deletes the "LACU internal short" branch entirely. One is a probability argument that must be re-made every inspection cycle forever. The other is an architectural argument you make once. That is why the FAA calls the modification a terminating action, and it is the correct hierarchy: eliminate the coupling, do not manage it.

4. Derived requirements (excerpt)

These are the requirements the design should have carried from the start. They are written to be traceable, verifiable and independent of this particular airframe.

DR-EFS-001 — Segregation of emergency activation paths. The activation command path for any emergency-only, one-shot survivability function (emergency flotation, emergency locator, fire extinguishing, emergency lighting) shall not share an enclosure, printed circuit assembly, connector shell, power feed or ground return with any equipment classified Major or below. Verification: installation drawing review plus wiring separation analysis; ARP4761A CMA record showing no shared coupling factor. Parent: 14 CFR 27.1309; ARP4761A CMA.

DR-EFS-002 — Latency bounding for the flotation command path. Continuity and integrity of the EFS activation command path shall be verifiable by the crew or by an automatic monitor at an interval not exceeding 24 flight hours, with an in-cockpit indication of an unavailable EFS presented before takeoff on any flight profile that includes overwater segments. Verification: monitor test on the aircraft; RFM procedure review; FHA latent-exposure calculation. Parent: FHA-EFS-01 latency finding.

DR-ENV-003 — Environmental category traceable to the operational profile. Every console-mounted LRU shall be qualified to a DO-160G Section 12 (Sand and Dust) category selected from the documented operational profile of the type, including unimproved-site, doors-off and rotor-wash-exposed operations. Where the selected category does not envelope the profile, an ingress-protection rating of at least IP54 at the enclosure shall be substantiated in its place. Verification: DO-160G §12 test report; qualification-to-profile traceability matrix. Parent: PRA-DUST-01; DO-160G §12.

DR-ENV-004 — Ingress tolerance at the board level. Printed circuit assemblies inside any LRU whose failure contributes to a Hazardous or Catastrophic failure condition shall be conformally coated and shall maintain creepage and clearance margins under a contaminated-surface assumption, such that conductive dust bridging between adjacent nets does not produce a sustained short. Verification: coating inspection; creepage/clearance analysis under pollution degree 3 assumptions. Parent: CMA-EFS-02; 14 CFR 27.1359.

DR-ZSA-005 — Zonal analysis coverage of mixed-criticality enclosures. Every enclosure containing functions of two or more different failure-condition classifications shall carry an explicit ZSA row identifying the highest classification present, and shall be reviewed against a documented list of zonal hazards including debris, fluid, thermal and mechanical events. No enclosure shall be released to production with an unresolved mixed-criticality ZSA finding. Verification: ZSA record completeness audit at each design review gate. Parent: ARP4761A ZSA; ARP4754A §5.4 derived requirements.

5. What the headline really tells us

The headline version of this AD is boring on purpose: FAA orders periodic cleaning of a control unit on light Airbus helicopters. It reads like housekeeping. It is not housekeeping. It is a regulator, twenty-two years into a type's service life, spending $783,360 of operator money to buy back a separation that sixteen work-hours per aircraft would have provided at build — and buying it only after a field event, one superseded AD, and a three-year gap between "there was smoke in the cockpit" and "this could sink the aircraft."

The missing artifact is not a cleaning procedure. It is a Zonal Safety Analysis row for a mixed-criticality enclosure, and behind it a DO-160G Section 12 category chosen against the operational profile the aircraft actually flies rather than the one on the certification basis. Everything downstream — the repetitive inspection, the RFM revision, the Group 1 to Group 2 reclassification, the $97,920 per inspection cycle — is the cost of reconstructing that one row in the field, on 576 aircraft, one shop visit at a time.

The generalizable question is not about helicopters. Open any enclosure in the system you are responsible for right now — an ECU, a surgical robot's control box, a PLC cabinet, an eVTOL avionics tray — and ask what the highest failure-condition classification inside it is, and what the lowest one is. If those two numbers are different and you cannot produce a written analysis explaining why the low one cannot take out the high one, you do not have an independence claim. You have an assumption. Assumptions get audited by the field, and the field is not gentle about it.

Dust took out the floats. Write the row.

Sources

— Jherrod Thomas, The Lion of Functional Safety™