ROSAS Safety Days 10./11.10.2017 Safety and Reliability in Civil Aviation AF Aviation Consulting Axel Firsching Kirschsteig 5 14552 Michendorf/Germany Tel: +49 (0) 171 611 33 61 E-Mail: axel.firsching@web.de
Table of Contents 1. About Me 2. Some Basics 3. A Few Accident Photos 4. Safety Regulations 5. Safety Predictions 6. ETOPS/EDTO 7. Safety at the Edge - Hechi Airport (China) 8. Air Traffic in Africa 9. How We Do Not Want To Work In The Future (Film) 10. Discussion 2
1. About Me Axel Firsching, 59 years, married, two children Diploma in Mechanical and Aerospace Engineering from the Technical University of Munich In Aerospace Engineering since 33 years - Turbo Engines and their installations Specialist for Airworthiness and Aviation Safety since 30 years Founded in April 2017 International relations to all major aviation companies and the Certification Authorities Trainer for various aviation fields Good network into all industry associations (ASD, AIA, GAMA, AIAC, AIAB, BDLI, etc.) 3
2. Some Basics ICAO Annex 8 - Conversion into EU Legislation (Part-21) (Part-M + Part-145 + Part-66 + Part-147) 4
3. A Few Accident Photos (I) 5
3. A Few Accident Photos (II) Gulfstream GIV, Hanscom AFB, Bedford MA, USA - 31 May 2014 TO attempt with 7 aboard No rotation at V1, but further attempts to lift off TO aborted too late - A/C overran runway A/C lost undercarriage when hitting an antenna installation Fuel tanks penetrated and A/C caught fire - no survivors Both pilots extremely experienced (PIC 11.250 hrs, SIC 18.500+ hrs) Accident caused by an engaged gust pitch lock (A/C parking system), preventing rotation at any speed Most probably pilots did not execute pre-flight check list HUMAN ERROR! 6
3. A Few Accident Photos (III) 7
3. A Few Accident Photos (IV) Airbus A320-214, in-flight from La Guardia Airport NY, USA - 15 January 2009 5 crew, 150 pax Total loss of thrust in both engines after massive bird flock encounter Not enough altitude to reach any of the NY airports Decision taken to ditch into the Hudson river A/C stayed intact and swimming Only minor injuries Accident investigation concluded multiple bird ingestion into both engines well above certification requirements both in bird number and weight BAD LUCK! 8
3. A Few Accident Photos (V) 9
3. A Few Accident Photos (VI) Gulfstream G650 Flight Test, Roswell NM, USA - 02 April 2011 Flight test programme to simulate engine failure on TO with 4 aboard After various successful TO s on last attempt A/C right wing struck the ground and A/C burst in flames killing all 4 crew Accident investigation concluded a number of contributors to the accident: Wrong estimation of critical AOA in ground effect, hence wrong setting of stick shakers - pilots did not recognize problem before it was too late Too aggressive test planning - issue had been seen before, but not been properly investigated and avionics adjusted Full fuel aboard instead of water ballast to simulate max. TO weight HUMAN ERROR! 10
3. A Few Accident Photos (VII) 11
3. A Few Accident Photos (VIII) Boeing 777-236ER, London Heathrow, UK - 17 January 2008 16 crew, 136 pax No throttle response in both engines and uncommanded roll-back on final approach A/C landed short of runway - only minor injuries to crew and pax Accident investigation concluded that ice in the fuel system had blocked the fuel-oil heat exchangers leading to fuel starvation Issue had been seen on previous single engine events on other aircraft but never been understood and resolved New phenomenon affecting all aircraft in the world Major redesign on ALL RR engines introduced! 12
4. Safety Regulations (I) Overview of the Risk Assessment/ Management Methodology Risk Assessment Risk Management Estimation of the Failure Rate for the service event Risk Estimation of the Failure Effect (Cat or Haz) P < 10-9 (Cat) P < 10-8 (Haz) Yes No Calculation of the Reaction Time Root Cause Analysis Reliability Prediction (Weibull Analyis), Time dependency? Service Data FTA (Multiple Failures) FMECA (Single Failures) Event Tree Analysis, if possible event sequences with different categories Acceptable Risk EASA AMC & GM for Part 21 Subpart A FAA Continued Airworthiness Assessment AC39-8 13
4. Safety Regulations (II) Acceptable Regulatory Risk (I) Dual Engine Event = potentially Catastrophic (Cat) The requirements are: Risk must be < 1.0E-9 per Aircraft Flight Hour (AFH) If this is not met, a corrective action is required such that: No aircraft must carry an occurrence rate greater than 2E-06 per AFH The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-04. The predicted number of events over the period of the campaign must not exceed 0.1. The worst counts. 14
4. Safety Regulations (III) Acceptable Regulatory Risk (II) Single Engine Event = potentially Hazardous (Haz) The requirements are: Risk must be < 1.0E-8 per Aircraft Flight Hour (AFH) If this is not met, a corrective action is required such that: No aircraft must carry an occurrence rate greater than 2E-05 per AFH The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-03. The predicted number of events over the period of the campaign must not exceed 0.5. The worst counts. 15
4. Safety Regulations (IV) Acceptable Company Risk BUT THERE IS SOMETHING ELSE - Company Policies (typical example): Dual Engine Event = potentially Catastrophic (Cat) As before - A/C manufacturer needs to decide on his acceptability level Single Engine Event = potentially Hazardous (Haz) The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.0E-03. The predicted number of events over the period of the campaign must not exceed 0.2. In both cases: Reaction Time cap 10 calendar years! 16
5. Safety Predictions (I) Flyforward Modelling (I) NOW +3 MONTHS 3.8 cycles per day 2883 cycles 7587 hours 4699 cycles 12181 hours 2.1 hours per cycle 3225 cycles 8305.2 hours 5041 cycles 12899.2 hours Future age of the engine can be estimated using: Operator utilisation (average cycles per day) Operator stage length (average hours per flight) From the future age we can calculate: Hazard rate in 3 months time Probability of failing in the next 3 months 17
5. Safety Predictions (II) Flyforward Modelling (II) Now +3 MONTHS This can be repeated for the whole fleet to calculate Average hazard Max hazard Expected number of failures 18
5. Safety Predictions (III) Flyforward Modelling (III) Repeat for 6 months, 9 months, NOW +3 MONTHS +6 MONTHS FUTURE A. Firsching/Dr. C. Ludena Rolls-Royce Deutschland 20.06.2013 19
5. Safety Predictions (IV) Flyforward Example (I) 2.0E-03 3.0E-03 1.8E-03 2.7E-03 1.6E-03 2.4E-03 Accured risk (per engine) 1.4E-03 2.1E-03 1.2E-03 1.8E-03 1.0E-03 1.5E-03 8.0E-04 1.2E-03 6.0E-04 9.0E-04 4.0E-04 6.0E-04 2.0E-04 3.0E-04 Reaction Time? September 2018 0.0E+00 0.0E-00 01 1-Jan-04 2016 31-Dec-04 2016 31-Dec-05 2017 31-Dec-06 2018 Date 20
5. Safety Predictions (V) Flyforward Example (II) 2 1.8 1.6 1.4 1.5 Failures!!! No of Failures 1.2 1 0.8 0.6 0.4 0.2 May 2017 Reaction Time November 2017 0 01 1-Jan-04 2016 31-Dec-04 2016 31-Dec-05 2017 31-Dec-06 2018 Date 21
5. Safety Predictions (VI) Fleet Example (I) 1,E-05 DIFSD Rate 1,E-06 Ultimate Limit for Grounding 2E-06/AFH 1,E-07 1,E-08 DIFSD Rate 1,E-09 Certification Requirement 1E-09/AFH 1,E-10 1,E-11 1,E-12 Mean DIFSD Rate Max DIFSD Rate 1,E-13 30. Apr 10 31. Mai 10 01. Jul 10 01. Aug 10 01. Sep 10 02. Okt 10 02. Nov 10 03. Dez 10 03. Jan 11 03. Feb 11 Calendar Time 22
5. Safety Predictions (VI) Fleet Example (II) 18 Single Events Prediction 17 16 15 14 13 12 11 Events 10 9 8 7 6 5 4 3 2 1 0 3-Dez-08 2-Jan-09 1-Feb-09 3-Mrz-09 2-Apr-09 2-Mai-09 1-Jun-09 1-Jul-09 31-Jul-09 Calendar Time 30-Aug-09 29-Sep-09 29-Okt-09 28-Nov-09 28-Dez-09 27-Jan-10 26-Feb-10 28-Mrz-10 27-Apr-10 27-Mai-10 26-Jun-10 23
6. ETOPS/EDTO (I) ETOPS = Extended Twin-Engine Operations Joke: ETOPS = "Engines Turn or Passengers Swim" EDTO = Extended Diversion Times Operations (official ICAO language since 2012) ETOPS for twin-engine A/C only EDTO for all aircraft ETOPS/EDTO = maximum permitted diversion time from next landing point in case of an engine failure "Normal" permitted diversion time 90 min (EASA all A/C) respectively 60 min (FAA twins) and 180 min (FAA multi-engine) Current maximum certified diversion time 370 min (A350 XWB) 24
8. ETOPS/EDTO (II) 370 25
6. ETOPS/EDTO (III) ETOPS/EDTO is a system certification, i.e. Engines, APUs and A/C need to meet certain reliability levels, which requires frequent installation of redundancies - partially demonstrated by design ("EDTO out of the box") and partially by proven actual reliability Sufficient fuel reserves to allow for extended operation at OEI Pilot and ground crew training for appropriate flight planning including wind and weather considerations Maintenance crew procedures and training to reduce human error Suitability of assumed diversion airports Demonstration and reporting of actual reliability May be withdrawn on airline level if required reliability figures cannot be demonstrated anymore Boeing dream of closing the south polar gap and any wind/weather dependencies => EDTO 540 min!!! 26
6. ETOPS/EDTO (IV) - Spitsbergen 27
6. ETOPS/EDTO (V) Boeing 787 Cargo Fire Suppression HRD = High Rate Discharge LRD = Low Rate Discharge 28
7.Safety at the Edge - Hechi Airport (China) 29
8.Air Traffic in Africa 30
9.How We Do Not Want To Work In The Future (Film) 31
Thank you! 32