Nimrod Information

[dun-testin]

To pick on a point raised previously, actually the ‘stuff about certification’ is important. It’s the airworthiness system in MoD not working as intended that’s at the root of things. Pick any in service IPT and you’ll find the same issues under the rug.

Commercial Aviation

What Mr Boeing and Mr Airbus do is meet the certification requirements in force at the time when the application is made for type certification. They will satisfy mandatory requirements to get the certification from the regulator (minus whatever aspects they can ‘grandfather’ if the aircraft is based on an older one). This is a world away from designing to be as safe as it can ‘possibly be’. No commercial organisation does that. If they say they do its just PR.

The industry functions on the basis that the regulatory compliance ensures an adequate level of safety. There is also a requirement within the regulations themselves to demonstrate safety against a numerical target. As Safeware said previously good luck finding a fully comprehensive example of that being done. The Safety Case concept is not applied in the industry.

Then, once the aircraft is sold to customers, the manufacturer has a requirement to respond to any in service data showing that the design is not meeting the designed level of safety. This is also required by regulation.

The prescriptive regulations prevent anybody from doing anything outrageously stupid for commercial reasons. Shortfalls in designs are fixed after sufficient incidents accrue to force the hand of the parties involved. The regulations also evolve slowly over time in response to technology changes.

MoD

The Military situation is rather different since MoD is its own regulator. This means that the manufacturer proceeds in sole reference to the contracted requirements and the direction it gets from the customer. MoD is full of standards and design criteria. Some are out of date, some are good. However its all entirely dependent on whatever makes it into the contract. That’s under the control of the IPTL.

The regulation JSP 553 provides the baseline criteria for airworthiness. In recent years the move has been away from safety by compliance with specific technical requirements of the kind found in EASA regulations towards safety cases. Basically, ‘do it any way you want just convince us the risk is tolerable’.

There is supposed to be an element of independence built in to the system. The airworthiness reporting chain is supposedly separate. The standard IPTL letter of delegation requires (or did require, been a while since I looked) the IPTL to deliver an airworthy aircraft and calls out JSP 553 and other documents like Defence Standard 00-970 in support. The IPTL is duty bound to satisfy these requirements. That means getting adequate resources to do the job. If this cannot be done work should cease and it be escalated to higher levels of authority.

This assumes a lot. It assumes that the man in post understands his crucial regulatory airworthiness role. It also assumes he is willing to be personally extremely unpopular in the interests of safety. Possibly to the detriment of his career. It assumes the IPTL will stand up and tell other personnel of higher rank in the same organisation that they cant have the equipment needed because there is not enough money allocated to make the risk tolerable.

As there is never enough money the pressure is always to compromise something. With capability compromises the effects are immediately tangible and opposed vocally by end users. Safety compromises often are not immediately obvious and thus meet less resistance. The flexibility of a safety case approach is also its weakness if the safety culture of the organisations involved is not strong enough. Often considerable pressure is brought to bear on IPTLs to make do, this manifests in watered down safety requirements to contractors and pressure on IPT safety managers to recommend things as tolerable. The same pressure often flows down to system engineers within the manufacturers from their management eg “I spoke to IPTL x and he says that that we don’t need this extra safety feature, he cant afford to pay for it and it would slip the schedule”. From the manufacturers management perspective the customer is right, especially as he’s the regulator as well. DECs voicing their opinion on airworthiness issues to contractors management muddies the waters even further.

While on paper the system is still robust its implementation is not in many cases. The widespread resource shortages are undermining the safety culture in the organisation and its not likely to get better in the conceivable future.

back in my box now....