rosas safety days 10./11.10.2017 safety and reliability in...

ROSAS Safety Days10./11.10.2017

Safety and Reliabilityin Civil Aviation

AF Aviation ConsultingAxel FirschingKirschsteig 514552 Michendorf/GermanyTel: +49 (0) 171 611 33 61E-Mail: [email protected]

2AF Aviation Consulting, Axel Firsching, Kirschsteig 5, 14552 Michendorf, Germany, Tel: +49 (0) 171 611 33 61, E-Mail: [email protected]

Table of Contents

1. About Me

2. Some Basics

3. A Few Accident Photos

4. Safety Regulations

5. Safety Predictions

6. ETOPS/EDTO

7. Safety at the Edge - Hechi Airport (China)

8. Air Traffic in Africa

9. How We Do Not Want To Work In The Future (Film)

10. Discussion


Axel Firsching, 59 years, married, two children

Diploma in Mechanical and Aerospace Engineering from the Technical University of Munich

In Aerospace Engineering since 33 years - Turbo Engines and their installations

Specialist for Airworthiness and Aviation Safety since 30 years

Founded in April 2017

International relations to all major aviation companies and the Certification Authorities

Trainer for various aviation fields

Good network into all industry associations (ASD, AIA, GAMA, AIAC, AIAB, BDLI, etc.)

1. About Me


2. Some Basics

ICAO Annex 8 - Conversion into EU Legislation

(Part-21) (Part-M + Part-145 + Part-66 + Part-147)


3. A Few Accident Photos (I)


Gulfstream GIV, Hanscom AFB, Bedford MA, USA - 31 May 2014

TO attempt with 7 aboard

No rotation at V1, but further attempts to lift off

TO aborted too late - A/C overran runway

A/C lost undercarriage when hitting an antenna installation

Fuel tanks penetrated and A/C caught fire - no survivors

Both pilots extremely experienced (PIC 11.250 hrs, SIC 18.500+ hrs)

Accident caused by an engaged gust pitch lock (A/C parking system), preventing rotation at any speed

Most probably pilots did not execute pre-flight check list

HUMAN ERROR!

3. A Few Accident Photos (II)


3. A Few Accident Photos (III)


Airbus A320-214, in-flight from La Guardia Airport NY, USA - 15 January 2009

5 crew, 150 pax

Total loss of thrust in both engines after massive bird flock encounter

Not enough altitude to reach any of the NY airports

Decision taken to ditch into the Hudson river

A/C stayed intact and swimming

Only minor injuries

Accident investigation concluded multiple bird ingestion into both engines well above certification requirements both in bird number and weight

BAD LUCK!

3. A Few Accident Photos (IV)


3. A Few Accident Photos (V)


Gulfstream G650 Flight Test, Roswell NM, USA - 02 April 2011

Flight test programme to simulate engine failure on TO with 4 aboard

After various successful TO’s on last attempt A/C right wing struck the ground and A/C burst in flames killing all 4 crew

Accident investigation concluded a number of contributors to the accident:

Wrong estimation of critical AOA in ground effect, hence wrong setting of stick shakers - pilots did not recognize problem before it was too late

Too aggressive test planning - issue had been seen before, but not been properly investigated and avionics adjusted

Full fuel aboard instead of water ballast to simulate max. TO weight

HUMAN ERROR!

3. A Few Accident Photos (VI)


3. A Few Accident Photos (VII)


Boeing 777-236ER, London Heathrow, UK - 17 January 2008

16 crew, 136 pax

No throttle response in both engines and uncommanded roll-back on final approach

A/C landed short of runway - only minor injuries to crew and pax

Accident investigation concluded that ice in the fuel system had blocked the fuel-oil heat exchangers leading to fuel starvation

Issue had been seen on previous single engine events on other aircraft but never been understood and resolved

New phenomenon affecting all aircraft in the world

Major redesign on ALL RR engines introduced!

3. A Few Accident Photos (VIII)


4. Safety Regulations (I)

Risk Assessment Risk Management

Estimation of the Failure Rate for the

service event

Root Cause Analysis Reliability Prediction

(Weibull Analyis),Time dependency?

Service Data

Risk Estimation of the Failure

Effect(Cat or Haz)

FTA (Multiple Failures) FMECA (Single Failures) Event Tree Analysis, if

possible eventsequences with differentcategories

Calculation of the Reaction

Time

EASA AMC & GM for Part21 Subpart A

FAA ContinuedAirworthinessAssessment AC39-8

P < 10-9 (Cat)P < 10-8 (Haz)

No

Acceptable Risk

Yes

Overview of the Risk Assessment/ Management Methodology


4. Safety Regulations (II)

Acceptable Regulatory Risk (I)

Dual Engine Event = potentially Catastrophic (Cat)

The requirements are: Risk must be < 1.0E-9 per Aircraft Flight Hour (AFH)

If this is not met, a corrective action is required such that:

No aircraft must carry an occurrence rate greater than 2E-06 per AFH

The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-04.

The predicted number of events over the period of the campaign must not exceed 0.1.

The worst counts.


4. Safety Regulations (III)

Acceptable Regulatory Risk (II)

Single Engine Event = potentially Hazardous (Haz)

The requirements are: Risk must be < 1.0E-8 per Aircraft Flight Hour (AFH)

If this is not met, a corrective action is required such that:

No aircraft must carry an occurrence rate greater than 2E-05 per AFH

The fleet mean cumulative risk of an event over the period of the campaign must not exceed 1.5E-03.


The worst counts.


4. Safety Regulations (IV)

Acceptable Company Risk

BUT THERE IS SOMETHING ELSE - Company Policies (typical example):

Dual Engine Event = potentially Catastrophic (Cat) As before - A/C manufacturer needs to decide on his acceptability level

Single Engine Event = potentially Hazardous (Haz) The fleet mean cumulative risk of an event over the period of the

campaign must not exceed 1.0E-03.


In both cases: Reaction Time cap 10 calendar years!


5. Safety Predictions (I)

Flyforward Modelling (I)

2883 cycles7587 hours

4699 cycles12181 hours

3225 cycles8305.2 hours

5041 cycles12899.2 hours

3.8 cycles per day

2.1 hours per cycle

NOW +3 MONTHS

Future age of the engine can be estimated using: Operator utilisation (average cycles per day)

Operator stage length (average hours per flight)

From the future age we can calculate: Hazard rate in 3 months time

Probability of failing in the next 3 months


5. Safety Predictions (II)

Flyforward Modelling (II)

This can be repeated for the whole fleet to calculate Average hazard Max hazard Expected number of failures

……

……

Now +3 MONTHS


5. Safety Predictions (III)

Flyforward Modelling (III)

A. Firsching/Dr. C. Ludena – Rolls-Royce Deutschland 20.06.2013

Repeat for 6 months, 9 months, …

NOW +3 MONTHS

……

……

……

……

……

……

+6 MONTHS FUTURE


5. Safety Predictions (IV)

Flyforward Example (I)

0.0E+00

2.0E-04

4.0E-04

6.0E-04

8.0E-04

1.0E-03

1.2E-03

1.4E-03

1.6E-03

1.8E-03

2.0E-03

1-Jan-04 31-Dec-04 31-Dec-05 31-Dec-06

Date

Accu

red

risk

(per

eng

ine)

Reaction Time?

September 20183.0E-04

6.0E-04

9.0E-04

1.2E-03

1.5E-03

1.8E-03

2.1E-03

2.4E-03

2.7E-03

3.0E-03

0.0E-00

01 Jan 2016 31 Dec 2016 31 Dec 2017 31 Dec 2018


5. Safety Predictions (V)

Flyforward Example (II)

0

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

1-Jan-04 31-Dec-04 31-Dec-05 31-Dec-06

Date

No

of F

ailu

res

1.5 Failures !!!

May 2017

Reaction Time

November 2017

01 Jan 2016 31 Dec 2016 31 Dec 2017 31 Dec 2018


5. Safety Predictions (VI)

Fleet Example (I)

DIFSD Rate

1,E-13

1,E-12

1,E-11

1,E-10

1,E-09

1,E-08

1,E-07

1,E-06

1,E-05

30. Apr 10 31. Mai 10 01. Jul 10 01. Aug 10 01. Sep 10 02. Okt 10 02. Nov 10 03. Dez 10 03. Jan 11 03. Feb 11Calendar Time

DIF

SD R

ate

Mean DIFSD Rate Max DIFSD Rate

Certification Requirement 1E-09/AFH

Ultimate Limit for Grounding 2E-06/AFH


5. Safety Predictions (VI)

Fleet Example (II)

Single Events Prediction

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

3-Dez

-082-J

an-09

1-Feb

-093-M

rz-09

2-Apr-

092-M

ai-09

1-Jun

-09

1-Jul-

0931

-Jul-0

930

-Aug

-0929

-Sep

-0929

-Okt-

0928

-Nov

-0928

-Dez

-0927

-Jan-1

026

-Feb-10

28-M

rz-10

27-A

pr-10

27-M

ai-10

26-Ju

n-10

Calendar Time

Even

ts


ETOPS = Extended Twin-Engine Operations

Joke: ETOPS = "Engines Turn or Passengers Swim"

EDTO = Extended Diversion Times Operations (official ICAO language since 2012)

ETOPS for twin-engine A/C only

EDTO for all aircraft

ETOPS/EDTO = maximum permitted diversion time from next landing point in case of an engine failure

"Normal" permitted diversion time 90 min (EASA all A/C) respectively 60 min (FAA twins) and 180 min (FAA multi-engine)

Current maximum certified diversion time 370 min (A350 XWB)

6. ETOPS/EDTO (I)


8. ETOPS/EDTO (II)

370


ETOPS/EDTO is a system certification, i.e.

Engines, APUs and A/C need to meet certain reliability levels, which requires frequent installation of redundancies - partially demonstrated by design ("EDTO out of the box") and partially by proven actual reliability

Sufficient fuel reserves to allow for extended operation at OEI

Pilot and ground crew training for appropriate flight planning including wind and weather considerations

Maintenance crew procedures and training to reduce human error

Suitability of assumed diversion airports

Demonstration and reporting of actual reliability

May be withdrawn on airline level if required reliability figures cannot be demonstrated anymore

Boeing dream of closing the south polar gap and any wind/weather dependencies => EDTO 540 min!!!

6. ETOPS/EDTO (III)


6. ETOPS/EDTO (IV)

- Spitsbergen


6. ETOPS/EDTO (V)

HRD = High Rate Discharge LRD = Low Rate Discharge

Boeing 787 Cargo Fire Suppression


7.Safety at the Edge - HechiAirport (China)


8.Air Traffic in Africa


9.How We Do Not Want To Work In The Future (Film)


Thank you!

rosas safety days 10./11.10.2017 safety and reliability in...

Documents