Wednesday, February 1, 2006
Armed with a slew of accident analyses, the oil and gas industry is prodding operators and manufacturers to make helicopter operations as safe as airline travel. Here's why.
The International Helicopter Safety Symposium last September in Montreal launched a collaborative effort to reduce the helicopter accident rate.
More than 260 international representatives of helicopter manufacturers, military and civil helicopter operators, and international regulators agreed that the current helicopter accident rate is excessive and unsustainable and that collaborative effort by all should be able to reduce that rate by 80 percent. Several speakers described how a few key risk-reduction measures could achieve this result.
Shell's "7/7=1" helicopter risk-reduction program advocates seven key measures that can reduce the current fatal-accident rate for offshore helicopter operations from just under seven per million flight hours to around one per million flight hours. This is consistent with the symposium's conclusion that the means are at hand to reduce the helicopter accident rate by 80 percent or more. Such a reduction is necessary to achieve the International Assn. of Oil and Gas Producers' (OGP) goal: "The individual risk per period of flying exposure for an individual flying on OGP-contracted business should be no greater than on the average global airline." Achieving this goal could save more than 200 offshore oil and gas workers' lives during the next 10 years.
While the "7/7=1" program focused on helicopters supporting offshore operations by OGP member companies, these same measures can help any type of helicopter operation reduce its accident rate by 80 percent or more.
Shell Aircraft, the organization within Shell responsible for aircraft operating standards, developed the "7/7=1" risk-reduction program as a result of its detailed analysis of 30 years of commercial airline safety improvements, published accident data, its own ongoing safety initiatives and comparisons of existing helicopter designs to the current U.S. FAA design requirements.
The poor safety record of the helicopter industry is well documented and many studies have been carried out to analyze the causes. There is broad consistency and agreement in much of the analysis; the causes of each new accident rarely come as a surprise to the industry. Indeed, some people believe that helicopters are, by design and operating concept, less safe than fixed-wing aircraft.
The current safety record of public-transport helicopters is actually not much worse than the airline industry's safety performance was 30 years ago. But while the airlines for the most part have consistently improved, offshore helicopter operations' accident rate is actually getting worse. Unfortunately, a large number of the helicopters presently operating offshore were designed and are still operated to the same criteria and procedures that the airliners were 30 years ago. Indeed, many of the helicopters themselves were built more than 30 years ago.
Analysis shows that the helicopter industry has not fully embraced the improvements in design, equipment, operating procedures, training and maintenance practices that enabled the airlines to achieve their safety improvements. In fact, the key steps taken by the airlines to improve their safety can be replicated with helicopters with similar effects.
Shell Aircraft analyzed numerous sets of accident data. These included: NASA's 2000 study of U.S. civil rotorcraft accidents from 1963 to 1997; a 1999 study of helicopter safety by the Scandinavian research group SINTEF; statistics and analyses of the U.S. Gulf Coast's Helicopter Safety Advisory Conference; Robert Breiling Associates' Annual Turbine Aircraft Accident Review; the Flight Safety Foundation's Flight Safety Digest, and U.K. Civil Aviation Authority studies of helicopter tail-rotor failures (in 2003) and helicopter health-monitoring cost-benefit ratios (in 1997).
These data show similar trends: a steady decrease in accident rate until the mid-1990s, followed by a disturbing upward trend in recent years. 2003 was a particularly bad year for accidents in the Gulf of Mexico, although all were on single-engine helicopters. In recent years, the overall accident rate for a representative sample of twin-turbine helicopters has averaged about 20 per million flight hours in the United States and about 12 per million in the North Sea.
Despite strenuous and continuous efforts by some oil companies and helicopter operators to reduce accidents, the trend of overall accident rates, also reflected in the rolling five-year average fatal-accident rate, shows a very disturbing upward trend in the last few years.
With the best available accident data and analyses in hand, our team carefully assessed Shell Aircraft's current and potential further risk-reduction initiatives, including:
- Aviation safety management systems (SMS) incorporating systematic hazard assessment and a structured approach to risk management.
- Quality assurance (QA) in maintenance.
- Operating, maintenance and training standards in line with industry "best practice" to minimize human error and improve the safety culture. These include, among other things, line-oriented flight training (LOFT) exercises with a focus on crew resource management (CRM) during simulator training, human factors training for air and maintenance personnel and the requirement for duplicate inspections after maintenance on safety-critical equipment.
- Health and usage monitoring systems (HUMS) on contracted or owned aircraft and the subsequent development of a minimum specification for HUMS/vibration health monitoring (VHM) for the industry, targeted at monitoring the machine and human error in maintenance.
- Cabin configuration guidelines and helicopter underwater escape training (HUET) standards to improve survivability for passengers and crew in the event of a ditching.
- Improved aircraft performance standards and standardized takeoff and landing profiles, i.e. Performance Class 1 (PC1) or Performance Class 2 enhanced (PC2e) as defined by ICAO Annex 6.
- Helicopter operations monitoring programs (HOMP), a version of flight data monitoring targeted at monitoring the pilot and his conduct of the operation in accordance with Flight Manual and Operations Manual requirements and enhancing training effectiveness through confidential feedback loops.
- Defensive aids such as automatic voice alert devices (AVAD) or enhanced ground proximity warning systems (EGPWS) to prevent controlled flight into terrain or water and traffic alert and collision avoidance systems (TCAS) to prevent mid-air collisions.
- Industry "best practice" for managing helideck operations.
Implementation of these risk-reduction measures has improved Shell's air safety performance fourfold since 1992. Analysis showed, however, that design deficiencies in many of the helicopters we currently fly would make it unlikely to achieve the goal of making them as safe as the good airlines. This fact is demonstrated by the helicopter safety record in the North Sea, where implementation of the measures mentioned reduced the fatal-accident rate to about two per million flight hours. Further improvement has proved to be difficult to achieve. Our analysis showed that to achieve a fatal-accident rate of one per million flight hours or less, industry must re-equip with helicopters designed to the latest requirements in Federal Aviation Regulations (FAR) 27 (for small aircraft) and 29 (for large ones).
We came to this conclusion after assessing the effectiveness of existing and potential risk-reduction measures against the common causes of helicopter accidents. Although the analyses we reviewed each used different ways of categorizing accidents, system failure (including engine failure), hitting objects, and flying into the ground featured prominently as the main causes and accounted for about 70 percent of all accidents. We analyzed the following causes (some of which have design implications) and assessed means of mitigation: airframe system failures, in-flight collision with objects, loss of control, loss of engine power and in-flight collision with terrain.
Most of the airframe system failures reported in NASA's study occurred in the rotor, transmission and control systems. Metal fatigue or other material failure caused about three quarters of them, accounting for about 20 percent of all accidents. The SINTEF study attributed about one fifth of all accidents to design deficiencies, most of which related to damage tolerance of rotor systems and flight controls. One of the greatest design deficiencies appears to be the tail-rotor systems on many helicopters.
Even with this most obvious difference between fixed- and rotary-wing aircraft, designs can be improved. For instance, NASA found the industry and regulators could adopt more conservative fatigue-design criteria and incorporate additional fail-safe modes, such as a fail-safe tail-rotor pitch mechanism. SINTEF found rotor systems and flight control systems could be made more redundant, for instance with duplex drive shafts. The Flight Safety Foundation noted rotor-control systems could be designed so no single failure (or combination of failures not shown to be extremely improbable) could cause an accident. This is similar to the requirements of FAR 25.671 for airliners. The table above shows some of the important amendments to FAR 29 that can help prevent airframe system failures.
Similar assessment of all the amendments to FAR 27 and 29 showed that many important risk-reduction measures are not present on older helicopter design types.
Together with the established risk-reduction potential of simulator training, quality and safety management systems, HUMS, HOMP, disciplined takeoff and landing profiles and defensive equipment like EGPWS and TCAS, our assessment showed that helicopters designed to the latest standards can indeed achieve the goal of reducing the fatal-accident rate by 80 percent or more. What's more, some of the new design types, like Sikorsky's S-92, come equipped with HUMS, a flight data recorder for HOMP, significantly improved takeoff and landing performance and EGPWS.
Having determined that Shell Aircraft's helicopter safety goal is achievable, we set out to show that the necessary risk-reduction measures are affordable. Within Shell, the ultimate test for safety measures is the expectation to reduce risks to a level as low as reasonably practicable (ALARP). Meeting this ALARP test argues for investing in safety improvement until the additional cost becomes disproportionate to the incremental safety benefit. When you consider that the costs associated with accidents include material losses, loss of reputation, loss of production, costs of litigation and potential punitive damages, the cost of an accident with a medium or large helicopter involving multiple fatalities could be in excess of $50 million.
Our first step toward determining what is necessary to manage helicopter risks to the ALARP standard was to quantify the risk reduction expected from each potential corrective measure. Having studied the referenced reports, we assigned effectiveness levels to each potential risk-reduction measure and applied them where appropriate in three levels of defense. The values assigned were conservative relative to established data. For instance, we assumed HUMS would have a 65-percent effectiveness, while the U.K. CAA study found such systems 69 percent effective.
To illustrate the three levels of defense, the first level of defense against loss of tail-rotor effectiveness is the design. The second is a HUMS to warn of incipient failure, and the final defensive barrier before release of the hazard is simulator training for the flight crew to cope with loss of tail-rotor effectiveness.
When all these defenses fail, secondary safety measures come into play. These include crashworthiness of the airframe and passenger seats, the helicopter's flotation system (to keep it upright after alighting on water), upper torso restraints (to help prevent disorientation should the helicopter capsize on water), HUET, and the water survival equipment used by passengers and flight crew.
Having applied the estimated effectiveness of each mitigation measure to the accident data, it was possible to project the percentage of reduction in accidents that could be attributed to each measure. The graphs on page 36, derived from the SINTEF and NASA studies, illustrate the impact of each mitigation measure in isolation, with the others set at zero.
This analysis shows that designs adhering to the latest amendment combined with enhanced handling qualities (which of course can only be obtained with new types of helicopter) would prove to be the most effective mitigation to prevent accidents. The NASA study covers a period ending in 1997, whereas the AS332 and S-76 analysis includes another six years. The charts indicate that mitigation provided by training, quality and safety management systems with operational controls, HUMS and the disciplined takeoff and landing profiles of PC1 and PC2e are all lower for the AS332 and S-76 accidents than for the NASA study. This may be indicative of improvements progressively introduced over the last 10 years to these two helicopter types, which predominate in offshore operations. The only significant difference between the two analyses concerns EGPWS/TCAS. This can be accounted for by the very high number of S-76 accidents involving controlled flight into terrain or water, which has driven Sikorsky to deliver the C model equipped with EGPWS standard.
Many of the mitigation measures have already been deployed to a varying extent throughout the world. To illustrate how the trends in accident reduction relate to operating costs (and hence whether changes meet the ALARP test), we estimated the risk reduction and cost for a number of mitigation-measure packages.
Package A is the baseline, with no mitigation measures, and represents twin-turbine helicopters operated globally in the late 1980s and early 1990s. The baseline accident rate we used is 20 per million flight hours, although recent trends indicate this may be rising. Using the ratio of 0.35 between fatal accidents and all accidents, we get a baseline fatal-accident rate of seven per million flight hours. The corresponding operating cost is estimated at $2.5 million a year based on annual standing charges for medium-twin airframe and 1,000 flight hours per year.
Package B comprises the following mitigation measures: a mix of PC2 and PC3, partial implementation of HUMS and simulator training with some LOFT and partial use of enhanced quality and safety management systems (SMS) and operational controls (with elements of a structured SMS and helideck management). This represents twin-turbine helicopters operating in the mid-1990s in the North Sea and currently in most other OGP regions. Aircraft types generally are the S-76A++, Bell 212, AS365N, AS332L/L1 and S-61.
We projected that applying Package B mitigation measures to a layered system of defenses would result in an accident rate of 15.1 per million flight hours and a fatal accident rate of 5.3 per million flight hours
The corresponding operating cost estimate for the medium-twin helicopters in this group for future contracts is $4.6 million per year based on an annual standing charge per airframe and 1,000 flight hours per year.
Package C's mitigation measures include a retrofitted HUMS with associated effectiveness, PC2, full JAR Ops 3 quality assurance to JAR 145, effective SMS with safety case and helideck management to CAP 437 standards, partial implementation of design requirements to equivalent levels of safety beyond that claimed in the Type Certificate Data Sheets, full implementation of HOMP and of simulator training and installation of TCAS and EGPWS.
Implementation of Package C's measures is representative of most of one major oil operator's twin-turbine helo operations in the late 1990s and early 2000s and all North Sea ops with such aircraft as the S-76C+, Bell 412, AS332L2, and EC155.
We projected that applying these measures in a layered defense model would result in an accident rate of 6.19 per million flight hours and a fatal accident rate of 2.17 per million flight hours. The corresponding operating cost estimate for this group is $5.03 million per year.
Package D includes all the mitigation measures and is representative of new twin-turbines such as the AB139, S-92, EC225 and EC155B1.
Applying these mitigation measures to the defense model, we estimated, would result in an accident rate of 3.2 per million flight hours and a fatal accident rate of 1.1 per million flight hours.
The corresponding operating cost for the helicopters in this group is estimated to be $5.76 million per year, but it should be possible to reduce this figure with, among other things, smart procurement, improved utilization and sharing.
Package E is a prediction of the potential safety level that might be achieved in the next 10-15 years with derivative technology such as fly-by-wire, enhanced cockpit management and flaw/damage-tolerant design and more rigorous monitoring and operational controls. It assumes that FAR 29 design requirements have closed the gap with FAR 25 and that operations are being conducted to the more stringent requirements of FAR 121 or JAR-OPS 3/NPA 38 (or the equivalent). It also assumes HUMS analysis employs machine-learning techniques and has been extended into the rotor system and that all operations are conducted to PC1 to no smaller than 1D helidecks according to CAP 437.
Although it is difficult to predict actual costs, we assumed that a premium of at least 20 percent over the Package D annual costs would be conservative for an equivalent aircraft. We adjusted the effectiveness of the appropriate mitigation measures for the various enhancements upwards by 5-10 percent. Applying these upgraded mitigation measures to the layered defense model, we projected, would result in an accident rate of 2.34 per million flight hours and a fatal accident rate of 0.82 per million flight hours.
The corresponding operating cost for the medium helicopters in this group is projected to be $6.9 million per year based on an annual standing charge per airframe and 1,000 flight hours per year. As in Option D, it should be possible to reduce this figure with smart procurement, improved utilization, sharing etc.
The ALARP assessment plot on the next page shows that in the last decade, progress has been made in reducing accident rates through the implementation of some of the mitigation measures. Where there has been more extensive implementation, as in the North Sea, accidents rates have been cut further. Recent contract rates for Package B's older aircraft and Package C's new versions of older-design aircraft do not now show the significant difference that existed five years ago. The significant reduction in accident rates clearly justifies the added cost.
However, the aircraft in Package C represent the status quo and are unlikely to help us achieve an 80-percent accident-rate reduction. This can only be achieved with the introduction of new-design aircraft like those in Package D. Although they show a premium of up to 15 percent in annual cost for a medium, 12-seat helicopter, their use has the potential to reduce accident rates by 50 percent.
Package E is likely to increase costs another 15-20 percent and the mitigation assessment shows an improvement of about 25 percent in safety. This would indicate the effect of the law of diminishing returns and that the ALARP point, which coincides with the projected safety goal, is Package D.
Oil and gas companies contract for helicopters within an industry that has generally been under funded and, arguably, complacent in the past 15 years. Regulatory change has been insufficient, and regulators globally are not harmonized in their approach to helicopter operations and safety.
Whilst mitigation has been introduced with improvements in training, equipment, safety management and operational control, these measures cannot by themselves deliver our safety goal. The opportunity exists for the helicopter industry to learn the lessons from the airlines and the fixed-wing industry. Our study demonstrates what can be achieved. However, it is very unlikely that the International Helicopter Safety Symposium's goal can be achieved without the mitigation offered by all the projected further improvements, including introduction of new types. "Business as usual" is therefore not an acceptable option. The only option that will enable the long-term goal to be met would be to acquire new helicopters built to the latest design standard.
Mark Stevens was an engineer in the U.K. Royal Air Force. He left the RAF in 2005 with the rank of Group Captain and joined Shell Aircraft as director air safety and global projects.
As managing director of Shell Aircraft Ltd., Bob Sheffield is responsible for Shell's corporate fleet and for the standards for all aircraft used in support of Shell's operations worldwide. Shell operates or contracts for operation of about 100 aircraft that fly around 100,000 hr. each year in more than 30 countries.
The authors gratefully acknowledge the work of Peter Perry, Eric Clark, Cliff Edwards, and Grant Campbell, whose research paper on this subject was the foundation for this article.
Airline safety improvements:
1. Damage tolerant design; system redundancy
2. High fidelity flight simulators
3. Engine and vibration monitoring systems
4. Quality & Safety Management Systems to reduce human errors
5. Flight data monitoring programs (FDM)
6. Disciplined take-off and landing profiles (e.g. stabilised approach)
7. EGPWS/TAWS; TCAS/ACAS
Helicopter mitigation available now:
1. Late FAR 29 designs with glass cockpits
2. High fidelity flight simulators with LOFT & CRM
4. Quality & Safety Management Systems to reduce human errors
5. Helicopter Operations Monitoring Program
6. Performance Class1/2e & helideck operating profiles EGPWS/TAWS; TCAS/ACAS