Where does the UK/JAR "twin only" mentality come from?

[JimBall]

24 incidents. Of which 3 engine failures - 2 SE, 1 LT.

21 incidents due to other causes - and not at all related to the number of engines. After all, taking off whilst still tied down, hard landings, dynamic rollovers can be done with any number of engines!

[Kalif]

Handysnaks,
Yeah, right.....

[zalt]

I wonder if the data driven accident assessment's being done by the International helicopter safety Team will bring some sanity back to regulation development.

[Mars]

I don't know why the offshore data suddenly entered this discussion except as recognition that HSAC/OGP does actually collect data. You might find this quote from an old post by SASless interesting:

HSAC Members: February 23, 2004
Please find attached the Helicopter Safety Advisory Conference (HSAC) "2003 Gulf of Mexico Offshore Helicopter Operations and Safety Review".

The membership support and response from 22 helicopter operators for this review is not only appreciated, but vital in establishing a meaningful report. Continued support is encouraged for the future.

The 2003 Gulf of Mexico oil industry helicopter accident rate per 100,000 flight hours was 3.93 with a total of 15 accidents (all single engine) compared to a 20-year annual average accident rate of 1.83 with a total of 9.1 accidents/year. The fatal accident rate per 100,000 flight hours during 2003 was 1.84 with a total of 7 fatal accidents compared to a 20-year average of 0.63 with a total of 2.7 fatal accidents/year.

This was the worst overall accident record in the 20 years since we began gathering data, with the highest number of fatal events (7) and total fatalities (12), and second highest number of total accidents (15). The 7 fatal accidents were caused by: 2 each engine and controlled flight into water; 1 each loss of control, helideck obstacle strike, loss of passenger control.

During 2003, improper pilot procedures accounted for 11 (73%) of the 15 accidents. 3 each of these were due to controlled flight into terrain or water, loss of control of the helicopter, and obstacle strikes. 1 each due to cargo falling out of the baggage bay and striking the tail rotor, and a strike to another helicopter.

In the last 5 years, there have been 47 accidents of which 14 were fatal (30%), resulting in 19 fatalities and 42 injuries. 25 (53%) of these accidents were due to pilot procedure related causes and 13 (28%) were due to technical fault. It should be noted that other than engines, the only technical causes of accidents were tail rotor failures. The specific leading causes of accidents in the last 5 years have been:

(19%) engine related - with 4 fatalities
(19 %) loss of control or improper procedure with 1 fatality
(11%) helideck obstacle strikes with 5 fatalities
(11%) controlled flight into terrain or water - 3 occurred at night - with 5 fatalities
(9%) tail rotor failures
(6%) fuel quality control
(6%) loose cargo striking tail rotor
(6%) passenger control with 2 fatalities

We are optimistic that by sharing this information with all operators and other oil industry group's, safety initiatives may be developed to reduce accidents and incidents.

Which brings us neatly on to the observation by Zalt on the IHST initiative.

None of us would do other than congratulate the helicopter community on its initiative to reduce the accident rate by 80% in 10 years. However, we should sound a note of caution because of the limited data that is being considered. At this time, the number of US accidents that have been analysed (for the year 2000) is 197 of which nine are for offshore. (The quote from SASless shows the benefit of smoothing data over a statistical window - it doesn't completely remove skewing but it does widen the perspective of the observer (see Sid's statistics for the OGP in 2000 and immediately notice skewing from the midair that happened in Mexico).)

Oh, and by the way, there is no JAA prohibition on flying singles offshore in a non-hostile-environment (such as the GOM) - it was removed from JAR-OPS 3 at Amendment 5 and from ICAO at Revision 12.

We might speculate that the JHSIT (the implementation team of the IHST) will recommend the introduction of Safety Management Systems (together with Risk Assessment), and monitoring in (lightweight forms of) HUMS and HOMP.

No change in regulations but would that satisfy you Zalt?

[handysnaks]

Kalif said

Handysnaks,
Yeah, right.....

I appreciate I'm being a bit slow but you'll have to let me know which bit you're 'yeah righting'!

[zalt]

Mars

Actually looking at the data to see what it says rather than looking for what you want to see in it would work for me. I'm sure there are lots of regulators (some of whom probably don'y know whats inside a cowling) who are keen to justify their half baked ideas.

Always thought it is hillarious that the only major part of an entire rotorcraft that is subject to a rigorous reliability based system safety assessment (the engine iaw Part 33) is the one bit the CAA seem to believe fails so regularly that you need a whole host of kit and extra procedures in JAR-OPS3 just to protect against failure in the first and last few seconds of the flight when PC2/PC2e.

[JimL]

Zalt,

Always thought it is hillarious that the only major part of an entire rotorcraft that is subject to a rigorous reliability based system safety assessment (the engine iaw Part 33) is the one bit the CAA seem to believe fails so regularly that you need a whole host of kit and extra procedures in JAR-OPS3 just to protect against failure in the first and last few seconds of the flight when PC2/PC2e.

I think it goes wider than that, examination of 29.1309 indicates that there is an overall system reliability standard in certification:

29.1309 Equipment, systems and installations

(2) For Category A rotorcraft:

(i) The occurrence of any failure condition which would prevent the continued safe flight and landing of the rotorcraft is extremely improbable; and

(ii) The occurrence of any other failure conditions which would reduce the capability of the rotorcraft or the ability of the crew to cope with adverse operating conditions is improbable.

Where ‘extremely improbable’ is defined as a probability of 1 x 10-9 and ‘improbable’ as 1 x 10-5

Meeting of this standard is achieved by methods which include redundancy or implied system reliability. Thus, it is of no consequence that the reliability of engines is close to 1 x 10-5 because there are (at least) two of them. Exposure, as permitted in JAR-OPS 3, is a way of getting close to the ‘extremely improbable’ standard by limiting the probability of a failure leading to a hazardous event to 5 x 10-8 - and the conditions of PC2e make up any deficiency.

In fact, there is logic in the way that the system of regulations is integrated: firstly, there are certification standards which are provided to ensure that a failure leading to a hazardous outcome is ‘extremely improbable’; secondly, there are operational standards to ensure that if a redundant unit fails, the remaining unit(s) prevent a hazardous event; thirdly, manning levels, qualification, training and testing are provided to ensure that failure of the human in the loop is at the lowest level possible.

Where there is only one engine (with its probability of failure of 1 x 10-5), there exists a standard to ensure that the consequence of the failure is considered; this standard -already referenced – is contained in Rules of the Air and consideration for a safe-forced-landing.

Obviously achieving all of this is problematical because helicopters are flexible, humans are less than predictable and it is not possible to describe all operational concepts. It therefore comes as no surprise that there is a move for operators to take responsibility for their own operational (and maintenance) risk assessment - hence the inexorable move towards Safety Management Systems.

Jim

[Rich Lee]

It is important to note that statements relating to safety, when made in comparison terms, must be considered statements of opinion only, because there exists today no clear cut, objectively based and quantifiable criteria by which the relative safety of two or more helicopter operations can be measured. The determination of the relative safety between single and twin engine helicopter operations includes considerations of many factors, such as the number of incidents and accidents; the injuries and loss of life resulting from those accidents; the time period under comparison; manufacturer quality, pilot training and supervision, and locale or regional considerations.

Indeed, even the federal government in the U.S. have been unable to reach an understanding of the term “safety” that is objective or quantifiable. For example, a report prepared for the Federal Aviation Administration, Office of System Safety, stated:

"In the broadest sense, safety data include reports of events, such as accidents and incidents, inspection results, reports of enforcement actions or other sanctions, and other data which characterize the activities of the air transportation system. It must be noted that only accidents (and some incidents) involve measurable harm to persons or property, and that many types of incidents are reported to FAA by the carriers themselves.
It should be noted that there is no consensus among researchers and participants in the aviation industry about what exactly constitutes "safety data." This lack of consensus was strongly expressed in the comments to the initial draft of this report. Although accidents are universally regarded as events that should be avoided and eliminated if possible, there is little or no statistical evidence for U.S. domestic commercial aviation that other forms of "safety data"-incidents, surveillance results, or enforcement actions-serve as predictors of future accidents or are correlated with accident rates for individual carriers….the exact nature of the relationships between these data and the safety of airline operations remains the subject of research in the aviation community. (GRA Inc (under contract with the FAA), “Safety Reports-Aviation Safety Data Accessibility Study Index”, Washington D.C. (January 20, 1997))

In the U.S., the FAA has not decided that two engines are safer than one engine. Indeed, a legitimate on-going debate exists within the helicopter industry and between the aviation safety and regulatory agencies of different countries as to the relative safety of Single-Engine and Twin Engine helicopters.

As noted above, helicopter experts have yet to define the most basic terms of the safety equation. Reasonable people in the industry, and international helicopter experts and regulators often draw valid, but completely different conclusions regarding the relative safety of Single-Engine and Twin-Engine helicopters.

FAA Administrator Jane Garvey, in a published response to a question by ROTOR in 1997 in opposition to European conclusions that single-engine turbine helicopters pose an unacceptably higher risk than twin-engine helicopters, stated: “Only two states provided all of the data necessary, but it was enough to show that the accident rate for single-engine turbine helicopters was, in most cases, better than twin-engine helicopters”. She also stated that “[a]n analysis of the accident data revealed that single-engine helicopters were either as safe as or safer than twin-engine turbine helicopters”.

However, the NTSB reported for the years 1991-1998 that the single-engine turbine helicopter fatal accident rate was 0.1.41 while the twin-engine turbine helicopter fatal accident rate was 0.88 per 100,000 flight hours. Clearly, the same safety data is being interpreted differently between the U.S. and Europe, as well as within governmental agencies of the U.S. (Harris, Joel S. “Data Show Downward Trends in U.S.-registered Helicopter Accident in 1991-98”, Helicopter Safety, Volume 27 (January-February 2001).)

Roy G. Fox, the Chief Safety Engineer for Bell Helicopter Textron, authored a document in August 1991 entitled “Measuring Safety in Single- and Twin-engine Helicopters”. In that article he presents data that the fatal accident rate from all causes for single-engine helicopters was 5.49 and twin-engine helicopter was 4.37 accidents per 100,000 flight hours between 1984 and 1988. From that data a reasonable person might conclude that it is safer (less chance of dying) in a twin-engine helicopter rather than a single-engine helicopter. Yet in the same article he concludes with the same data that the relative risk of serious injury to the individual from all causes was the same in generic single-engine turbine and twin-engine turbine helicopters. It is possible that a reasonable person might conclude that it is safer (less chance of injury) in a single-engine turbine helicopter rather than a twin-engine helicopter (less chance of death).(Fox, Roy G. “Measuring Safety in Single- and Twin-engine Helicopters”, Flight Safety Digest, Volume 10 (August 1991))

Joel S. Harris reported in an article for the Flight Safety Foundation in 1999 that “Data show same U.S. Fatal-accident Rate for Single-turbine and Twin-turbine helicopters”. The statistics for 1993, through 1997 showed a fatal accident rate of 1.4 per 100,000 flight hours for both single and twin-engine helicopters. (Harris, Joel S. “Data Show Same U.S. Fatal-accident Rate for Single-turbine and Twin-turbine Helicopters”, Helicopter Safety, Volume 27 (January-February 1999))

Clearly, there are legitimate differences of opinion regarding the relative safety between single-engine and twin-engine helicopters. However, it remains true that the FAA has not stated that twin-engine helicopters are safer.

There are a number for reasons why twin-engine helicopters may not be safer. First, the existence of two engines may be irrelevant given that the greatest cause of helicopters accidents is pilot error. In the NTSB study cited above, 66.5 percent of all accidents were caused by pilot error. Engine failure was a cause in 20.8 percent of the accidents in the study. When fatal accidents only are considered, engine failure or malfunction as a contributory cause totaled only 9.9 percent of the total while airframe failure and prop or rotor failure were a contributory cause in 96.2 percent of the accidents. (National Transportation Safety Board, “REVIEW OF ROTORCRAFT ACCIDENTS 1977-1979”, NTSB Special Study NTSB-AAS-81-1 (August 11, 1981))

Furthermore, the addition of a second engine does not in, and of itself result in a ‘safer’ helicopter. A second engine increases the overall system complexity. Carrying an extra engine means carrying the extra weight of the engine, heavier system and airframe, and additional fuel. This requires larger and more complex drive systems. Rotor and anti-torque systems must be larger and often their size requires the use of hydraulic systems. As the systems become more complex and non-linear they are more difficult to operate and pilots require more training. The possibility of pilot error, already the greatest cause of helicopter accidents, increases.

A twin engine helicopter does not always cost more to purchase than a single engine helicopter, but it will always cost more to operate. This additional operational cost can effectively reduce safety if maintenance or servicing intervals is deferred because funds are not available. (Perrow, Charles. “Normal Accidents; Living With High-Risk Technologies”. New York: Basic Books, (1984))

The subject of engines when considered alone creates confusion and uncertainty when safety is considered. There are significant differences between helicopters in the broad categories of single-engine turbine and twin-engine turbine. As an example, a single make of helicopter can be equipped with two or more engine types. These engine types can be from the same or different manufacturer. Each engine will have different operational limits, performance and failure rates. Another problem results from the misconception that all twin-engine helicopters are capable of flying on one engine. This is not true. Many twin-engine helicopters are incapable of flight on one engine in many phases of flight, such as hover or take-off. Many twin-engine helicopters are incapable of single-engine flight at high weights regardless of the mode of flight. The addition of a second engine may seem safer at first glance, but this is not always true. (Harris, Joel S. “Implications of the Power Curve on Single-engine Flight in a Twin-engine Helicopter”, Helicopter Safety, Volume 18 Number 2 (March-April 1992)

[Shawn Coyle]

Rich Lee- great post!
On another note....
It is interesting to note that Canada (and I believe the US) now permits single engine fixed wing aircraft to carry passengers IFR and at night. But with some pretty stringent requirements to ensure the engine is properly maintained and operated correctly.
I believe that's why Agusta did the A119 - same reliable engine (PT-6) as the FW world now allows to fly IFR.
Are we going to listen to the FW's history?

[212man]

I'm sure the next of kin will be greatly heartened to hear that their relatives deaths were a statistical improbability! (Red face test, anybody?)

No one is arguing that CFIT does not cause more accidents than engine failures, nor that all engine failure occur during take off or landing. One thing is certain though: if you do have an engine shutdown in flight, it will result in an OEI landing!

There will be many cases of inflight shutdowns in twins that do not result in accidents (and hence appearing in the statistics) being used for comparison. Er, that's the point!

You do not have to have an engine failure to have an inflight shutdown (chip?). Similarly, an engine may lose power without 'failing' (P3 bleed leak on a PT-6?)

The IHST has been mentioned, and OGP. They are adopting many or all of the Shell Group guidelines in the '7/7=1' initiative (no, not a learning programme for pilots!) within which, PC1 and PC2e are but one element. CFIT, Simulator training, design standards and other elements are all considered as, or more, important, with statistical analysis to back it up.

The point is, that you can tick all the boxes you want against the key causes of accidents (EGPWS fitted--Check, TCAS fitted--Check etc) but at some point you need to consider aircraft performance in both the certification and then the subsequent operating regulations, regardless of how large a factor in accidents it is. Clearly, it is not a "no factor" element. If your approach to taking off is "lets pull and go, and rely on statistics that we won't end up in that forest, built up area, lake, etc" then you may gloss over that part. If you take the view that the passengers deserve to be served by operational standards not disimilar to those used on small commuter turboprops, then you make take another view.

Take the 'wife and kids test'

[zalt]

JimL

1309 may seem to apply apply to 'systems' (and engine UMS is probably included) but nothing important like the rotors, flying controls or gear boxes.

Numeric targets were removed when JAR-29 was created.

[212man]

Zalt, not strictly true: both JAR-29 and now CS-29 still use AC29-2C as their AMCs and that document does quantitively define the qualtitative terms of 'improbable', 'extremely improbable' etc.

[CRAZYBROADSWORD]

Having read the post's so far it would seem the only fact is there are very few facts about which is safer, however what I would like to know is why with an R22 on a private flight or out with an instructor you can land in tiny little sites such as clearings in woods or private sites.But with fare paying passengers and you would hope an experienced pilot you can't it not like you hear of loads of accidents involving such flights.[they normally roll over before they get of the ground]

I am not suggesting letting singles land in site's in the middle of towns with no safe place to go should the engine stop but giving a heli 400m's plus as a takeoff run when doing public transport seems daft.

[MSP Aviation]

21 incidents due to other causes - and not at all related to the number of engines. After all, taking off whilst still tied down, hard landings, dynamic rollovers can be done with any number of engines!

Yea, but the experienced heroes of the sky who are allowed to fly twins certainly wouldn't make such stupid mistakes, right?!

[alouette3]

My opinion is , if the engine on a single quits at night over terrain, the only place I m going is down and I hope to get everything right the first time so that my crew and passenger(who is probably unconscious anyway--in an EMS scenario) and, most importantly, I ,can walk away.In a twin if an engine quits under the same circumstances all I am looking for is the friendly flash of an airport beacon.A no brainer as to what I would rather fly.
The defenders of the single engine concept are partially right.They are simple to maintain and less complicated.But that stems from an ENGINEER'S point of view, which, as we know, is always at odds with the pilot's.
Secondly,I am not sure all those who loudly proclaim that there is no "scientific" way to prove one way or another that singles are okay, are not bottom line driven and pro-operator advocates.
Finally, would any of these gentlemen(including members of the NTSB) send their families on a trip over the Amazon in a single engine airplane?
Alt 3.

[Rich Lee]

Secondly,I am not sure all those who loudly proclaim that there is no "scientific" way to prove one way or another that singles are okay, are not bottom line driven and pro-operator advocates.

The 'bottom line' drives all decisions whether they be regulatory, design, or operational. When something becomes expensive to purchase or operate, it use becomes limited or restricted. At some point anything can become cost prohibitive and use will be terminated. This is true even for governments.

How about risk? If it was proven that more engines were safer, would you fly in a twin when a four engine aircraft was available? Certainly 4 engines are better than two. How about six engines, or even eight! That would be even safer. Needless to say if you never flew at all, that would be the safest option. At what level is risk acceptable? If it could be proved scientifically that 95% of all accidents were caused by pilots with less than 25,000 hours, should all others with less time be restricted?

Would you want the JAA to impose a requirement that any helicopter flown at night or over a city must have eight engines and a crew of four (pilot, co-pilot, flight engineer, and navigator-all of whom at appropriate CRM training)? If one could scientifically prove the risk would be lower, how could you argue against such a requirement?

Finally, would any of these gentlemen(including members of the NTSB) send their families on a trip over the Amazon in a single engine airplane?

Anyone (including members of the NTSB) would send their families on a trip over the Amazon in a single engine airplane if the risk of that trip was less than the risk of some other option. Flying in a single engine would be safer than walking across the Amazon. It would be safer than attempting to drive or kayak or balloon across the Amazon. Would a twin be safer? Maybe. Would you fly in a old, poorly maintained twin rather than a new and superbly maintained single? Would you fly in a twin flown by a pilot with 200 hours and no nav instruments or would you prefer to fly in a single with two 20,000 hour pilots with sat nav and full flight director?

How about that bottom line. Would you take a trip in a twin that cost 5,000 euros when the same trip in a single cost only 50 euros? Thousands of people every day select low fare options over higher fares even when the are completely aware of the additional risks.

Like it or not, these are bottom line questions. Yes, they are also pro-operator because when nobody can afford to fly a helicopter because the cost to purchase an appropriate helicopter becomes to high, and the cost to operate that helicopter (landing fees, maintanence, insurance, registration costs) becomes to high, or the use of the helicopter becomes to restricted; then there will be no civil operators, owners or helicopter pilots.

Then there are the eco and ethical questions. Two engines, bigger carbon foot print. Two engines equals less operational aircraft which equals less people saved by EMS. If you were laying on the road, bleeding with life threatening injuries, would you refuse that night flight in a single because the risk was too high?

[Shawn Coyle]

To carry on with the FW comparison - the deciding factor was that a properly maintained turbine single engine was much more reliable than a piston twin that couldn't maintain flight on one engine. The statistics backed that up quite clearly.
There are turbine engines that have terrible reliability records, and those that have wonderful ones. Are we going to continue to treat them all the same???
A recent troll through the US NTSB statistics for one popular engine type showed a huge number of unexplained power losses where the engine ran fine afterwards. Can't all be pilot error (as some would claim). This engine type drags down the safety record of all the others, yet we don't do anything about it.

[alouette3]

There is a point beyond which adding extra engines becomes stupid.I will not contest that.However, the discussion here is about single vs.TWIN.Also, there is a reason why the US Govt picked the EH101 over the S92 as the future Marine One.I am sure that the third engine had something to do with it.
As far as a well maintained single.Define well maintained.I am sure Air Force One is more "well maintained" than the average 747 in any of the airlines.But is that cost effective maintenance?More bang for the buck?
I don't think so.
The ugly truth is that operators will spend the same amount of time effort and money on a single or a twin(proportionately).Yes, when the costs become prohibitive,services will go away.Yes, aviation is all about risk management etc.I am fully cognizant of the risks I take when I strap on the single engine helicopter at 2 in the morning on a pitch dark night.I am just tired of the hypocrisy of operators,engineers and regulators who try to sell this concept to the unwashed masses that there is absolutely no statistics to prove that the twins are no safer than singles.Well. lies,damn lies and statistics.The public is ignorant enough(you won't believe how many times I have been asked if the patient is going to ride on the skids)to swallow anything.But don't try to sell that to me from the comfort of an offfice desk when I am the potential statistic.I will buy economic sense vs. potential loss of a job.What I won't buy is hypocrisy clothed in scientific clothing.
Alt3.

[Lutefisk989]

Shawn: I'm not sure I understand your point about F/W. The issue with rotorcraft and IFR isn't merely an issue that they're single engine. (My hazy memory recalls an IFR STC for a B407 at some point in the past.) Rather, the limiting factors probably relate more to:

- the additional requirements for handling qualities (meaning you probably need SAS or autopilot) in Appendix B (which don't exist for F/W, since their H/Q are generally acceptable for IFR w/out an AFCS); and

- the related 1309 requirements for system reliablity/redundancy ... electrical, hydraulic, and SAS/autopilot, gyros, etc. ... "fly to destination with a failed system under IFR, yada yada"

These requirements add space, weight, power, and integration penalties which may be significant in many single-engine rotorcraft.

[JimL]

Shawn,

The SARPs and advisory material for single-engine flight in IMC are included in ICAO Annex 6 Part III Revision 12. The SARPs are not just restricted to engine reliability, they include other elements to ensure that the Risk Profile remains acceptable.

Really enjoyed reading Rich's two posts, the second included almost the whole of the meaning of life in a capitalist society and then ended with ethical issues and global warming - phew!

However, it is easy to support the thrust of his argument - which was about risk management - because it is exactly that which drives the shape of regulations. Probably the only point missed was the level of safety demanded by society (the culture) - which establishes the targets for States/Regions. I would question Rich's contention "Thousands of people every day select low fare options over higher fares even when they are completely aware of the additional risks"; firstly with the low cost Air Transport Operators in Europe, there do not appear to be any additional (safety) risks - although there are some anti-social practices; and secondly, the average passenger in helicopters generally has no idea of the elements of risk that are extant for any flight (Norwegian offshore passengers excluded, they appear to be well aware of the risks and their power to minimise them).

The argument on comparative safety (NTSB over the amazon) is accepted as it is an integral part of the JAA culture.

As I understand it, the basis for the JAA philosophy is that flights over a hostile environment should be conducted by a helicopter certificated in Category A. The main reason for that is not performance - although it is an important element - but certification. As Nick Lappos has often stated, the certification basis for a Transport Category helicopter includes provisions that are not present for the Normal Category - except where that Normal Category helicopter is certificated to Appendix C of Part 27.

From the previous discussion it can be seen that: design assessment, fault tolerance, redundancy, compliance with 29.1309 etc., provide a level of confidence that the helicopter will continue to fly (usually related to some quantitative value). When this is characterised in a discussion about one or two engines it translates to a failure rate of 1:100,000 as opposed to one close to 1:1,000,000,000. Using the simplest analogy - because we all understand it - if an oil patch requires 400,000 hours to service all clients, there would be 4 engine failures/year. If those helicopters were singles, the result would be ditching but the consequence would depend on the water over which the flights are conducted. Clearly the GOM is (on most occasions) non-hostile but the North Sea (on most occasions) is hostile - hence there is no JAA prohibition on flying to helideck in a non-hostile environment because the consequence of a failure would likely be a safe-forced-landing.

As was stated earlier, there is no twin-only mentality but risk assessed regulations that take into account the hostile, non-hostile categorisation - i.e. it is not the failure that is important only the consequence.

The argument that simplicity is safer than complexity is a given, only the consequence of failure is in question.

Jim