1. “ Improving Helicopter Safety ” Roy Fox, Chief of Flight Safety Bell Helicopter International Helicopter Safety Symposium 2005 Montreal, Quebec, Canada September 26-29, 2005

2. 2 Start of Helicopter Industry Early 1900s –Europe: several helicopter concepts flown. –Many lessons learned. –USA: helicopter production lines »Sikorsky R-4 for US Army Air Corp (1944) »Bell 47 for civil operators (1946)

3. 3 Model 47 First 50 Years

4. 4 Causes of Model 47 Accidents

5. 5 Improvements: 1960s + Turbine engine introduction Construction materials –Wood –Steel tubing –Aluminum/steel –Honeycomb structures –Fiberglass –Carbon Fibers

6. 6 Bell Civil Turbine Accident Causes Worldwide 1994-2003

7. 7 Three Safety Protection Levels 1.Design for no failures. 2.Accept failure and mitigate: Backup/redundant systems Identify impending failures (HUMS) Autorotation capabilities 3.Crash survival protection: Seats/restraints Post fire protection

8. 8 Airworthiness Responsibilities Civil Certification Agency & Certification Rules Engine manufacturer certifies the engine to FAA Part 33. Receives Type Certificate (TC). Helicopter manufacturer certifies the rest of the aircraft (other than the TC engine(s)). Receives TC. –Part 27 for standard helicopters less than 6,000 lb. (now 7,000 lb.) –Part 29 for transport helicopters for those heavier than Part 27. TC Holder is responsible to maintain fielded fleet for continuing certification (e.g. helicopter manufacturer has non-engine airworthiness (AW) components).

9. 9 System Safety: Management of Risk Military origin in late 1950s USAF Ballistic Missile Division. New approach to look at aircraft as a system (all components, subsystems, and crew, etc.) Everything works as a system. Goal is to identify/correct hazards early in design life and continue risk management through system life. Risk is a function of hazard likelihood combined with hazard severity. In last few years, civil has adopted System Safety. Past certification, civil is expanding into operational aspect - Safety Management System (SMS). Needs to be supported. All are systematic processes to manage RISK.

10. 10 Risk Assessment Matrix

11. 11 Crash Survival Requirements Maintain a livable volume. Restrain the occupant. Keep crash loads on occupant within human non-injury tolerance. Provide time/means of escape, primarily the post crash fire threat.

12. 12 USArmy Leader in Crashworthiness Research/Application 1950s/60s Military research in many aspects of crash survival (crash kinematics/loads, human tolerance, crash environment, and post crash fires) Developed Crashworthy Fuel System (CWFS) –First CWFS in UH-1H May 1970 –Other Army helicopters (production and fielded) then got CWFS. Crash Survival Design Guide TR 89-22 and Mil-Std- 1290 New generation Army helicopters (UH60 & AH64) were first designed to most of these requirements. Subsequent military helicopters and tiltrotor aircraft also designed to these new requirements.

13. 13 Crash Survival in Civil Helicopter Civil application came 10 years later –222 certificated and fielded in 1980 »Crash Resistant Fuel System (CRFS) »Shoulder Harness for every occupant »Energy Attenuating (EA) seat for each occupant FAA Rule Changes to new Crash Safety levels (1989 to 1994) –Amd 27-25 and 29-29 EA seats for new TC applicants. –Amd 27-28 and 29-32 Shoulder harness all seats on helicopters produced after 1994. –Amd 27-30 and 29-35 Crash Resistant Fuel System.

14. 14 Where to Concentrate Efforts for Safety Improvements?

15. 15 20-years Bell Civil Turbine Worldwide (1985-2004, 50 million hours)

16. 16 Fewer 206 Airworthiness Failures (51.6 million hours)

17. 17 Human Error Root Cause Study of Bell Worldwide (1986): Improved Judgment Needed Common element involved in all root causes was bad judgment. 1987 Implemented 3 different approaches to teach judgment (Aeronautical Decision Making) to pilots/management. 1.Individual pilot: Cockpit Emergency Procedures Expert Trainer (CEPET). PC Dos-based software to teach judgment. Situational decision tree based on actual accident scenarios and Bell pilot staff/engineering knowledge. Also tested ability to identify symptoms and subsequent actions. »206 Jet Ranger »206 Long Ranger »412

18. 18 More Bell Actions (no cost to customer) 2. Concentrate on weekly 206 pilot ground school students of CTA. 2-hour Safety briefing included, measuring risk, crash survival, human error studies, and judgment training. 3. Established HELIPROPS Program (Helicopter Professional Pilots Safety) to give Safety Briefs at Customer’s meetings, FAA Safety Seminars, etc. Speakers: R. Fox (Safety Engineering) L. Doughty (Training Pilot) J. Szymanski (HELIPROPS Manager) 4. Publish “Human AD” magazine with free worldwide mailing. Subjects are human error and situations for all makes of helicopters. (Copies available on Bell website)

19. 19 Spreading the Word Very positive responses in first year (1987) Trained two other turbine-powered helicopter manufacturer in our approach. Made HELIPROPS an Industry program at Helicopter Association International for all to use. Did HELIPROPS actually work?

20. 20 Fatalities in U.S.

21. 21 Concentrated Safety Effort Effects

22. 22 Statistically Significant of Changes in Fatalities Was there a statistical significant change in fatalities for 7-year periods before (1980- 1986) and after Heliprops (1987-1993)? –Used Student T, 1-tailed at 0.05 test for annual number of fatalities. Gives 95% assurance that averages are or are not significantly different. –Said differently, 95% of the time, the numbers of fatalities will be different and not due to random nature of rare events.

23. 23 Statistical Significance of HELIPROPS Effects Metrics US Registered 206s Accidents (All Causes) Average for 1980-1986 Average for 1987-1993 Difference is Statistical Significant to 0.05 level (95%) Number of Accidents /year 53.4333.43YES Fatalities/100,000 flight hour 2.331.60YES Accidents/100,000 flight hours 5.203.76YES NOTE: Table 2 “Number of Fatalities/year” of paper in Error. Should be “Number of Accidents/year”. Send Email to Rfox@bellhelicopter.textron.comRfox@bellhelicopter.textron.com for corrected copy. Non-206 helicopters (e.g. all US registered helicopters except 206) Did NOT show Statistical Significance in differences.

24. 24 What is Safety? TSI Rotorcraft Safety: Risk Webster’s Dictionary defines “Safety” as the condition of freedom from harm, loss, or injury. Note that dictionary does not relate safety to not having an accident. Safety is the Management of Risk. There is no absolute safety in aviation. If you minimize the risks to the occupants, you have improved their safety.. © Bell Helicopter 2005

25. 25 There is NO Absolute Safety, ONLY Shades of Gray Risk to Occupant Risk to Aircraft Destroyed No Damage No InjuryDeath Key is to minimize the final risk to the occupant. Risk of Fatal Injury (RFI) = (Number of fatalities/number onboard exposed) X (accidents/hours of exposure)

26. 26 Occupant Risk and Aircraft Risk in US Registered Helicopters

27. 27 National Aviation Safety Goal: 80% Reduction White House Commission on Aviation Safety Recommendation 1.1 “Government and industry should establish a national goal to reduce the aviation fatal accident rate by a factor of five within 10 years sand conduct safety research to support that goal.” Is achievement of this National Goal possible?

28. 28 Helicopter Study to Identify Safety Investment Areas (SIA) Groups (US Registered) Flight Hours (1990-1994) AccidentsFatal Accidents Piston2,361,52648666 Turbine7,990,74729477 Military Surplus UH-1 171,049244 Combined Fleet 10,523,322804147

29. 29 Combined Fleet Risks (rates not mutually exclusive) SIA ProblemsAccidents/ 100,000 flt hr Fatal Accidents/ 100,000 flt hr Risk of Fatal Injury/ 100,000 occ hr 1. Obstacle strike0.890.310.28 2. Loss of A/C situational awareness2.490.590.57 3. Real time aircraft performance exceeded 1.560.130.08 4. Loss of situational awareness internal to aircraft 1.430.150.11 5. Loss of visibility0.470.24 6. Inability to respond in short duration emergency 0.380.040.02 7. Aircraft component failure1.950.300.25 8. Maintenance error0.760.100.07 9. Cockpit action5.851.111.04

30. 30 SIA Solutions Sequencing to Achieve 80% With Existing Helicopter Fleets SIA Num. SIA SolutionAccidents/ 100,000 flt hr Fatal Accidents/ 100,000 flt hr Risk of Fatal Injury/ 100,000 occ hr Present risk rates. Assuming 100% implementation: 7.641.401.23 1,2Add proximity detection alerting systems (live & maps) 5.070.760.65 1,2,3, 4,7 Add HUMS, aircraft health, real time performance, & pilot aids 2.140.390.37 1,2,3, 4,7,9 Add cockpit information recorder (image, area mic, GPS, & crash survivable recorder) 0.360.060.10 10-year future goal/target (80% less) 1.530.260.25 YES – 80% is achievable

31. 31 Safety Investments for Future

32. 32 Roadblocks to Significant Safety Improvements 1.No exposure data (e.g. flight hours flown by a specific model) –HAI working with FAA re Flight Hour reporting similar to Bell individual aircraft monitoring. –Cannot actually measure risk without accurate flight hours. 2.Unknown actions within cockpit presently labeled “human error”. We don’t know. If you don’t understand it - You cannot fix it.

33. 33 FAA/HAI Effort to Develop More Accurate Flight Hours Bell tracks individual aircraft by serial number for flight hours HAI starting using same approach under FAA R&D to accumulate individual hours. Hours then totaled by model

34. 34 CIR is Key to Understanding Actual Human Error A means is needed to document what occurs (and when) in cockpit –Instrument/caution panel –Pilot control motions –A common reference time –Cockpit ambient noise A crash-survivable Cockpit Information Recorder (CIR) is needed to document cockpit events

35. 35 Need a Giant Step Forward in Understanding Cockpit Actions Digital camera for sequential snapshot images of: –Instrument panel –Caution panel –Pilot cyclic stick, collective stick, and pedals Area microphone GPS (Global Positioning System) Crash-survivable recorder

36. 36 COCKPIT AREA RECORDED

37. 37 CIR WIRELESS – THE FUTURE Once CIR is developed/fielded, a wireless feature via satellite could be added. (Similar to GM’s OnStar car system) Provide flight following notification of accident (alert) to operator, local SAR, FAA Provide accident location (reduces Search & Rescue time and some lives lost while waiting). Some aircraft never found. Further compressed/pre-analyzed data packets to minimize transmission cost. Send to satellite to landline to Internet to specific operator and the aircraft manufacturer who would check mission profiles, adjust as needed. Computer programmed for last known GPS when data transmittal interrupted (and not reestablished), determine if normal action or crash If crash – PC automatically makes alert calls

38. 38 Automatic Alert Long/Lat Operator Manufacturer

39. 39 SUMMARY Safety in some helicopters show slight improvements. BUT Civil Helicopter Industry(as a whole), Risks are NOT IMPROVING There is many causes of accidents – most of which some kind of human problem but no details known. There is no ONE Solution. Airworthiness failures are rare and processes are working. SMS is new systematic organizational safety approach. Need flight hours to measure risk. 80% Risk Reduction Goal is possible for existing fleets Understanding Human aspects is the area of Safety Challenge. Significant reductions in accidents requires we document/understand cockpit information. Cockpit Information Recorder has potential to allows reaching next safety plateau (airline safety) Cannot Fix What You Do Not Understand