International Helicopter Safety Symposium
2005
Montreal, Quebec, Canada
September 26-29, 2005
“Improving Helicopter Safety”
Roy Fox, Chief of Flight Safety
Bell Helicopter
Start of Helicopter Industry
• Early 1900s
– Europe: several helicopter concepts flown.
– Many lessons learned.
– USA: helicopter production lines
» Sikorsky R-4 for US Army Air Corp (1944)
» Bell 47 for civil operators (1946)
2
Model 47 First 50 Years
Accidents/100,000 flt hr
140
120
100
1973 Production Ceased
80
60
40
20
0
47
50
55
60
65
70
75
80
85
90
95
Year
3
Causes of Model 47 Accidents
47 Worldwide Accident Causes (1947-1957)
6.4%
11.6%
8.7%
73.2%
Engine AW
Non-Engine AW
Maintenance
Pilot/Unk
4
Improvements: 1960s +
• Turbine engine introduction
• Construction materials
– Wood
– Steel tubing
– Aluminum/steel
– Honeycomb structures
– Fiberglass
– Carbon Fibers
5
Bell Civil Turbine Accident Causes
Worldwide 1994-2003
6
Three Safety Protection Levels
1. Design for no failures.
2. Accept failure and mitigate:
•
Backup/redundant systems
•
Identify impending failures (HUMS)
•
Autorotation capabilities
3. Crash survival protection:
•
Seats/restraints
•
Post fire protection
7
Airworthiness Responsibilities
• Civil Certification Agency & Certification Rules
• Engine manufacturer certifies the engine to FAA Part
33. Receives Type Certificate (TC).
• Helicopter manufacturer certifies the rest of the aircraft
(other than the TC engine(s)). Receives TC.
– Part 27 for standard helicopters less than 6,000 lb. (now
7,000 lb.)
– Part 29 for transport helicopters for those heavier than
Part 27.
• TC Holder is responsible to maintain fielded fleet for
continuing certification (e.g. helicopter manufacturer
has non-engine airworthiness (AW) components).
8
System Safety: Management of Risk
• Military origin in late 1950s USAF Ballistic Missile
Division.
• New approach to look at aircraft as a system (all
components, subsystems, and crew, etc.)
• Everything works as a system.
• Goal is to identify/correct hazards early in design life
and continue risk management through system life.
• Risk is a function of hazard likelihood combined with
hazard severity.
• In last few years, civil has adopted System Safety.
• Past certification, civil is expanding into operational
aspect - Safety Management System (SMS). Needs to
be supported.
• All are systematic processes to manage RISK.
9
Risk Assessment Matrix
10
Crash Survival Requirements
• Maintain a livable volume.
• Restrain the occupant.
• Keep crash loads on occupant within human
non-injury tolerance.
• Provide time/means of escape, primarily the
post crash fire threat.
11
USArmy Leader in Crashworthiness
Research/Application
• 1950s/60s Military research in many aspects of crash
survival (crash kinematics/loads, human tolerance,
crash environment, and post crash fires)
• Developed Crashworthy Fuel System (CWFS)
– First CWFS in UH-1H May 1970
– Other Army helicopters (production and fielded) then got
CWFS.
• Crash Survival Design Guide TR 89-22 and Mil-Std1290
• New generation Army helicopters (UH60 & AH64)
were first designed to most of these requirements.
• Subsequent military helicopters and tiltrotor aircraft
also designed to these new requirements.
12
Crash Survival in Civil Helicopter
• Civil application came 10 years later
– 222 certificated and fielded in 1980
» Crash Resistant Fuel System (CRFS)
» Shoulder Harness for every occupant
» Energy Attenuating (EA) seat for each occupant
• FAA Rule Changes to new Crash Safety levels
(1989 to 1994)
– Amd 27-25 and 29-29 EA seats for new TC
applicants.
– Amd 27-28 and 29-32 Shoulder harness all seats on
helicopters produced after 1994.
– Amd 27-30 and 29-35 Crash Resistant Fuel System.
13
Where to Concentrate Efforts for
Safety Improvements?
14
20-years Bell Civil Turbine
Worldwide (1985-2004, 50 million hours)
7
Accidents/100,000 hr
6
5
4
3
2
1
0
85
90
NonEng AW
96
Engine AW
2000
Year
All Causes
15
Fewer 206 Airworthiness Failures
(51.6 million hours)
30 Years 206 Accident Causes Worldwide
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
0%
1975-1984
1985-1994
1995-2004
Unknow n
3.7%
6.0%
6.5%
Hum an (Non-AW)
73.7%
73.1%
78.4%
Engine AW
18.2%
16.8%
11.2%
Non-Engine AW
4.4%
4.1%
4.0%
16
Human Error Root Cause Study of Bell
Worldwide (1986): Improved Judgment Needed
•
Common element involved in all root causes was bad
judgment.
•
1987 Implemented 3 different approaches to teach
judgment (Aeronautical Decision Making) to
pilots/management.
1. Individual pilot: Cockpit Emergency Procedures
Expert Trainer (CEPET). PC Dos-based software to
teach judgment. Situational decision tree based on
actual accident scenarios and Bell pilot
staff/engineering knowledge. Also tested ability to
identify symptoms and subsequent actions.
»
206 Jet Ranger
»
206 Long Ranger
»
412
17
More Bell Actions
(no cost to customer)
2. Concentrate on weekly 206 pilot ground school
students of CTA. 2-hour Safety briefing included,
measuring risk, crash survival, human error
studies, and judgment training.
3. Established HELIPROPS Program (Helicopter
Professional Pilots Safety) to give Safety Briefs at
Customer’s meetings, FAA Safety Seminars, etc.
Speakers: R. Fox (Safety Engineering)
L. Doughty (Training Pilot)
J. Szymanski (HELIPROPS Manager)
4. Publish “Human AD” magazine with free
worldwide mailing. Subjects are human error and
situations for all makes of helicopters. (Copies
available on Bell website)
18
Spreading the Word
• Very positive responses in first year (1987)
• Trained two other turbine-powered
helicopter manufacturer in our approach.
• Made HELIPROPS an Industry program at
Helicopter Association International for all
to use.
• Did HELIPROPS actually work?
19
Fatalities in U.S.
Annual U.S. Fatalities: All Helicopters vs 206
(1980-2004, NTSB)
100
90
80
70
60
50
40
30
20
10
Fatalities in 206
2004
2003
2002
2001
2000
99
98
97
96
95
94
93
92
91
90
89
88
87
86
85
84
83
82
81
80
0
Fatalities in All Helicopters
20
Concentrated Safety Effort Effects
U.S. 206 Fatalities vs U.S. HELIPROPS Briefs
(1980-2004, NTSB)
70
60
50
40
30
20
10
206 Ground School Safety Briefs
HELIPROPS Briefs All Models
2004
2003
2002
2001
2000
99
98
97
96
95
94
93
92
91
90
89
88
87
86
85
84
83
82
81
80
0
Fatalities in 206
21
Statistically Significant of
Changes in Fatalities
Was there a statistical significant change in
fatalities for 7-year periods before (19801986) and after Heliprops (1987-1993)?
– Used Student T, 1-tailed at 0.05 test for annual
number of fatalities. Gives 95% assurance that
averages are or are not significantly different.
– Said differently, 95% of the time, the numbers of
fatalities will be different and not due to random
nature of rare events.
22
Statistical Significance of
HELIPROPS Effects
Metrics US Registered
206s Accidents (All
Causes)
Number of
Accidents /year
Average for Average for
1980-1986
1987-1993
Difference is
Statistical
Significant to
0.05 level (95%)
53.43
33.43
YES
Fatalities/100,000
flight hour
2.33
1.60
YES
Accidents/100,000
flight hours
5.20
3.76
YES
Non-206 helicopters (e.g. all US registered helicopters except 206)
Did NOT show Statistical Significance in differences.
NOTE: Table 2 “Number of Fatalities/year” of paper in Error.
Should be “Number of Accidents/year”. Send Email to
Rfox@bellhelicopter.textron.com for corrected copy.
23
TSI Rotorcraft Safety: Risk
What is Safety?
• Webster’s Dictionary defines “Safety” as the
condition of freedom from harm, loss, or
injury.
• Note that dictionary does not relate safety to not
having an accident.
• Safety is the Management of Risk.
• There is no absolute safety in aviation. If you
minimize the risks to the occupants, you have
improved their safety..
© Bell Helicopter 2005
24
There is NO Absolute Safety,
ONLY Shades of Gray
Risk to Aircraft
No Damage
Destroyed
Risk to Occupant
Death
No Injury
Key is to minimize the final risk to the occupant.
Risk of Fatal Injury (RFI) =
(Number of fatalities/number onboard exposed) X (accidents/hours of exposure)
25
Occupant Risk and Aircraft Risk in US
Registered Helicopters
Risk per 100,000 Exposure Hours
14
12
10
8
6
4
2
0
90
91
92
93
94
95
96
97
98
99
00
01
02
03
Year
Occupant Risk of Fatal Injury (RFI)
Risk to Helicopter (accident Rate)
26
National Aviation Safety Goal:
80% Reduction
White House Commission on Aviation Safety
Recommendation 1.1
“Government and industry should establish a
national goal to reduce the aviation fatal
accident rate by a factor of five within 10
years sand conduct safety research to
support that goal.”
Is achievement of this National Goal possible?
27
Helicopter Study to Identify
Safety Investment Areas (SIA)
Groups (US
Registered)
Flight Hours
Accidents
Fatal
Accidents
(1990-1994)
Piston
2,361,526
486
66
Turbine
7,990,747
294
77
171,049
24
4
10,523,322
804
147
Military
Surplus UH-1
Combined
Fleet
28
Combined Fleet Risks
(rates not mutually exclusive)
SIA Problems
Accidents/
100,000 flt
hr
Fatal
Accidents/
100,000 flt hr
Risk of Fatal
Injury/ 100,000
occ hr
1. Obstacle strike
0.89
0.31
0.28
2. Loss of A/C situational awareness
2.49
0.59
0.57
3. Real time aircraft performance
exceeded
1.56
0.13
0.08
4. Loss of situational awareness
internal to aircraft
1.43
0.15
0.11
5. Loss of visibility
0.47
0.24
0.24
6. Inability to respond in short
duration emergency
0.38
0.04
0.02
7. Aircraft component failure
1.95
0.30
0.25
8. Maintenance error
0.76
0.10
0.07
9. Cockpit action
5.85
1.11
1.04
29
SIA Solutions Sequencing to Achieve
80% With Existing Helicopter Fleets
SIA
Num.
SIA Solution
Accidents/
100,000 flt
hr
Fatal
Accidents/
100,000 flt hr
Risk of Fatal
Injury/ 100,000
occ hr
Present risk rates. Assuming
100% implementation:
7.64
1.40
1.23
1,2
Add proximity detection
alerting systems (live & maps)
5.07
0.76
0.65
1,2,3,
4,7
Add HUMS, aircraft health,
real time performance, &
pilot aids
2.14
0.39
0.37
1,2,3,
4,7,9
Add cockpit information
recorder (image, area mic,
0.36
0.06
0.10
GPS, & crash survivable
recorder)
10-year future goal/target
(80% less)
1.53
0.26
0.25
YES – 80% is achievable
30
Safety Goal
4: Accident Ratefor
Reduction
Safety
Investments
Future
Real Time Performance Indicator
Pilot monitor
Low Airspeed Indicator
Pilot Cueing
er
elp
al
Su
rv
iv
Ai
ds
en
t
nc
em
M
ty
bi
li
Vi
si
El
ec
tro
nic
Ground-based OCAS
10-Year Rate
Goal: 0.24
En
ha
ain
t
en
Aw
ar
en
an
c
e ss
eA
ids
Ai
ds
1.0
on
ati
/H
lS
itu
Dynamic Rollover
Ground Resonance
or
rn
a
vi s
Ad
2.3
Onboard Proxi mity Detec tion
Autorotations
ot
s
val
Anomaly Analysis
Map-based TAWS
Recovery re Inadvertent IMC
Pil
Damage Tolerance
re
ilu
ie
et r
Fa
i ds
sA
nes
Design Criteria, Risk Assessment
t
raf
re
wa
nR
Ex
te
Short-Term Automatic Recovery Training
c
Ai r
lA
Load Spectrum Monitoring
Low-cost Simulators
Cr
as
h
rna
at io
rm
nfo
it I
Civil Turbine
Accident Rate:
3.9
Improved pilot training
HUMS Warning Validation
g
di n
pen
Im
ckp
e
Int
A/C
Co
Improved judgment training
31
Roadblocks to Significant Safety
Improvements
1. No exposure data (e.g. flight hours flown by
a specific model)
– HAI working with FAA re Flight Hour reporting
similar to Bell individual aircraft monitoring.
– Cannot actually measure risk without accurate
flight hours.
2. Unknown actions within cockpit presently
labeled “human error”. We don’t know.
If you don’t understand it - You
cannot fix it.
32
FAA/HAI Effort to Develop More
Accurate Flight Hours
• Bell tracks individual
aircraft by serial number
for flight hours
S/N 30XX Flight Hours
12,000
6,000
4,000
2,000
1/1/2004
1/1/2002
1/1/2000
1/1/1998
1/1/1996
USA
1/1/1994
1/1/1992
1/1/1990
UK
1/1/1988
1/1/1984
1/1/1986
USA
0
1/1/1982
• Hours then totaled by
model
8,000
1/1/1980
• HAI starting using same
approach under FAA R&D
to accumulate individual
hours.
Total Hours
10,000
Year
33
CIR is Key to Understanding
Actual Human Error
• A means is needed to document what occurs
(and when) in cockpit
– Instrument/caution panel
– Pilot control motions
– A common reference time
– Cockpit ambient noise
• A crash-survivable Cockpit Information
Recorder (CIR) is needed to document
cockpit events
34
Need a Giant Step Forward in
Understanding Cockpit Actions
• Digital camera for sequential snapshot
images of:
– Instrument panel
– Caution panel
– Pilot cyclic stick, collective stick, and pedals
• Area microphone
• GPS (Global Positioning System)
• Crash-survivable recorder
35
COCKPIT AREA RECORDED
36
CIR WIRELESS – THE FUTURE
Once CIR is developed/fielded, a wireless feature via satellite
could be added. (Similar to GM’s OnStar car system)
• Provide flight following notification of accident (alert) to
operator, local SAR, FAA
• Provide accident location (reduces Search & Rescue time
and some lives lost while waiting). Some aircraft never
found.
• Further compressed/pre-analyzed data packets to minimize
transmission cost. Send to satellite to landline to Internet
to specific operator and the aircraft manufacturer who
would check mission profiles, adjust as needed.
• Computer programmed for last known GPS when data
transmittal interrupted (and not reestablished), determine
if normal action or crash
• If crash – PC automatically makes alert calls
37
Long/Lat
Automatic Alert
Operator
Manufacturer
38
SUMMARY
• Safety in some helicopters show slight improvements.
• BUT Civil Helicopter Industry(as a whole), Risks are NOT
IMPROVING
• There is many causes of accidents – most of which some kind
of human problem but no details known. There is no ONE
Solution.
• Airworthiness failures are rare and processes are working.
• SMS is new systematic organizational safety approach.
• Need flight hours to measure risk.
• 80% Risk Reduction Goal is possible for existing fleets
• Understanding Human aspects is the area of Safety
Challenge. Significant reductions in accidents requires
we document/understand cockpit information.
• Cockpit Information Recorder has potential to allows
reaching next safety plateau (airline safety)
• Cannot Fix What You Do Not Understand
39