“Improving Helicopter Safety” Roy Fox, Chief of Flight Safety Bell Helicopter International Helicopter Safety Symposium 2005 Montreal, Quebec, Canada September 26-29, 2005
Dec 26, 2015
“Improving Helicopter Safety”
Roy Fox, Chief of Flight SafetyBell Helicopter
International Helicopter Safety Symposium 2005
Montreal, Quebec, Canada
September 26-29, 2005
2
Start of Helicopter Industry
• Early 1900s
– Europe: several helicopter concepts flown.
– Many lessons learned.
– USA: helicopter production lines
» Sikorsky R-4 for US Army Air Corp (1944)
» Bell 47 for civil operators (1946)
3
Model 47 First 50 Years
0
20
40
60
80
100
120
140
47 50 55 60 65 70 75 80 85 90 95
Year
Acc
iden
ts/1
00,0
00 f
lt h
r
1973 Production Ceased
4
Causes of Model 47 Accidents
47 Worldwide Accident Causes (1947-1957)
8.7%
11.6%
6.4%
73.2%
Engine AW Non-Engine AW Maintenance Pilot/Unk
5
Improvements: 1960s +
• Turbine engine introduction
• Construction materials– Wood
– Steel tubing
– Aluminum/steel
– Honeycomb structures
– Fiberglass
– Carbon Fibers
6
Bell Civil Turbine Accident CausesWorldwide 1994-2003
7
Three Safety Protection Levels
1. Design for no failures.
2. Accept failure and mitigate:• Backup/redundant systems
• Identify impending failures (HUMS)
• Autorotation capabilities
3. Crash survival protection:• Seats/restraints
• Post fire protection
8
Airworthiness Responsibilities
• Civil Certification Agency & Certification Rules
• Engine manufacturer certifies the engine to FAA Part 33. Receives Type Certificate (TC).
• Helicopter manufacturer certifies the rest of the aircraft (other than the TC engine(s)). Receives TC.
– Part 27 for standard helicopters less than 6,000 lb. (now 7,000 lb.)
– Part 29 for transport helicopters for those heavier than Part 27.
• TC Holder is responsible to maintain fielded fleet for continuing certification (e.g. helicopter manufacturer has non-engine airworthiness (AW) components).
9
System Safety: Management of Risk
• Military origin in late 1950s USAF Ballistic Missile Division.
• New approach to look at aircraft as a system (all components, subsystems, and crew, etc.)
• Everything works as a system.
• Goal is to identify/correct hazards early in design life and continue risk management through system life.
• Risk is a function of hazard likelihood combined with hazard severity.
• In last few years, civil has adopted System Safety.
• Past certification, civil is expanding into operational aspect - Safety Management System (SMS). Needs to be supported.
• All are systematic processes to manage RISK.
10
Risk Assessment Matrix
11
Crash Survival Requirements
• Maintain a livable volume.
• Restrain the occupant.
• Keep crash loads on occupant within human non-injury tolerance.
• Provide time/means of escape, primarily the post crash fire threat.
12
USArmy Leader in Crashworthiness Research/Application
• 1950s/60s Military research in many aspects of crash survival (crash kinematics/loads, human tolerance, crash environment, and post crash fires)
• Developed Crashworthy Fuel System (CWFS)
– First CWFS in UH-1H May 1970
– Other Army helicopters (production and fielded) then got CWFS.
• Crash Survival Design Guide TR 89-22 and Mil-Std-1290
• New generation Army helicopters (UH60 & AH64) were first designed to most of these requirements.
• Subsequent military helicopters and tiltrotor aircraft also designed to these new requirements.
13
Crash Survival in Civil Helicopter
• Civil application came 10 years later– 222 certificated and fielded in 1980
» Crash Resistant Fuel System (CRFS)
» Shoulder Harness for every occupant
» Energy Attenuating (EA) seat for each occupant
• FAA Rule Changes to new Crash Safety levels (1989 to 1994)– Amd 27-25 and 29-29 EA seats for new TC
applicants.
– Amd 27-28 and 29-32 Shoulder harness all seats on helicopters produced after 1994.
– Amd 27-30 and 29-35 Crash Resistant Fuel System.
14
Where to Concentrate Efforts for Safety Improvements?
15
20-years Bell Civil Turbine Worldwide (1985-2004, 50 million hours)
0
1
2
3
4
5
6
7
85 90 96 2000Year
Acc
iden
ts/1
00,0
00 h
r
NonEng AW Engine AW All Causes
16
Fewer 206 Airworthiness Failures(51.6 million hours)
30 Years 206 Accident Causes Worldwide
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Unknown 3.7% 6.0% 6.5%
Human (Non-AW) 73.7% 73.1% 78.4%
Engine AW 18.2% 16.8% 11.2%
Non-Engine AW 4.4% 4.1% 4.0%
1975-1984 1985-1994 1995-2004
17
Human Error Root Cause Study of Bell Worldwide (1986): Improved Judgment Needed
• Common element involved in all root causes was bad judgment.
• 1987 Implemented 3 different approaches to teach judgment (Aeronautical Decision Making) to pilots/management.
1. Individual pilot: Cockpit Emergency Procedures Expert Trainer (CEPET). PC Dos-based software to teach judgment. Situational decision tree based on actual accident scenarios and Bell pilot staff/engineering knowledge. Also tested ability to identify symptoms and subsequent actions.
» 206 Jet Ranger
» 206 Long Ranger
» 412
18
More Bell Actions (no cost to customer)
2. Concentrate on weekly 206 pilot ground school students of CTA. 2-hour Safety briefing included, measuring risk, crash survival, human error studies, and judgment training.
3. Established HELIPROPS Program (Helicopter Professional Pilots Safety) to give Safety Briefs at Customer’s meetings, FAA Safety Seminars, etc.
Speakers: R. Fox (Safety Engineering)
L. Doughty (Training Pilot)
J. Szymanski (HELIPROPS Manager)
4. Publish “Human AD” magazine with free worldwide mailing. Subjects are human error and situations for all makes of helicopters. (Copies available on Bell website)
19
Spreading the Word
• Very positive responses in first year (1987)
• Trained two other turbine-powered helicopter manufacturer in our approach.
• Made HELIPROPS an Industry program at Helicopter Association International for all to use.
• Did HELIPROPS actually work?
20
Fatalities in U.S.Annual U.S. Fatalities: All Helicopters vs 206
(1980-2004, NTSB)
0
10
20
30
40
50
60
70
80
90
100
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
2000
2001
2002
2003
2004
Fatalities in 206 Fatalities in All Helicopters
21
Concentrated Safety Effort Effects U.S. 206 Fatalities vs U.S. HELIPROPS Briefs
(1980-2004, NTSB)
0
10
20
30
40
50
60
70
80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
2000
2001
2002
2003
2004
206 Ground School Safety Briefs HELIPROPS Briefs All Models Fatalities in 206
22
Statistically Significant of Changes in Fatalities
Was there a statistical significant change in fatalities for 7-year periods before (1980-1986) and after Heliprops (1987-1993)?– Used Student T, 1-tailed at 0.05 test for annual
number of fatalities. Gives 95% assurance that averages are or are not significantly different.
– Said differently, 95% of the time, the numbers of fatalities will be different and not due to random nature of rare events.
23
Statistical Significance of HELIPROPS Effects
Metrics US Registered 206s Accidents (All Causes)
Average for 1980-1986
Average for 1987-1993
Difference is Statistical Significant to 0.05 level (95%)
Number of Accidents /year
53.43 33.43 YES
Fatalities/100,000 flight hour
2.33 1.60 YES
Accidents/100,000 flight hours
5.20 3.76 YES
NOTE: Table 2 “Number of Fatalities/year” of paper in Error. Should be “Number of Accidents/year”. Send Email to [email protected] for corrected copy.
Non-206 helicopters (e.g. all US registered helicopters except 206) Did NOT show Statistical Significance in differences.
24
What is Safety?
TSI Rotorcraft Safety: Risk
• Webster’s Dictionary defines “Safety” as the condition of freedom from harm, loss, or injury.
• Note that dictionary does not relate safety to not having an accident.
• Safety is the Management of Risk.
• There is no absolute safety in aviation. If you minimize the risks to the occupants, you have improved their safety..
© Bell Helicopter 2005
25
There is NO Absolute Safety,ONLY Shades of Gray
Risk to Occupant
Risk to Aircraft
Destroyed No Damage
No InjuryDeath
Key is to minimize the final risk to the occupant.
Risk of Fatal Injury (RFI) =
(Number of fatalities/number onboard exposed) X (accidents/hours of exposure)
26
Occupant Risk and Aircraft Risk in US Registered Helicopters
0
2
4
6
8
10
12
14
90 91 92 93 94 95 96 97 98 99 00 01 02 03
Year
Ris
k p
er 1
00,0
00 E
xpo
sure
Ho
urs
Occupant Risk of Fatal Injury (RFI) Risk to Helicopter (accident Rate)
27
National Aviation Safety Goal: 80% Reduction
White House Commission on Aviation Safety
Recommendation 1.1
“Government and industry should establish a national goal to reduce the aviation fatal accident rate by a factor of five within 10 years sand conduct safety research to support that goal.”
Is achievement of this National Goal possible?
28
Helicopter Study to Identify Safety Investment Areas (SIA)
Groups (US Registered)
Flight Hours
(1990-1994)
Accidents Fatal Accidents
Piston 2,361,526 486 66
Turbine 7,990,747 294 77
Military Surplus UH-1
171,049 24 4
Combined Fleet
10,523,322 804 147
29
Combined Fleet Risks(rates not mutually exclusive)
SIA Problems Accidents/ 100,000 flt hr
Fatal Accidents/ 100,000 flt hr
Risk of Fatal Injury/ 100,000 occ hr
1. Obstacle strike 0.89 0.31 0.28
2. Loss of A/C situational awareness 2.49 0.59 0.57
3. Real time aircraft performance exceeded
1.56 0.13 0.08
4. Loss of situational awareness internal to aircraft
1.43 0.15 0.11
5. Loss of visibility 0.47 0.24 0.24
6. Inability to respond in short duration emergency
0.38 0.04 0.02
7. Aircraft component failure 1.95 0.30 0.25
8. Maintenance error 0.76 0.10 0.07
9. Cockpit action 5.85 1.11 1.04
30
SIA Solutions Sequencing to Achieve 80% With Existing Helicopter Fleets
SIA Num.
SIA Solution Accidents/ 100,000 flt hr
Fatal Accidents/ 100,000 flt hr
Risk of Fatal Injury/ 100,000 occ hr
Present risk rates. Assuming 100% implementation:
7.64 1.40 1.23
1,2 Add proximity detection alerting systems (live & maps)
5.07 0.76 0.65
1,2,3,4,7
Add HUMS, aircraft health, real time performance, & pilot aids
2.14 0.39 0.37
1,2,3,4,7,9
Add cockpit information recorder (image, area mic, GPS, & crash survivable recorder)
0.36 0.06 0.10
10-year future goal/target (80% less)
1.53 0.26 0.25
YES – 80% is achievable
31
Safety Investments for Future
32
Roadblocks to Significant Safety Improvements
1. No exposure data (e.g. flight hours flown by a specific model)
– HAI working with FAA re Flight Hour reporting similar to Bell individual aircraft monitoring.
– Cannot actually measure risk without accurate flight hours.
2. Unknown actions within cockpit presently labeled “human error”. We don’t know.
If you don’t understand it - You cannot fix it.
33
FAA/HAI Effort to Develop More Accurate Flight Hours
• Bell tracks individual aircraft by serial number for flight hours
• HAI starting using same approach under FAA R&D to accumulate individual hours.
• Hours then totaled by model
S/N 30XX Flight Hours
0
2,000
4,000
6,000
8,000
10,000
12,000
1/1/
1980
1/1/
1982
1/1/
1984
1/1/
1986
1/1/
1988
1/1/
1990
1/1/
1992
1/1/
1994
1/1/
1996
1/1/
1998
1/1/
2000
1/1/
2002
1/1/
2004
Year
To
tal
Ho
urs
USA USAUK
34
CIR is Key to Understanding Actual Human Error
• A means is needed to document what occurs (and when) in cockpit– Instrument/caution panel
– Pilot control motions
– A common reference time
– Cockpit ambient noise
• A crash-survivable Cockpit Information Recorder (CIR) is needed to document cockpit events
35
Need a Giant Step Forward in Understanding Cockpit Actions
• Digital camera for sequential snapshot images of:– Instrument panel
– Caution panel
– Pilot cyclic stick, collective stick, and pedals
• Area microphone
• GPS (Global Positioning System)
• Crash-survivable recorder
36
COCKPIT AREA RECORDED
37
CIR WIRELESS – THE FUTURE
Once CIR is developed/fielded, a wireless feature via satellite could be added. (Similar to GM’s OnStar car system)
• Provide flight following notification of accident (alert) to operator, local SAR, FAA
• Provide accident location (reduces Search & Rescue time and some lives lost while waiting). Some aircraft never found.
• Further compressed/pre-analyzed data packets to minimize transmission cost. Send to satellite to landline to Internet to specific operator and the aircraft manufacturer who would check mission profiles, adjust as needed.
• Computer programmed for last known GPS when data transmittal interrupted (and not reestablished), determine if normal action or crash
• If crash – PC automatically makes alert calls
38
Automatic Alert
Long/Lat
Operator
Manufacturer
39
SUMMARY• Safety in some helicopters show slight improvements.
• BUT Civil Helicopter Industry(as a whole), Risks are NOT IMPROVING
• There is many causes of accidents – most of which some kind of human problem but no details known. There is no ONE Solution.
• Airworthiness failures are rare and processes are working.
• SMS is new systematic organizational safety approach.
• Need flight hours to measure risk.
• 80% Risk Reduction Goal is possible for existing fleets
• Understanding Human aspects is the area of Safety Challenge. Significant reductions in accidents requires we document/understand cockpit information.
• Cockpit Information Recorder has potential to allows reaching next safety plateau (airline safety)
• Cannot Fix What You Do Not Understand