ROSAS Safety Days 10./ Safety and Reliability in Civil Aviation

Transcription

1 ROSAS Safety Days 10./ Safety and Reliability in Civil Aviation AF Aviation Consulting Axel Firsching Kirschsteig Michendorf/Germany Tel: +49 (0) axel.firsching@web.de

2 Table of Contents 1. About Me 2. Some Basics 3. A Few Accident Photos 4. Safety Regulations 5. Safety Predictions 6. ETOPS/EDTO 7. Safety at the Edge - Hechi Airport (China) 8. Air Traffic in Africa 9. How We Do Not Want To Work In The Future (Film) 10. Discussion 2

3 1. About Me Axel Firsching, 59 years, married, two children Diploma in Mechanical and Aerospace Engineering from the Technical University of Munich In Aerospace Engineering since 33 years - Turbo Engines and their installations Specialist for Airworthiness and Aviation Safety since 30 years Founded in April 2017 International relations to all major aviation companies and the Certification Authorities Trainer for various aviation fields Good network into all industry associations (ASD, AIA, GAMA, AIAC, AIAB, BDLI, etc.) 3

4 2. Some Basics ICAO Annex 8 - Conversion into EU Legislation (Part-21) (Part-M + Part Part-66 + Part-147) 4

5 3. A Few Accident Photos (I) 5

6 3. A Few Accident Photos (II) Gulfstream GIV, Hanscom AFB, Bedford MA, USA - 31 May 2014 TO attempt with 7 aboard No rotation at V1, but further attempts to lift off TO aborted too late - A/C overran runway A/C lost undercarriage when hitting an antenna installation Fuel tanks penetrated and A/C caught fire - no survivors Both pilots extremely experienced (PIC hrs, SIC hrs) Accident caused by an engaged gust pitch lock (A/C parking system), preventing rotation at any speed Most probably pilots did not execute pre-flight check list HUMAN ERROR! 6

7 3. A Few Accident Photos (III) 7

8 3. A Few Accident Photos (IV) Airbus A , in-flight from La Guardia Airport NY, USA - 15 January crew, 150 pax Total loss of thrust in both engines after massive bird flock encounter Not enough altitude to reach any of the NY airports Decision taken to ditch into the Hudson river A/C stayed intact and swimming Only minor injuries Accident investigation concluded multiple bird ingestion into both engines well above certification requirements both in bird number and weight BAD LUCK! 8

9 3. A Few Accident Photos (V) 9

10 3. A Few Accident Photos (VI) Gulfstream G650 Flight Test, Roswell NM, USA - 02 April 2011 Flight test programme to simulate engine failure on TO with 4 aboard After various successful TO s on last attempt A/C right wing struck the ground and A/C burst in flames killing all 4 crew Accident investigation concluded a number of contributors to the accident: Wrong estimation of critical AOA in ground effect, hence wrong setting of stick shakers - pilots did not recognize problem before it was too late Too aggressive test planning - issue had been seen before, but not been properly investigated and avionics adjusted Full fuel aboard instead of water ballast to simulate max. TO weight HUMAN ERROR! 10

11 3. A Few Accident Photos (VII) 11

12 3. A Few Accident Photos (VIII) Boeing ER, London Heathrow, UK - 17 January crew, 136 pax No throttle response in both engines and uncommanded roll-back on final approach A/C landed short of runway - only minor injuries to crew and pax Accident investigation concluded that ice in the fuel system had blocked the fuel-oil heat exchangers leading to fuel starvation Issue had been seen on previous single engine events on other aircraft but never been understood and resolved New phenomenon affecting all aircraft in the world Major redesign on ALL RR engines introduced! 12

13 4. Safety Regulations (I) Overview of the Risk Assessment/ Management Methodology Risk Assessment Risk Management Estimation of the Failure Rate for the service event Risk Estimation of the Failure Effect (Cat or Haz) P < 10-9 (Cat) P < 10-8 (Haz) Yes No Calculation of the Reaction Time Root Cause Analysis Reliability Prediction (Weibull Analyis), Time dependency? Service Data FTA (Multiple Failures) FMECA (Single Failures) Event Tree Analysis, if possible event sequences with different categories Acceptable Risk EASA AMC & GM for Part 21 Subpart A FAA Continued Airworthiness Assessment AC

14 4. Safety Regulations (II) Acceptable Regulatory Risk (I) Dual Engine Event = potentially Catastrophic (Cat) The requirements are: Risk must be < 1.0E-9 per Aircraft Flight Hour (AFH) If this is not met, a corrective action is required such that: No aircraft must carry an occurrence rate greater than 2E-06 per AFH The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-04. The predicted number of events over the period of the campaign must not exceed 0.1. The worst counts. 14

15 4. Safety Regulations (III) Acceptable Regulatory Risk (II) Single Engine Event = potentially Hazardous (Haz) The requirements are: Risk must be < 1.0E-8 per Aircraft Flight Hour (AFH) If this is not met, a corrective action is required such that: No aircraft must carry an occurrence rate greater than 2E-05 per AFH The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-03. The predicted number of events over the period of the campaign must not exceed 0.5. The worst counts. 15

16 4. Safety Regulations (IV) Acceptable Company Risk BUT THERE IS SOMETHING ELSE - Company Policies (typical example): Dual Engine Event = potentially Catastrophic (Cat) As before - A/C manufacturer needs to decide on his acceptability level Single Engine Event = potentially Hazardous (Haz) The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.0E-03. The predicted number of events over the period of the campaign must not exceed 0.2. In both cases: Reaction Time cap 10 calendar years! 16

17 5. Safety Predictions (I) Flyforward Modelling (I) NOW +3 MONTHS 3.8 cycles per day 2883 cycles 7587 hours 4699 cycles hours 2.1 hours per cycle 3225 cycles hours 5041 cycles hours Future age of the engine can be estimated using: Operator utilisation (average cycles per day) Operator stage length (average hours per flight) From the future age we can calculate: Hazard rate in 3 months time Probability of failing in the next 3 months 17

18 5. Safety Predictions (II) Flyforward Modelling (II) Now +3 MONTHS This can be repeated for the whole fleet to calculate Average hazard Max hazard Expected number of failures 18

19 5. Safety Predictions (III) Flyforward Modelling (III) Repeat for 6 months, 9 months, NOW +3 MONTHS +6 MONTHS FUTURE A. Firsching/Dr. C. Ludena Rolls-Royce Deutschland

20 5. Safety Predictions (IV) Flyforward Example (I) 2.0E E E E E E-03 Accured risk (per engine) 1.4E E E E E E E E E E E E E E-04 Reaction Time? September E E Jan Dec Dec Dec Date 20

21 5. Safety Predictions (V) Flyforward Example (II) Failures!!! No of Failures May 2017 Reaction Time November Jan Dec Dec Dec Date 21

22 5. Safety Predictions (VI) Fleet Example (I) 1,E-05 DIFSD Rate 1,E-06 Ultimate Limit for Grounding 2E-06/AFH 1,E-07 1,E-08 DIFSD Rate 1,E-09 Certification Requirement 1E-09/AFH 1,E-10 1,E-11 1,E-12 Mean DIFSD Rate Max DIFSD Rate 1,E Apr Mai Jul Aug Sep Okt Nov Dez Jan Feb 11 Calendar Time 22

23 5. Safety Predictions (VI) Fleet Example (II) 18 Single Events Prediction Events Dez-08 2-Jan-09 1-Feb-09 3-Mrz-09 2-Apr-09 2-Mai-09 1-Jun-09 1-Jul Jul-09 Calendar Time 30-Aug Sep Okt Nov Dez Jan Feb Mrz Apr Mai Jun-10 23

24 6. ETOPS/EDTO (I) ETOPS = Extended Twin-Engine Operations Joke: ETOPS = "Engines Turn or Passengers Swim" EDTO = Extended Diversion Times Operations (official ICAO language since 2012) ETOPS for twin-engine A/C only EDTO for all aircraft ETOPS/EDTO = maximum permitted diversion time from next landing point in case of an engine failure "Normal" permitted diversion time 90 min (EASA all A/C) respectively 60 min (FAA twins) and 180 min (FAA multi-engine) Current maximum certified diversion time 370 min (A350 XWB) 24

25 8. ETOPS/EDTO (II)

26 6. ETOPS/EDTO (III) ETOPS/EDTO is a system certification, i.e. Engines, APUs and A/C need to meet certain reliability levels, which requires frequent installation of redundancies - partially demonstrated by design ("EDTO out of the box") and partially by proven actual reliability Sufficient fuel reserves to allow for extended operation at OEI Pilot and ground crew training for appropriate flight planning including wind and weather considerations Maintenance crew procedures and training to reduce human error Suitability of assumed diversion airports Demonstration and reporting of actual reliability May be withdrawn on airline level if required reliability figures cannot be demonstrated anymore Boeing dream of closing the south polar gap and any wind/weather dependencies => EDTO 540 min!!! 26

27 6. ETOPS/EDTO (IV) - Spitsbergen 27

28 6. ETOPS/EDTO (V) Boeing 787 Cargo Fire Suppression HRD = High Rate Discharge LRD = Low Rate Discharge 28

29 7.Safety at the Edge - Hechi Airport (China) 29

30 8.Air Traffic in Africa 30

31 9.How We Do Not Want To Work In The Future (Film) 31

32 Thank you! 32