Helicopter down in Afghanistan
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Bing, you are correct, the hazard/risk remains but you can reduce the probability of it occurring, passing it up the line to the next DH level does not eliminate the risk either. You are also correct that the HSE is not the military regulatory body, but the MAA constantly make reference to their 'Reducing Risks' documentation. The risk boundaries set in RA1210 are lifted from the HSE documentation. The MAA and Duty Holders can not 'cherry-pick' in order to get the answer they want.
The following is an extract from the MoD Helicopter Safety Enhancement Programme, dated Sept 2013;
"Operating Risks are owned and managed by the Duty Holder who is personally and legally responsible for ensuring that the Risk to Life (RtL) emanating from activities associated with their generation and sustainment of force elements is at least Tolerable and As Low As Reasonably Practicable (ALARP). If an identified Risk to Life (RtL) is not demonstrably at least Tolerable or ALARP then those activities should not continue". (Please note it says 'is', not can be, or will be at some time in the future)
RA 1210 makes it clear that Duty Holders are legally accountable for safe operations and are expected to defend the validity of their ALARP safety statement in a court of law in the event of an accident. That has never happened.
DV
The following is an extract from the MoD Helicopter Safety Enhancement Programme, dated Sept 2013;
"Operating Risks are owned and managed by the Duty Holder who is personally and legally responsible for ensuring that the Risk to Life (RtL) emanating from activities associated with their generation and sustainment of force elements is at least Tolerable and As Low As Reasonably Practicable (ALARP). If an identified Risk to Life (RtL) is not demonstrably at least Tolerable or ALARP then those activities should not continue". (Please note it says 'is', not can be, or will be at some time in the future)
RA 1210 makes it clear that Duty Holders are legally accountable for safe operations and are expected to defend the validity of their ALARP safety statement in a court of law in the event of an accident. That has never happened.
DV
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
A difficulty certainly arises if the modification is considered "essential" to safety (e.g. to mitigate a Class A risk) as the regs say "to be embodied irrespective of delay, scrap or downtime involved". The fact that the risk of collision and death was predicted, and ultimately occurred, seals it. So, who above General Felton signed to say it would be borne?
DV
The risk boundaries set in RA1210 are lifted from the HSE documentation.
The fact that the risk of collision and death was predicted, and ultimately occurred, seals it.
Bing, I was referring to the general risk and mitigation, which is the theme of DV's posts on this subject. The original mitigation for avoiding collision with, or controlled flight into, a cable, didn't need a transponder. I've posted before that the technology was ready, but system integration was not, so the decision was correct at the time. But over 30 years have passed, the kit was ready shortly thereafter, so there was no reason not to revisit. Instead, the general risk was allowed to drift on, based on a decision that was no longer valid.
Thanks for the CFIT clarification. If I ever knew that, I'd forgotten!
Thanks for the CFIT clarification. If I ever knew that, I'd forgotten!
Bing, I was referring to the general risk and mitigation, which is the theme of DV's posts on this subject. The original mitigation for avoiding collision with, or controlled flight into, a cable, didn't need a transponder. I've posted before that the technology was ready, but system integration was not, so the decision was correct at the time. But over 30 years have passed, the kit was ready shortly thereafter, so there was no reason not to revisit. Instead, the general risk was allowed to drift on, based on a decision that was no longer valid.
Thanks for the CFIT clarification. If I ever knew that, I'd forgotten!
Thanks for the CFIT clarification. If I ever knew that, I'd forgotten!
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
That's the bit I asked the HSE about, their response was that it was nothing to do with them. They have incidentally been removed from the latest version of RA1210 not that that has any bearing on this accident.
Well no, they hit a tethered ballon which wouldn't have been detected even if they had had a TAS system fitted as they don't, to my knowledge, have a transponder. It's also not classified as a Mid-Air Collision as collisions with objects on or connected to the ground aren't included in that risk. It actually falls under CFIT.
You are correct to point out that this was a CFIT, but I can find no reference to that in the SI report (but could be wrong). Having said that I should point out that the MAA Bowtie for CFIT indicates wire-cutters as one of the recovery controls. Whether they would have been effective or not with a banking helicopter we will never know. However, this recovery control was not fitted.
DV
I had noticed that, so DHs have no idea where the boundaries sit?
Under the old scheme you had to consider deaths per thousand of the population at risk per year. Which you averaged over a five year period. This works fine for any large industry with many thousands of people involved. However for your typical military aircraft the population at risk is normally in the low hundreds, if you're lucky. This meant any accident that caused death of a first party made the airframe intolerable for the next five years as you'd have to multiply the small population and the fatalities by whatever factor was required to reach 1000.
At the same time a logical reading of the 3rd party tolerability boundary, 1 death per million of the population at risk per year, meant you could happily kill 60 civilians a year and remain tolerable.
So as guidance it was notably unhelpful. Ultimately I'd suggest DHs consider any deaths intolerable in the current climate and are working to remove the risk as well as they can with the levers available to them.
The TAS would have alerted the pilot of the doomed Puma as to the location of the other craft, and improved his situation awareness.
I note that you talk about TAS, what happened to the original fit of TCAS, as installed in the Bond Super Puma?
Whether they would have been effective or not with a banking helicopter we will never know.
I'm not sure TCAS would have been much use in this scenario; my experience of using it in formation at low level is that it just warns you continuously that your play mate is there, so gets turned off by the number 2. Even if it was fitted and on, I'm not sure it would have provided the fidelity in sufficient time to prevent this accident.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
They probably have a better idea than they did before.
Under the old scheme you had to consider deaths per thousand of the population at risk per year. Which you averaged over a five year period. This works fine for any large industry with many thousands of people involved. However for your typical military aircraft the population at risk is normally in the low hundreds, if you're lucky. This meant any accident that caused death of a first party made the airframe intolerable for the next five years as you'd have to multiply the small population and the fatalities by whatever factor was required to reach 1000.
At the same time a logical reading of the 3rd party tolerability boundary, 1 death per million of the population at risk per year, meant you could happily kill 60 civilians a year and remain tolerable.
Under the old scheme you had to consider deaths per thousand of the population at risk per year. Which you averaged over a five year period. This works fine for any large industry with many thousands of people involved. However for your typical military aircraft the population at risk is normally in the low hundreds, if you're lucky. This meant any accident that caused death of a first party made the airframe intolerable for the next five years as you'd have to multiply the small population and the fatalities by whatever factor was required to reach 1000.
At the same time a logical reading of the 3rd party tolerability boundary, 1 death per million of the population at risk per year, meant you could happily kill 60 civilians a year and remain tolerable.
Your statement also exposes another flaw in the risk to life process, namely it can only be regarded as a risk to life if a death has already occurred; it is reactive rather than proactive. Risk assessment must be about determining the potential of gaining or losing something of value. In his comments to the the Tornado SI Air Marshal Garwood said, "bad luck has to be part of the explanation.......a few few feet difference in altitude of one aircraft would have created a near miss rather than this tragic accident". So would this near miss have been regard as a risk to life, or not. For me the risk to life occurred before the collision event, not after it. In my book every Class A/B near miss, confirmed by the AIRPROX body, is a risk to life (not machine)
I don't know that TCAS was ever considered. For aircraft that spend a lot of time at low level it doesn't really give you anything extra as the RAs are suppressed below a certain height.
"The UK MOD is actively considering installing systems on the majority of the helicopter fleet. For most types the decision in the short term is to fit a non-integrated system, most likely to be a TAS type unit. For the larger platforms (Chinook, Merlin and Puma) the fitment of fully integrated TCAS II systems is being considered."
We can continue to debate what the outcomes could have been with and without certain items of equipment, but the facts remain the same,
(1) The risks of collision and wire strike were the No.1 and No.2 Air Safety risk according to the Cdr JHC (ODH).
(2) The risks, at the time of the accident, were neither tolerable nor ALARP.
(3) The ODH had signed off to say they were.
According to RA1210, by reference,”The Health and Safety Executive is responsible for making adequate arrangements for enforcement. In fulfilment of its duty the Executive provides guidance to its regulatory staff who have to judge whether measures put in place or proposed, by those who are under a duty to control and reduce risks "as low as is reasonably practicable" (ALARP), are acceptable.
The principles and guidelines set out [in HSE documentation]are based on what the courts have decided is required of duty-holders, and are intended to help HSE regulatory staff reach decisions about the control of risks and make clear what they should expect from duty-holders. Ultimately, it is for the courts to decide whether or not duty-holders have complied with the law.”
The final paragraph is very important and is the reason why it is covered in MAA RA1210. So far the MAA/MoD have avoided having the regulation tested in court.
DV
Not sure how DHs will have a better idea without guidelines as to what is tolerable.
namely it can only be regarded as a risk to life if a death has already occurred
For the larger platforms (Chinook, Merlin and Puma) the fitment of fully integrated TCAS II systems is being considered.
(1) The risks of collision and wire strike were the No.1 and No.2 Air Safety risk according to the Cdr JHC (ODH).
(2) The risks, at the time of the accident, were neither tolerable nor ALARP.
That's not a fact, that's your opinion until it's tested in court.
MoD also forgets its own teaching. This activity (risk/hazard mitigation) is not presumed safe (innocent) until proven unsafe (guilty). The Safety Management System and its outputs must prove the system or aircraft is safe before Service use; including risks to be ALARP and tolerable. There is a different starting point to the legal process.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
The MAA needs to go back to basics; air safety within the MoD was not invented by Haddon-Cave. Adequate regulations were in force long before that, they simply weren’t followed. Unfortunately, since his review the MAA has tried to reinvent the wheel and in many areas has come up with a square one. It still turns, but not as good as the previous round one.
Let’s revisit BP 1201 and the guidelines set out there. Where the risk matrix (probability against severity) is used to define whether a risk is intolerable, tolerable or broadly acceptable and not which level of Duty Holder holds the risk. Passing the risk to a higher level does not eliminate or mitigate the risk. On the subject of risk severity, why was it necessary to change the criteria for category levels so that, for example, Remote went from ‘Unlikely to occur during the operational life of a particular fleet’ to ‘Likely to occur one or more times in 10 years’; the latter being more in line with Occasional or Probable under BP 1201? Of course it did allow a Class A risk to become a Class B risk, overnight, and lowered the standards.
Let’s accept that safe means that a risk is broadly acceptable, or tolerable and ALARP, and by ALARP I mean the legal interpretation set out by HSE and not ALARP (temporal). According to the narrative verdict handed out at the Nimrod inquest ALARP is a current requirement, not a future one. That is why Andrew Walker called for the grounding of the Nimrod fleet, because the fuel system was not ALARP.
Having legally accountable Duty Holders, is a good outcome from H-C, but they need tighter guidelines to work with; remember most of them have only done the 2 day course. As it stands at present I believe that the TOLERABLE and ALARP standard set out by the MAA is so subjective that Duty Holders choose to state whether it is or isn't depending on how they feel. As yet not one of them has been held accountable after three major accidents.
DV
Let’s revisit BP 1201 and the guidelines set out there. Where the risk matrix (probability against severity) is used to define whether a risk is intolerable, tolerable or broadly acceptable and not which level of Duty Holder holds the risk. Passing the risk to a higher level does not eliminate or mitigate the risk. On the subject of risk severity, why was it necessary to change the criteria for category levels so that, for example, Remote went from ‘Unlikely to occur during the operational life of a particular fleet’ to ‘Likely to occur one or more times in 10 years’; the latter being more in line with Occasional or Probable under BP 1201? Of course it did allow a Class A risk to become a Class B risk, overnight, and lowered the standards.
Let’s accept that safe means that a risk is broadly acceptable, or tolerable and ALARP, and by ALARP I mean the legal interpretation set out by HSE and not ALARP (temporal). According to the narrative verdict handed out at the Nimrod inquest ALARP is a current requirement, not a future one. That is why Andrew Walker called for the grounding of the Nimrod fleet, because the fuel system was not ALARP.
Having legally accountable Duty Holders, is a good outcome from H-C, but they need tighter guidelines to work with; remember most of them have only done the 2 day course. As it stands at present I believe that the TOLERABLE and ALARP standard set out by the MAA is so subjective that Duty Holders choose to state whether it is or isn't depending on how they feel. As yet not one of them has been held accountable after three major accidents.
DV
Last edited by Distant Voice; 17th Sep 2017 at 10:30. Reason: spelling, addition
DV:-
And therein lies the rub. Civilian operators would long ago have had strap hanging passengers, a la train commuters, if they were free to regulate themselves. No doubt it would have been justified by some acronym or other and dressed up with fanciful and dubious statistics. It wouldn't matter much what people thought anyway as they would be their own judge and jury. That is exactly the case with the MOD and its "independent" Regulator the MAA (and its "independent" Investigator the MilAAIB, or whatever it's called this week).
Grounding, or "pausing" fleets (the Hawk T2's now?) is not the answer. The answer to all these airworthiness related fatal air accidents, whether actual or potential, is a truly independent Regulator and Investigator of the operator (the MOD) and of each other. Unless and until that happens avoidable military airworthiness related air accidents will go on happening relentlessly.
Self Regulation Doesn't Work and in Aviation It Kills!
I believe that the TOLERABLE and ALARP standard set out by the MAA is so subjective that Duty Holders choose to state whether it is or isn't depending on how they feel.
Grounding, or "pausing" fleets (the Hawk T2's now?) is not the answer. The answer to all these airworthiness related fatal air accidents, whether actual or potential, is a truly independent Regulator and Investigator of the operator (the MOD) and of each other. Unless and until that happens avoidable military airworthiness related air accidents will go on happening relentlessly.
Self Regulation Doesn't Work and in Aviation It Kills!
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Grounding, or "pausing" fleets (the Hawk T2's now?) is not the answer. The answer to all these airworthiness related fatal air accidents, whether actual or potential, is a truly independent Regulator and Investigator of the operator (the MOD) and of each other. Unless and until that happens avoidable military airworthiness related air accidents will go on happening relentlessly.
Mr Walker also recommended, "that consideration be given to civil aircraft investigation replacing the Board of Inquiry system for investigating the loss of military aircraft."
DV
Indeed DV, it took a 700 year old institution to tell one which has yet to make its first century, "There is something wrong with your bloody aircraft". It has yet to recognise that fact and to take the necessary remedial action.
As tuc continually reminds us, rearranging the deck chairs by rewriting the regs is not the answer. All that is required is to implement the old ones, but that would require admitting why they were scrapped in the first place, and who it was who scrapped them. The RAF can go on protecting the VSOs responsible, or it can move towards regaining its airworthiness. It can't do both.
As tuc continually reminds us, rearranging the deck chairs by rewriting the regs is not the answer. All that is required is to implement the old ones, but that would require admitting why they were scrapped in the first place, and who it was who scrapped them. The RAF can go on protecting the VSOs responsible, or it can move towards regaining its airworthiness. It can't do both.
