I feel the DECU connector saga gets to the heart of the airworthiness issue, exposing the obvious political imperative that the “new” Mk2 must be seen to be flying which, I believe, led to shortcuts and poor engineering practice. If I may, the following is from the House of Lords Committee minutes;
House of Lords - Chinook ZD 576 - Report. See Section 5 – Evidence.
109. Squadron Leader Burke spoke to having experienced two engine run ups on the ground at the Boeing factory in Philadelphia while flying with an American Army test pilot (Q 655) and similar run ups when testing the overspeed limiter on the ground at Odiham (Q 680). He also spoke to problems with the multi-point connectors which went from the engines into the DECU. These were of bad design and liable to be displaced by vibration which then produced a power interruption. Although there was a back-up system this did not always work and on two or three occasions pilots had lost control of the engine condition lever. As a result squadrons introduced a procedure whereby crewmen every quarter of an hour checked that the connections had not been displaced in flight (QQ 677-9).
110. At the time of the accident DECUs still presented recurring problems. They were removed from the aircraft when something had gone wrong and returned to the makers who on many occasions could find no fault (QQ 698-9).
And from the Board of Inquiry:
“There were two entries in the Supplementary Flight Servicing Register that had potential relevance to the accident: Serial 2, SI/CHK/57 on the security of the DECU connectors…….”
I do not have a copy of the SI (Servicing Instruction) but it would seem to relate to a pre-flight check to be carried out on the ground. The “supplementary” in-flight 15 minute check was, it appears, introduced by the “Squadrons”. If I’m wrong about this, sorry, but I’ve asked the question many times without reply. It changes little of what I am about to say.
SIs are issued by MoD(PE) (as was). The Def Stan is very clear on this. The User or Design Authority can be tasked to develop / trial the SI, but it is seen to be issued by PE (that is, the Technical Agency – the named person in the mandated contract whose sole purpose is to maintain the build standard). Therefore, straight away one knows who approved it, as he/she is NAMED in the contract. I won’t comment on the fact the SI was controlled by the very people who have, for 15 years, been allowed to sit in judgement of themselves and prepare Ministerial replies. The independent scrutiny argument.
The reason why PE controls the SI is because it represents a change to the build standard, and should be a fully documented. If it is not, the airworthiness audit trail is broken.
Nowhere does the Def Stan address the concept of in-flight SIs.
It is my opinion that such a design problem should not have been managed by an SI. There are some parts of an aircraft design that you just don’t mess with, and fuel computers are one. For example, you can accept an EMC problem almost anywhere, but if a fuel system is affected, the aircraft doesn’t fly. Simple. Users and maintainers tend not to see such problems in-service – precisely because they MUST be designed out. I accept I have limited knowledge of this particular problem, but even the basic information screams “Class A modification” (“essential for safety, to be embodied irrespective of delay, scrap or downtime involved”). A Class A does not necessarily mean grounding, but in this case I’d have said yes, especially given Boscombe’s concern with the associated software.
I’d go further. If the problem was known about before CA Release was granted, a Class AA modification should have been issued (“essential for initial approval, for Service Use or a new type of equipment” e.g. FADEC/DECU). “To be embodied prior to delivery, irrespective of cost, scrap or delay involved”. All quotes are from the Def Stan.
But, checking in-flight is a new level of lunacy altogether. Why was this extraordinary action necessary? There must be a recorded reason, but it seems no deeper investigation took place post-crash. Some of the more obvious questions are - Did the Users report concerns about the DECU or the SI? Was a request for a proper engineering solution refused, or was it “in hand”? Who authorised this in-flight servicing? What tests/tools/test equipment were to be used to verify the check/repair (as servicing is not complete until verified)? What was the test - a simple wiggle? (See previous posts about degradation). An electrical continuity check? An insulation check? Was electrical bonding compromised by constant wiggling? (Poor bonding is the first thing to check if one suspects nav problems). What was the maintainer (Loadmaster/Maintainer??) meant to do if the connector came loose in his hand? Get on the intercom to the pilot and say “I think I may know why we’re in the clag”?
Frankly, this stinks. Yet, the systemic failings I describe were becoming common practice at the time, due mainly to the RAF (in particular) not requiring the build standard to be maintained. A waste of money you see.
The Safety Case (or Safety argument, whatever) MUST reflect the current in use build standard (which is why one maintains it). Therefore, what safety and risk related documentation exists to support the SI? Read the Nimrod thread and see the discussion of impact and probability. Someone in the Sqn apparently disagreed with the probability of occurrence and, probably, the impact. For example, a pre-flight check may be a temporary risk mitigation, but it is not the engineering solution. An SI is not a permanent device; it is temporary pending superseding modification.
What mod superseded the SI to replace/improve the design? Crucially, what on earth do Fields 6 and 7 of the 714 say? This is a serious question, because the 714 (the modification proposal) demands a multitude of answers, and would reveal prior knowledge and understanding of the problems, which could not be hidden given the extant SI/CHK/57.
And what was the impact if the connector came loose or detached? Catastrophic? Critical? When combined with an increasing probability of occurrence (witnessed by the 15min check), the risk is definitely Class A - in other words, unacceptable and to be tolerated only under exceptional circumstances. May I suggest a VVIP transit to FG is not exceptional circumstances?
There - down to precisely the same argument as Nimrod. Sorry, I've been there before with this on Mull, but few reply. Is it apathy?