Helicopter safety has been big news in 2018, with passengers, community members, unions and politicians justifiably demanding that safety standards in the North Sea are kept to the highest level.
When accidents happen the results can be tragic, so knowing how helicopters are certified as safe is a good starting point when we ask whether standards are being met or have fallen short.
But first, what do you see when you see a helicopter? What do you want to know when you fly in one?
What you’re looking at is an immensely complex machine, drawing upon advanced technology, science and engineering.
But none of that matters to you, the passenger. What you want to know is that it’s safe – or at least as safe as it possibly can be.
Half-measures, unapproved drawings, parts casually assembled, maintenance carried out in a blase manner are not good enough.
READ: Remarkable progress on North Sea safety, pilot says
Achieving safety requires rigorous pursuit of tested specifications, processes and systems. Not just one day but every day, and not just from the moment the helicopter takes off, flies and lands, but from the very point it was planned, back in the designer’s mind.
It’s vital, therefore, that every aspect of their existence, every moment from when they’re conceived to day-to-day flying is governed by uniform, tight, fool-proof regulation.
Aviation safety regulations cover design, production, continued airworthiness, operations, maintenance, air traffic management and airports (including heliports).
For those rules to carry weight, for them to be obeyed, they must be set and enforced independently of the manufacturer or operator.
Carrying the most clout are Easa (the European Aviation Safety Agency) and the FAA (Federal Aviation Administration).
The regulated life of every new type of helicopter begins with the Type Certification.
In Europe, Type Certification is under the responsibility of Easa.
When the likes of Airbus Helicopters, Leonardo Helicopters or Kopters come up with a design, they can’t just dream up a helicopter and get it built – the model must comply with a list of technical requirements.
In Europe, for light helicopters, these specifications are contained in the blandly-titled Certification Specification 27 (CS-27), and for heavy models in the CS-29.
They may sound boring, but CS-27 and CS-29 are the equivalent of a helicopter’s genetic code, mapping out its DNA over seven chapters – general, flight, strength, design and construction, power plant, equipment, and operating limits limitations.
If the proposed helicopter design should stray outside CS-27 and CS-29, special conditions are added.
Very similar rules and processes are applied in the US and globally. For example, US-based Boeing, Sikorsky and Bell Helicopters must comply with the FAA’s Code of Federal Regulations (CFR) Title 14, Part 27 and Part 29, which closely mirror CS-27 and CS-29. Indeed, the regulators recognise each others’ competence and often apply the same rules and determinations.
Importantly, CS and CFR are continually evolving. New technologies, accident investigations and in-service experience all drive continual improvement of these specifications or regulations, making aviation ever safer
But with the design and development process for a new aircraft taking many years, how can a manufacturer begin the design without knowing what rules will be in place when the machine is finally certified? The answer lies in the establishment of the so called “certification basis” very early in the certification process.
At the start of the process, the manufacturer informs the aviation authority (for example, Easa or the FAA) of the new helicopter design, for which it applies for certification, along with the operating characteristics and proposed operating limitations.
The authority then proposes the most adapted set of design requirements (the initial certification basis).
Once agreed, the initial certification basis is deemed to be frozen during the certification period (typically five years) in order to prove the design meets requirements. This is typically done through testing, demonstration, inspection, simulation, analysis and similarity.
The initial certification basis may change depending on the behaviour of the new helicopter but is frozen at the end of the process.
Certification basis requirements are complemented by means of compliance, either published by the aviation authority or agreed between it and the applicant.
Once compliance with the certification basis is agreed, the regulator issues the Type Certificate, associated with the Type Certificate Data Sheet (TCDS) which describes the approved design characteristics and airworthiness limitations of the new product.
Note that the Type Certificate defines a Type Design and does not approve compliance of an individual aircraft.
Regardless of any technological advances and modifications that may take place in the future, the original basis for the certification (for example, design rules or regulations) is normally frozen during the operational life of the aircraft.
These rules go to the heart of the aircraft’s design, or the system’s architecture, so it would be impractical to continuously update and retrofit already certified types.
The latest design specifications or regulations will only be imposed where there is proof of a clear safety deficiency in the original rules or their application, or in case of significant modifications of the original aircraft type.
Throughout the life of an aircraft, new capabilities and safety improvements are continually developed and applied.
Less significant modifications result in the issue of a Service Bulletin and more important changes lead to a Supplemental Type Certificate.
Major modifications are introduced through updates to the Type Certificate as a new variant of the aircraft. Even if the regulations have evolved between the time the original basis of certification was agreed, it is those regulations included in the original basis of certification that need to be satisfied when making new changes.
Finally, airworthiness-related aspects of the aircraft’s operation and maintenance are also included in the Type Certification process.
Even though the design may be approved via a Type Certificate, additional regulations govern how the production process is controlled.
Systems, processes, people, parts and data all need to be controlled. This is to ensure that the end product actually meets the design.
Even if an aircraft design has a Type Certificate, the national authority for where the aircraft will operate needs to be satisfied that it conforms to the design and must issue a Certificate of Airworthiness against each tail number before it is allowed to fly.
Operators are tasked with reporting and manufacturers, under their design organisation duties, with collecting data on incidents and employing teams of specialists who are in regular communication with the regulators.
When incidents occur, manufacturers assess what operating limitations, maintenance inspections or design changes should be made and issue Service Bulletins to describe these measures.
Where the measures address a significant safety issue, these are then mandated by the aviation authority to operators by way of Airworthiness Directives.
European air operation regulations are prepared by Easa but published by the European Commission as EU law.
EU national aviation authorities are responsible for checking the correct implementation of operational regulations over their territory, and delivering certificates to air operators.
Pilots undergo a rigorous training programme, which culminates in a test before a license to fly is granted.
Good academic grades, skills tests, a medical assessment and a minimum number of flight hours are required.
And finally, at each take off, landing and flight there are tight regulations governing air traffic management and airports (including heliports).
Aviation is one of the world’s most highly regulated industries.
Global experts such as Easa and the FAA set the design standards and manufacturers, when acting as type design applicants, need to prove compliance to these in order to obtain a Type Certificate.
The design rules to be applied are agreed at the beginning of the certification process. Even if the design rules evolve throughout the life of the aircraft, they only become applicable to the aircraft design and subsequent modification/upgrades where the original rule is shown to have had a significant safety deficiency, or a major design change.
Once designed, an aircraft is produced, operated and maintained in accordance with related regulations. Compliance monitoring of these is typically delegated to national aviation authorities, such as the UK Civil Aviation Authority.
Andrew Warner is a retired helicopter test pilot