Académique Documents
Professionnel Documents
Culture Documents
Risk Mitigation
International
Association of
Oil and Gas
Producers
Formerly E & P Forum
4.00
3.50
3.00
We know we have a 2.50
confident that we
1.00
0.50
40
In 1992, aircraft accidents
35 5 year average were the second most
1992 common cause of Shell
30
Group fatalities.
25
20
15
10
0
Road Aircraft Fire / Fall Falling Drowning Other Crush Electrical Assault
Exposion Object
Shell Aircraft Responded With:
• Development of safety targets and focussed programme
• Shell Group Standards for Aircraft Operations
– Aviation Safety Management System (SMS)
– Aircraft performance standards
– Pilot, maintenance and passenger training
– Equipment fit – items that could have prevented half the GoM fatalities since
1992
– Quality-based maintenance
• Approval of aircraft operators and aircraft types
• More than $1.5million on a range of research programmes
– Health & Usage Monitoring Systems (HUMS)
– Helicopter Operations Monitoring Program (HOMP)
– Underwater escapability trials that led to Helicopter Underwater Escape
Training (HUET)
– Safety management and safety case concept for aircraft operators
– Mathematical modelling of enhanced Performance Class 2
• Influenced industry and regulatory bodies via
– OGP, UKOOA, EHOC, CAA, FAA, NTSB, FSF/IFA, IAGSA, HAI, HSAC
Resultant Shell Fatal Accident Rate
STRATEGIC
SAFETY TARGETS
Safety Performance
20
Air Contractors
Fatal Accident Rate per million flying hrs
15.1
13.2
16
13.7
5 Year Moving Average
11.3
12
5.8 Target
Target
8
2000
5 2005 Target
4 4 4 2008
2.9 2
4
2
0 0
0
90-94
91-95
92-96
93-97
94-98
95-99
97-01
98-02
99-03
00-04
96-00
01-05
Target '08
Despite this Improvement,
the Industry Trend in 2003 was Unacceptable
• International Association of Oil and Gas Producers (1998 –
2003)
Average 2003
Accident rate (per million flying hrs) 17.8 34.7
Fatal accident rate (per million flying 6.4 11.6
hrs)
Accidents per year 16.5 33
Fatalities per year 23.7 51
Passenger Weather
/HLO Related, Not
Training & CFITW
Pilot
Control 8%
Procedure
2%
50%
OGP Offshore Accident Causes 1995-2003
Technical Related (31% of Total)
Component
Failure
54%
Engine
Related
46%
OGP Offshore Accident Causes 1995-2003
Component Failure - Technical Related
Unknown
10% Bird Strike,
Main Rotor or Damage to
Transmission Control Rods
Component 5%
30%
Other
Equipment
Failure
Tail Rotor 10%
Failure
45%
CAA – HUMS Cost Benefit Analysis
Oil Cooler
Failure
Evident
Success
Engine to Gearbox Tail Rotor
Drive
gearbox
• HUMS can detect 69% of mechanical defects in critical rotating parts before failure.
• Identifying incipient failures before they are manifest prevents in-flight failures and
accidents.
Risk Mitigation – Technical Failures
• Improved design requirements (FAR 27/29)
• Quality Assurance (QA) in Maintenance (enhanced Part 135)
• Duplicate inspections (Required Inspection Item)
• Enhanced training
– Human factors training for maintenance staff
– Flight simulator training/CRM/LOFT pilot training for emergency procedures
• Vibration & Health and Engine Monitoring Systems such as
HUMS/VHM/EVMS
• Shell and others in the oil industry have:
– Funded early development of HUMS in North Sea
– Supported research to enhance analysis of HUMS data
– Committed to the installation of HUMS/VHM/EVMS systems
– Accepted costs of such systems and developed a minimum specification
for HUMS/VHM/EVMS
– Recognised the need for minimum system management and serviceability
requirement (FAA AC29-2C MG15, CAP693 + OGP Aircraft Mgmt. Guide)
>10
~2
Technical Failures
Pre and
Post
HUMS:
From
about
eight per
million
flying
hours
to only
one
technical
accident
cause in
nine
years.
HOMP/FOQA Management Process
HOMP
Flight data OPERATOR:
Data Replay,
Analysis and
Verification
Changes to
Changes to HOMP,
Procedures, Investigations
Manuals, HOMP
Training SAFETY OFFICER: MANAGER
etc. Review Meeting (PILOT):
Assessment
Reporting of
Trend information
to Management
and Staff Confidential
Crew Feedback
• 45% to 65% of all accidents involve human error.
• HOMP enables trend analysis and problem identification before they result in accidents.
• HOMP can help assure compliance with standard operating procedures; e.g., take-off
and landing profile compliance.
• HOMP can help assess training effectiveness and troubleshoot operational problems.
Risk Mitigation – Pilot Human Factors
• Flight simulator training in LOFT scenarios emphasising CRM
• Improved aircraft performance and disciplined helideck take-off
and landing profiles to standardised helidecks
• Enhanced management controls within a structured safety
management system, including improved helideck management,
adequate weather forecasting and communications
• Defensive aids such as EGPWS (or AVAD) and TCAS
• Helicopter Operations Monitoring Programme (HOMP)
• Shell and others in the oil industry have :
– Funded initial HOMP feasibility studies and development in UK
– Deployed HOMP on UK North Sea operations on AS332L and S76A++
– Committed to the installation of HOMP systems on contracted helicopters
– Accepted the costs of such systems and are developing a minimum specification
– Recognised the need for minimum system management and serviceability
requirement (CAP 739 and CAA Papers 2002/02 and 2004/12)
– Strongly endorsed initiatives of the ICAO HTSG to add HOMP to ICAO Annex 6 as
a Recommended Practice for all helicopters equipped with flight data recorders
In Sum - What Have We Learned?
• Essential Pre-requisites for Safe Operations
– Safety culture supported by Quality and Safety Management systems
• Equipment fit
– Appropriate to the operation
– HUMS/EGPWS/TCAS and cabin egress modifications
• Pilot procedures
– Helicopter Flight Data Monitoring (HFDM, also known as HOMP or FOQA)
– Flight simulator training in LOFT scenarios emphasising CRM
– Helideck performance profiles
• Helideck management
– Helicopter Landing Officer and Helideck Assistant training
– Helideck procedures
• System failure management
– HUMS/VHM/EVMS
– Engine monitoring
– Flight Simulator training
• Human error in maintenance
– Human factors training
– Duplicate inspections/RIIs
– HUMS/VHM/EVMS
• All these items are addressed in OGP’s Aircraft Management Guide, and will mitigate
risk, but they are unlikely to achieve the long term safety goal.
Overview
• Yet many helicopter operations still use aircraft such as B212 and AS350
that were designed in a similar era (1960/70’s) and to equivalent safety
standards.
• Whilst certification standards for new design aircraft have changed, these
models have continued to be built to old certification standards under
“grandfather rights.”
Design Requirements and Airworthiness
• Latest design requirements offer:
– Improved performance with one engine inoperative
– Redundant systems with flaw tolerance
– Fail safe designs
– Digital flight management systems to reduce pilot workload, improve
situational awareness, and help cope with emergencies
– Crashworthy airframe, fuel cells, and passenger/crew seats
FAR 29 is now at AL 47
Key Design Improvements
• FAR 29.67 Climb: One engine inoperative Amendment 29-26 (Oct 88)
– New continuous OEI rating
• FAR 29.547/29.917 Main & Tail Rotor Drive System Amendment 29-40
(Aug 96)
– Design assessment and failure analysis of Rotor/drive system
• FAR 29.571 Fatigue Evaluation of Structure Amendment 29-28 (Nov 89)
– Tolerance to flaws and damage
• FAR 29.610 Lightning and static electricity protection Amendment 29-40 (Aug 96)
– Improved protection
• FAR 29.863 Flammable fluid fire protection Amendment 29-17 (Dec 78)
– New requirements
• FAR 29. 901/903 Engines Amendment 29-36 (Jan 96)
– Design consideration of effects of uncontained engine rotor burst
– Containment and redundancy of key flight essential systems in the burst zone
• FAR 29.1309 Equipment, Systems and Installations Amendment 29-24 (Dec 84)
– Safety analysis with consideration of system interactions and multiple failures
• FAR 29.1529 Instructions for continued airworthiness Amendment 29-20 (Oct 80)
– Requires substantiation via lightning tests
New Types
EC 225
Sikorsky S92
Overview
In flight Collision
Loss of Control
Other ops
Loss of Power
Main Rotor
Tail Rotor
Other airframe
. Misc/other
We used the Dec 2000 NASA study as our baseline for accident causes
Accident Analysis – NASA Data for Generic Twin
0.65
1 Pilot related (in air) %
Risk mitigation measures applied to accident causes with 3 levels of diminishing efficacy.
Percentage of Accidents Reported in NASA Study
Preventable by Individual Mitigation Measures
Late FAR 29/Enhanced Handling
OC/QA/SMS
Measures
HUMS/VHM
Seven Key
HOMP/FOQA Initiatives
EGPWS/TCAS
Rad Alt/Avad
HOMP
VHM
Engine monitoring
Two pilots
Late FAR27/29
25 7
OPTION A – Baseline NASA Accident Rate/million hrs
Fatal Accident Rate
FAR Part 135/Part 91 Twin Engine – Cost - $million per year (1000 hrs)
early FAR 29 6
OPTION B – Typical global offshore (OGP) 20
Baseline/early FAR 29 + Limited
5
SMS/QA and Ops Controls + part
HUMS + CRM, part simulator, LOFT
OPTION C – New aircraft – early/mid FAR 15 Variable depending
4
Option B + full SMS/QA + full HUMS + on procurement,
full simulator training + Perf Class finance and
depreciation policy
2 + HOMP + TCAS/EGPWS 3
10
OPTION D - New aircraft - late FAR 29
Option C + enhanced cockpit/HQ +
2
enhanced Perf Class 2/Class 1 +
Impact Warning System 5
1
Cost assumes no action taken to
reduce costs through efficiencies; e.g.,
smart procurement, higher utilisation, 0 0
sharing etc A B C D
Baseline Typical New Aircraft New Aircraft
NASA Current OGP early FAR - late FAR
Proving That Risk Reduction Measures
are Justified
• Use the layered defence model in Microsoft Excel as a
predictive tool to calculate the incremental risk reduction
for a given measure.
• Apply the risk reduction in question to the expected
exposure; i.e., number of helicopters, flying hours per
year, and number of passengers per flight.
• Use the incremental cost to calculate the implied cost of
avoiding a fatality (ICAF) and the individual risk of fatality
per annum (IRPA).
• Compare these outcomes to your company’s risk
management guidelines; e.g., maximum ICAF of $50
million, maximum IRPA of 1 in 10,000.
Example: Old vs. New Design
1 Pilot related (in air) % Level 1 Mitigation MF1 Level 2 MF2 Level 3 MF3 Overall Accidents 1 Pilot related (in air) % Level 1 Mitigation MF1 Level 2 MF2 Level 3 MF3 Overall Accidents
Mitigation Mitigation MF prevented Mitigation Mitigation MF prevented
In f l i g h t co l l i si o n w i th 14.3
o b j ect % In f l i g h t co l l i si o n w i th 14.3
o b j ect %
Airport/helipad/fence 5.7 IW 0 .0 0 SM S/ QA / OC 0 .4 3 HOM P 0 .3 8 0 .6 4 3 .6 3 Airport/helipad/fence 5.7 IW 0 .0 0 SM S/ QA / OC 0 .4 3 HOM P 0 .3 8 0 .6 4 3 .6 3
Wire 4.3 EGPW S/ TCA S 0 .7 5 SM S/ QA / OC 0 .4 3 HOM P 0 .3 8 0 .9 1 3 .9 4 Wire 4.3 EGPW S/ TCA S 0 .7 5 SM S/ QA / OC 0 .4 3 HOM P 0 .3 8 0 .9 1 3 .9 4
Other-trees, brush, acft 4.3 EGPW S/ TCA S 0 .7 5 IW 0 .0 0 Tr a i n i n g 0 .3 4 0 .8 3 3 .6 1 Other-trees, brush, acft 4.3 EGPW S/ TCA S 0 .7 5 IW 0 .0 0 Tr a i n i n g 0 .3 4 0 .8 3 3 .6 1
Lo ss o f co n tr o l 14.7 Lo ss o f co n tr o l 14.7
Handling 6.3 DR/ HQ 0 .0 0 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 3 .9 2 Handling 6.3 DR/ HQ 0 .6 0 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 5 5 .3 7
Loss of reference/disorientation 3.0 Tr a i n i n g 0 .4 5 DR/ HQ 0 .0 0 HOM P 0 .3 8 0 .6 6 1 .9 7 Loss of reference/disorientation 3.0 Tr a i n i n g 0 .4 5 DR/ HQ 0 .5 1 HOM P 0 .3 8 0 .8 3 2 .4 9
System deficiency 2.3 DR 0 .0 0 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 1 .4 4 System deficiency 2.3 DR 0 .5 0 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 1 .8 9
Misc/undetermined 3.0 Tr a i n i n g 0 .4 5 HOM P 0 .4 3 PC 1 / 2 e 0 .0 0 0 .6 8 2 .0 5 Misc/undetermined 3.0 Tr a i n i n g 0 .4 5 HOM P 0 .4 3 PC 1 / 2 e 0 .4 9 0 .8 4 2 .5 1
In f l i g h t co l l i si o n w i th ter
5.7 r aEGPW
in S/ TCA S 0 .7 5 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .9 0 5 .1 2 In f l i g h t co l l i si o n w i th ter
5.7 r aEGPW
in S/ TCA S 0 .7 5 HOM P 0 .4 3 Tr a i n i n g 0 .3 4 0 .9 0 5 .1 2
W ea th er 4.0 Tr a i n i n g 0 .4 5 SM S/ QA / OC 0 .4 3 PC 1 / 2 e 0 .0 0 0 .6 8 2 .7 4 W ea th er 4.0 Tr a i n i n g 0 .4 5 SM S/ QA / OC 0 .4 3 PC 1 / 2 e 0 .4 9 0 .8 4 3 .3 5
On g r o u n d / w a ter co l l i si 3.3o n IW
w i th o b j ect 0 .0 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 2 .0 6 On g r o u n d / w a ter co l l i si 3.3o n IW
w i th o b j ect 0 .0 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 2 .0 6
Ha r d l a n d i n g 2.7 Tr a i n i n g 0 .4 5 PC 1 / 2 e 0 .0 0 DR/ HQ 0 .0 0 0 .4 5 1 .2 0 Ha r d l a n d i n g 2.7 Tr a i n i n g 0 .4 5 PC 1 / 2 e 0 .5 5 DR/ HQ 0 .4 5 0 .8 6 2 .3 0
M i d a i r co l l i si o n 2.0 EGPW S/ TCA S 0 .7 5 Tr a i n i n g 0 .3 8 HOM P 0 .3 8 0 .9 0 1 .8 1 M i d a i r co l l i si o n 2.0 EGPW S/ TCA S 0 .7 5 Tr a i n i n g 0 .3 8 HOM P 0 .3 8 0 .9 0 1 .8 1
Ro l l o ver / N o seo ver 1.3 HOM P 0 .5 0 DR/ HQ 0 .0 0 Tr a i n i n g 0 .3 4 0 .6 7 0 .8 9 Ro l l o ver / N o seo ver 1.3 HOM P 0 .5 0 DR/ HQ 0 .5 1 Tr a i n i n g 0 .3 4 0 .8 4 1 .1 1
Subtotal % 48.0 % 0 .0 0 34.38 Subtotal % 48.0 % 0 .0 0 39.20
2 Technical 2 Technical
Lo ss o f en g i n e p o w er 13.0 Lo ss o f en g i n e p o w er 13.0
Engine structure 5.0 DR 0 .0 0 PC 1 / 2 e 0 .0 0 HUM S 0 .4 9 0 .4 9 2 .4 4 Engine structure 5.0 DR 0 .5 0 PC 1 / 2 e 0 .5 5 HUM S 0 .4 9 0 .8 9 4 .4 3
Fuel system related 5.7 PC 1 / 2 e 0 .0 0 DR 0 .0 0 SM S/ QA / OC 0 .3 8 0 .3 8 2 .1 3 Fuel system related 5.7 PC 1 / 2 e 0 .6 5 DR 0 .4 3 SM S/ QA / OC 0 .3 8 0 .8 7 4 .9 5
Other 2.3 PC 1 / 2 e 0 .0 0 DR 0 .0 0 HUM S 0 .4 9 0 .4 9 1 .1 4 Other 2.3 PC 1 / 2 e 0 .6 5 DR 0 .4 3 HUM S 0 .4 9 0 .9 0 2 .0 9
A i r f r a m e co m p o n en t/ sy stem
29.6 A i r f r a m e co m p o n en t/ sy stem
29.6
Main rotor 6.3 DR 0 .0 0 HUM S 0 .5 5 SM S/ QA / OC 0 .3 8 0 .7 2 4 .5 6 Main rotor 6.3 DR 0 .5 0 HUM S 0 .5 5 SM S/ QA / OC 0 .3 8 0 .8 6 5 .4 4
Main rotor drive train 4.3 DR 0 .0 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .7 0 3 .0 5 Main rotor drive train 4.3 DR 0 .5 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .8 5 3 .6 9
Main rotor control system 3.7 DR 0 .0 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .7 0 2 .5 8 Main rotor control system 3.7 DR 0 .5 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .8 5 3 .1 2
Tail rotor 3.3 DR/ HQ 0 .0 0 HUM S 0 .5 5 SM S/ QA / OC 0 .3 8 0 .7 2 2 .4 0 Tail rotor 3.3 DR/ HQ 0 .6 0 HUM S 0 .5 5 SM S/ QA / OC 0 .3 8 0 .8 9 2 .9 6
Tail rotor drive train 6.3 DR/ HQ 0 .0 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .7 0 4 .4 5 Tail rotor drive train 6.3 DR/ HQ 0 .6 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .8 8 5 .5 8
Tail rotor control system 2.3 DR/ HQ 0 .0 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .7 0 1 .6 4 Tail rotor control system 2.3 DR/ HQ 0 .6 0 HUM S 0 .5 5 Tr a i n i n g 0 .3 4 0 .8 8 2 .0 5
Other airframe 3.3 DR 0 .0 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 2 .0 6 Other airframe 3.3 DR 0 .5 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 2 .7 0
Fire/explosion 1.7 DR 0 .0 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 1 .0 3 Fire/explosion 1.7 DR 0 .5 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 1 .3 4
Gear collapsed 2.0 DR 0 .0 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .6 2 1 .2 4 Gear collapsed 2.0 DR 0 .5 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 1 .6 2
Subtotal % 46.3 % 27.46 Subtotal % 46.3 % 38.36
3 Other 3 Other
Rotor contact -person 2.7 SM S/ QA / OC 0 .5 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 2 .1 6 Rotor contact -person 2.7 SM S/ QA / OC 0 .5 0 SM S/ QA / OC 0 .4 3 Tr a i n i n g 0 .3 4 0 .8 1 2 .1 6
Misc/other 3.0 HOM P 0 .5 0 Tr a i n i n g 0 .3 8 SM S/ QA / OC 0 .3 8 0 .8 1 2 .4 2 Misc/other 3.0 HOM P 0 .5 0 Tr a i n i n g 0 .3 8 SM S/ QA / OC 0 .3 8 0 .8 1 2 .4 2
Subtotal % 5.7 % 4.58 Subtotal % 5.7 % 4.58
Factor 0.85 Factor 0.75 Factor 0.85 Factor 0.75
Total accidents prevented (= % effectivity of mitigation measures) 66.43 Total accidents prevented (= % effectivity of mitigation measures) 82.14
Obstacle strike 5%
•Seismic and geophysical support
Tail Rotor
14%
Component operations are pilot intensive, with
Failure
Pilot Proc
26% 7% short legs and many landings/take
offs or lifts, often into confined
areas.
• Pilot fatigue issues are exacerbated by environmental factors and living
conditions.
• Monitoring of engine and aircraft instruments is very limited during hi line
and vertical lift ops.
• Emergency require flying of the aircraft and taking immediate actions.
• 2 pilots = 2 sets of eyes + 4 hands + 2 brains.
• Operational impact of the weight penalties of the additional pilot can be
offset by the longer crew duty days.