BOI into the 2012 Tornado Collision over the Moray Firth

[Chugalug2]

OAP, precisely! The reason why the events of 30+ years ago (tff!) are so important is that a decision was made at the highest level to subvert Air Safety for short term gain. As a result those with airworthiness delegation were ordered to suborn the regs, and thus be personally compromised thereafter, or to go. The regs themselves were progressively scrapped so that those inexperienced and untrained people who replaced those that were gone had no means of implementing the regs even if they wished to. Hence Mk10 seats lacked a Safety Case, IFFs lacked failure warnings, grossly unairworthy aircraft were illegally Released to Service, and many people died.

So that was then and now is now, but the system still remains broken as tuc states, the MAA is using unrealistic Regs, as DV states, and people go on dying!

TFF, if those of today are hurt by these home truths I am truly sorry, but hurt feelings are secondary to avoidable deaths. No-one is blaming those who produced this SI. They were deceived by omission and commission, just as have been Coroners, Sheriffs, Ministers, and Parliament.

It is I that said that it was nobbled and I stand by that, because every SI is nobbled before a Board is even convened let alone deliberating. As tuc says, the system is failed, the system is partial, the system is dysfunctional. It should be saving lives, it is saving backsides instead.

Unless and until the MAAIB is free of the MAA and MOD, SIs will continue to be nobbled. That is the bitter truth, unpalatable though it be.

[tucumseh]

But as I pointed out, the people of today are not responsible for the failings of their predecessors.


But now they know of the details of the failings (evidence to Haddon-Cave, Lord Philip etc). If they do nothing they are are equally guilty. Remember, it is a legal obligation to report such failings and illegal acts. MoD policy is to discipline those who do. The MAA are party to this ruling. As such, anyone who doesn't speak out perpetuates the problem and places lives at unnecessary risk.



They can only look to the future and do their best.

But their best demonstrably isn't good enough if they don't understand and accept history. Witness, the same recommendations being made. Fine, they made the recommendations. But very rarely in an SI/BoI report do we see the simple and honest acknowledgement that it is the umpteenth time a recommendation has been made. There has to be a register of recommendations and an action plan to clear them. And the SI report must cross reference to previous reports. Only then will the true systemic nature of the failings be exposed. At the moment, MoD compartmentalises everything.


The continued inference that the current incumbents of every position in military aviation safety are all are either incompetent or liars does a large number of very decent people a huge disservice.

Not sure who made this accusation, but you shouldn't draw inference that any such implication is true. But, that despicable lies have been told, and continue to be told, is a simple, demonstrable fact. I have said before; the lies come from the highest ranks. And pointed out a number of times that junior officers refused to lie during the MoK Review, and that honesty was a significant factor in (a) exposing the lies of their seniors and (b) forcing a Ministerial apology; all of which influenced Lord Philip.




In many ways, misleading by omission is even worse than lying. May I offer a simple example in this case? The SI Panel recommends better management of MF760 (Narrative Fault Reports). (The report is poorly worded, making me uncertain if they understand). The progression, to a satisfactory conclusion, of MF760s is a CORE component of Maintaining the Build Standard, which is a mandatory pre-requisite to a valid Safety Case and, hence, Release to Service. Not having such an audit trail, which MUST be a quite deliberate and conscious act of "savings at the expense of safety", would be your top risk.

As I said above, the MAA have studiously avoided mentioning this direct link. Why?

Very few in the past 20 years understood this simple process, because it was effectively cancelled under Chief Engineer Alcock. But that loss of Corporate Knowledge is no longer an excuse following the evidence to Lord Philip and Haddon-Cave. What the SI report should do is put a simple footnote to this effect against this recommendation, to demonstrate they actually appreciate the full impact of what, at the moment, looks like a throw-away statement. In fact, it is in many ways the most serious of them all, because it clearly reveals no lessons have been learned from the host of other accidents that shared this systemic failing. (See the Rivet Joint and Spry threads - MoD get the basic definitions worng, proving my point better than I ever could).


As I said above - compartmentalisation. What will happen in this Tornado case? Tornado will change their MF760 procedures slightly (yet still ignore mandated policy, or more likely continue in total ignorance of it), but what is needed is a policy decision to rid us of Alcock's legacy. That is, properly fund the subject (valid Safety Cases) pan-MoD. You'd be surprised at how little it costs compared to lives lost; as well as equipment. So, SI recommendations should also carry a statement of applicability. Is it isolated, or systemic? Having to answer this simple question would improve competences immeasurably. And it would almost certainly reveal holes in the education of the Panel's engineer!

[Distant Voice]

It is reported that the law firm acting on behalf of the families have comfirmed that the Ministry of Defence will accept liabilty for the mid-air collision. What a pity that this could not have been mentioned in the Ministerial Statement issued prior to the release of the SI report.

DV

[Distant Voice]

Does anyone know, approximately, how many aircrew are currently employed in Tornado GR4 opertions.

DV

[Roland Pulfrew]

, is it because illegality in the past is still unrighted wrong today?

And is not the role of a SI team or inquiry. :=

But their best demonstrably isn't good enough if they don't understand and accept history.

And is not the role of an SI which is to find out what happened during a particular incident. They have, they have made the recommendations based on what happened during a particular incident.

Not sure who made this accusation

Well the usual suspects on here and yet again in one of the most recent posts:

SIs will continue to be nobbled. That is the bitter truth, unpalatable though it be. Which is, of course, utter pish.

Someone, many years ago, decided that the emerging technology of CWS was not required on the Tornado, or they decided that something else was more important and given only a finite pot of money that was this year's priority. So Tornado might have got a new DAS or a new weapon or better GPS because the reality is there is only so much money and other systems, at that point in time, were deemed to be more important.

Why not get together, build a case, formally complain to the police, or the serious crime agency, or to Defence Internal Audit. Write a book, go to the press, make a film, but stop criticizing others who are doing their best, within their terms of reference, to investigate the circumstances surrounding an incident and most certainly have not been "nobbled" (hamstrung maybe). :=

[dervish]

Roland


You defend the BoIs and VSOs because allegedly they kept to their terms of reference. Within a very narrow view this is probably true of the BoI members. But what about, as tuc says, their legal obligations and duty of care? Do they not have greater weight? I'm not having a pop, just asking a logical question. I had very low level delegation at one time and I know my letter placed me under direct orders to report these things. I know the pressure we were under not to say anything if a senior officer or policy was involved. Your post reminds me of that pressure.

What the "usual suspects" are pushing for here is a transparent and honest system. Why are you agin this?

[Chugalug2]

RP, when all else fails play the man instead of the ball, eh?

When this campaign was in its infancy we were accused of attacking hard working honourable Very Senior Officers, until it became clear that the VSOs we were attacking had set out to, and succeeded in, destroying the process of providing and maintaining airworthiness in the Military Airfleets.

Now the charge is that we are attacking OR's, JO's, and SO's who are trying their best to provide for Military Air Safety, when we are not. What we are trying to point out to those prepared to listen is that the system for providing Military Air Safety, whether it be for Airworthiness Provision or Accident Investigation, is broken. That is no criticism of those stuck with the unenviable task of doing their best in dealing with that system, it is criticism of the system itself.

That is what I mean by saying that SIs are nobbled, for they are denied access to all the facts. It is the SI that is nobbled, not those who sit on its panel who, I am sure, do their level best to get to the truth. That is no way to run Air Safety, because it costs lives, money, and capability. The cost of protecting those who created this mess and those who cover for them can be counted by each and everyone of those factors.

Those that you speak on behalf of will be able to do their job, to save lives, when they are freed of such constraints and discover that the same conclusions that they come to have been discovered over and over again, only to be cast aside every time.

[tucumseh]

Roland


You are of course entitled to your opinion, which I respect.


Why not get together, build a case, formally complain to the police, or the serious crime agency, or to Defence Internal Audit. Write a book, go to the press, make a film, but stop criticizing others who are doing their best, within their terms of reference, to investigate the circumstances surrounding an incident and most certainly have not been "nobbled" (hamstrung maybe).


Build a Case - Done. Fully accepted by, for example, Lord Philip and Haddon-Cave (although the latter changed the start date from 1988 to 1998, an act that actively protected certain VSOs). This act is a repetitive feature of most reports.


Formally complain to Police - Done. Thames Valley Constabulary (2 Asst Chief Constables and Chief Constable) confirmed MoD were permitted to judge their own case, and they had no authority. Although one Asst CC was more than ambiguous, offering 3 very different and contradictory reasons, that amounted to "We've been told we don't want to know". The Independent Police Complaints Commission has demonstrated its independence by inviting the same Asst CC to judge her own case. She has confirmed her independent inquiry has ruled in her favour. Civil Service Commissioners and Parliamentary Ombudsman said the same.


Defence Internal Audit - Done. DIA ruled in my favour. MoD took no action and scrapped the report. (Source - FoI reply. The person who took no action was the 2 Star with management oversight responsibility for Chinook, Nimrod......., supported by his 4 Star). There were 19 recommendations. Implementing #13, for example, would have mitigated most of the problems I air here.


Write a Book - Well, the main submission to Lord Philip, which he read and fully accepted, was about 270 pages. It subsumed the main submission to Haddon-Cave. Various supplementary submissions were made, as his original deadline was extended for 6 months after CHART and its implications were revealed.


Go to the press - Done. They tend to listen to MoD when they say it is an isolated case and can never happen again; and when it does they conveniently ignore it because they are seen to be complicit. However, the media (BBC) were excellent during the Philip Inquiry, being instrumental in exposing the lies retired VSOs and civilians told about, for example, CHART. For example, Alcock claimed it had nothing to do with Chinook Mk2, when Mk2 was mentioned over 370 times. He claimed Mk2 was not mentioned in the Team's TORs, but it was. He claimed the recommendations were implemented, but they weren't - they were repeated ad nauseum in later ARTs. None of this is opinion - Lord Philip was most impressed by the fact they were easily disproved by simply submitting the evidence Alcock claimed didn't exist. A recurring theme.


Make a film - Ah, got me there. I don't have the wherewithall. However, I (along with another ppruner) have taken part in a 2 hour programme about MoK when all the above was discussed in greater detail than the usual 10 second soundbite permits. MoD declined to take part.



Yes, you are right, "hamstrung" is a better word in most cases. That is the point I make. Their ToRs are too restrictive. I said that. Dervish also makes the valid point about obligations and duty of care. Yes, I believe they take precedence at all times over SI/BoI ToRs. If the members are discouraged from speaking, or they do speak and a report is amended (e.g. MoK) or destroyed and a statement made it doesn't exist (ASaC), then that is definitely "nobbling".


Hope this clarifies my position.

[dervish]

RP, when all else fails play the man instead of the ball, eh?


Roland has never told us what it is he's unhappy with. Does he want the status quo or our aircraft to be safe? Or neither? (Both is impossible.)

Tuc has told us what he's done to present his case. Over to you Roland. How did you get on when you did the same.

[Distant Voice]

Notwithstanding the failure to fit a collision warning system in Tornado GR4 this accident could have been prevented by the Operational Duty Holder (AVM Stuart David Atha - AOC 1Group).

As ODH, and owner of the risk, he declared the risk to be Tolerable and ALARP, knowing full well that between 2008 and 2011 there had been eight Tornado Class A near misses, at least two being Tornado against Tornado. These incidents had the potential to create twenty fatalities amongst Tornado crews. It is hoped that AVM Atha will be called as a witness at any future Fatal Accident Inquiry in order to justify his decision.

According to MRP RA 1020 DHs slould cease routine aviation operations if RtL are identified that are not at least Tolerable and ALARP.

DV

[Fox3WheresMyBanana]

It would seem from the detail of the BoI that AOC 1Gp was writing lots of letters trying to get CWS incorporated.
So, is he part of the problem, or just someone else caught in an invidious position on this one?

[Distant Voice]

It would seem from the detail of the BoI that AVM Atha was writing lots of letters trying to get CWS incorporated.

All the more reason for not declaring his Tornadoes Tolerable and ALARP.

DV

[Fox3WheresMyBanana]

What I was driving at was that CAS in his letter to SoS in 2011 said it was not ALARP, so what was going on internally in the RAF? Was AOC 1Gp being "asked" to declare it ALARP whilst the fight went on at higher level to get CWS? Did AOC 1GP and CAS at the time disagree? Since there are numerous other examples of individuals being basically ordered to lie, was that the case? As far as I understand it, the case history seems to indicate an individual is obliged to lie if ordered to do so. Maybe CAS decided 2008 wasn't the right time to pick the 'not ALARP' fight, and 2011 was? Maybe it was because of different CAS/AOC 1 Gp

Hands up everyone who's been asked to lie officially whilst something was fixed behind the scenes? Ah, that will be all of us then.

Edit: Stu Atha was AOC 1GP after 2011 I believe
AOC 1 Gp during the period most in question was
2007–2009 Air Vice-Marshal C N Harper
2009-2011 Air Vice-Marshal G J Bagwell
2011- Air Vice-Marshal S Atha

I was acquainted with Greg Bagwell. Seemed like a straight-up and talented guy. Ditto Stu Atha.

[Easy Street]

If I read the report correctly, AOC 1 Gp had already elevated the risk to the Senior Duty Holder. Having used all the 'levers' available to him to reduce the risk (which, considering the piffling financial delegation a 2* gets these days, are fairly limited), the AOC decided that there was more risk than he could bear, since it was both reasonable and practicable to fund CWS. The AOC couldn't approve funding himself, so he passed it up the chain. At that point, if the SDH says 'keep flying', the AOC keeps flying. It's not his call any more, even if he thinks the risk is excessive. He is perfectly entitled to keep writing letters to the SDH saying 'I really think you should fund CWS', but he is no longer the risk owner, so he doesn't call the shots (or carry the can if there is a subsequent collision).

Once the risk had shot up to SofS, who recognised the steaming turd that had arrived on his desk and ordered that money be found to get rid of it at once, funding was in place. Having a funded project is indeed not the same as having the kit in place and working, but would it now reasonable to ground the Tornado fleet until the CWS was installed? For up to 3 years? I think the answer to that is clearly 'no', with the aircraft on active duty in Afghanistan and with an eye on the potential (at the time) for involvement in the near East. Some risks clearly outweigh the operational prerogative (fuel leaking onto hot pipes perhaps?) but I don't see how CWS could be one of those. If the need for a CWS trumped operational flying, you'd have to squawk mode 3 all the time in hostile airspace - certainly not reasonable.

[Distant Voice]

Stu Atha was AOC 1GP after 2011 I believe

AVM Atha became AOC 1GP in August 2011.

Today, he still seems to think that the risk is Tolerable and Alarp after more Class As and three deaths.

DV

[Easy Street]

There are plenty of other mitigations that could be applied to reduce the risk of fast jet mid-air collision, some of or all of which fail the 'reasonableness' test for various reasons:



Establish controlled airspace around all military airfields
Mandate use of Traffic Service as absolute minimum level of service outside controlled airspace
Limit autonomous military training to Restricted or Danger Areas
Paint all combat aircraft black
Extend danger areas around weapons ranges to include all maneouevring airspace, not just the weapon flight airspace
Apply the 250kt below 10000ft speed limit

and there are probably more. AOC 1 Gp could have demanded any or all of these (well, apart from the first - he probably would have had a fight on his hands). Is he negligent for not doing so? No, none are reasonably practicable. DV, your 'reasonableness' radar is a bit out on this one. A risk event occurring does not change anything in terms of the prescribed treatment, unless the number of occurrences invalidates the probability of occurrence assumed in that treatment. If it was declared ALARP following approval of CWS funding, it's still ALARP after the collision, unless the underpinning maths has changed.


Incidentally, at least one of the 'Cat A Tornado airproxes' being bandied around in the Scottish press was a Tornado minding its own business behind a tanker at night when a Typhoon pilot got horribly disoriented and nearly clapped hands with it. Hardly fair to blame that on the Tornado or its lack of a CWS, I would say (TCAS would have been off in any case).

[Distant Voice]

If it was declared ALARP following approval of CWS funding, it's still ALARP after the collision, unless the underpinning maths has changed.


Yes, but who declared it ALARP and on what basis? Having an ALARP programme does not make a risk ALARP, but merely creates "paper safety at the expense of real safety"; to use H-C's words. Anyway, for ALARP to have any meaning the risk must be at least TOLERABLE, and this risk is not. The AOC 1 Gp and the MAA DG must realise that fact. See my posting #250

The collision risk associated with Tornado GR4 aircraft is neither Tolerable, nor ALARP, and can only be mitigated by following MRP RA 1020.

Cease routine aviation operations if RtL are identified that are not demonstrably at least Tolerable and ALARP.





DV

[thefodfather]

DV, not wanting to split hairs where lives are concerned and not wanting to play numbers games with such a serious question as safety, but, as far as I know the last mid air collision involving a Tornado before this event was in 1990. Therefore, whilst CWS might have prevented this accident it might not prevent the next one. Pro-active safety with finite budgets is about making choices and it how the choices are made that is, for me, the most important thing.

[Wrathmonk]

Will CWS help avoid mid-air collisions with non-CWS aircraft at low level? If memory serves me right upwards of 10 people have been killed in midairs between FJ and civilian aircraft, at low level, in the UK in the past 20 years or so - if 'see and avoid' (i.e. no CWS fitted) is not suitable for routine military operations then surely the same can be said about non-CWS fitted civilian operations. Or are all bug smashers fitted with CWS these days?

[Fox3WheresMyBanana]

I would agree TFF, were they prepared to come out and say that, but that isn't the case. If they said "It's not worth it", they would have to justify risk vs cost.
What the MoD have said is - Not having CWS is not justifiable from a safety standpoint, so we'll bring in CWS......except it's taken them over 18 years to date with no system fitted from a point where it could have taken them 2 years, and they had a working system. This is beyond delays, this is lying, and they should get their balls nailed to the wall for it.
And as DV points out, they are breaking their own rules. Having a safety system and then ignoring it is far worse that having no system at all. It wastes everybody's time at huge expense, gives a false impression of safety, and acts as a block to an effective safety system being introduced.

[Distant Voice]

but, as far as I know the last mid air collision involving a Tornado before this event was in 1990

The previous Tornado collision was with a Cessna in 1999. Having said that collision is not the risk, it a consequence of the risk not being adequately mitigated. In this case installation of CWS. The "Top Event", main risk or incident, is "Airprox". (Obtained from MAA Bowtie data).

A CWS would act as (1) "prevention" againt the Top Event (Airprox) occurring, and (2) "mitigation" in order to reduce the impact of of the Top Event should it happen. In TCAS terms TA and RA.

Not having an accident is no guarentee of safety. Nimrod flew for 30 years with fuel couplings in close proximity to hot air pipes. In this case there was neither prevention nor mitigation.

N.B For the avoidance of doubt Airprox means "Aircraft in close proximity to another aircraft that their safety is, or may be compromised"

DV

[Distant Voice]

The "Top Event", main risk or incident, is "Airprox".

It is noted that in the latest Risk Register for Tornado collision (8th June 2014) the Top Event is no longer ALARP but Societal Concern. An entry in the RR talks about "a very significant and negative societal impact associated towards the RAF and MOD"

So it is now about image not lives.

DV

[salad-dodger]

that's twisting things a bit DV.

From the HSE:
"...the risks or threats from hazards which impact on society and which, if realised, could have adverse repercussions for the institutions responsible for putting in place the provisions and arrangements for protecting people, eg Parliament or the Government of the day. This type of concern is often associated with hazards that give rise to risks which, were they to materialise, could provoke a socio-political response, eg risk of events causing widespread or large scale detriment or the occurrence of multiple fatalities in a single event. Typical examples relate to nuclear power generation, railway travel, or the genetic modification of organisms. Societal concerns due to the occurrence of multiple fatalities in a single event is known as 'societal risk.' Societal risk is therefore a subset of societal concerns."
But then you probably knew that....

S-D

[Easy Street]

The "Top Event", main risk or incident, is "Airprox". (Obtained from MAA Bowtie data).

The bowties are used to explore and catalogue the causes of incidents, and to enable probabilistic analysis. So, you have seen the bowtie which explores the causes of airproxes, which has 'airprox' as its Top Event. The analysis resulting from this bowtie would be a component of the predicted occurrence rate for Mid-air Collision, which is the actual risk logged in the Duty Holders' risk registers. Airprox is not, itself, the risk under treatment; it is a proxy from which the potential causes of mid-air collisions can be broken out and then individually treated. Plenty of airproxes result in no degradation of safety whatsoever.

The collision risk associated with Tornado GR4 aircraft is neither Tolerable, nor ALARP

On what basis do you say that? The fact that there has been a collision in which 3 people were killed, and X number of Cat A airproxes, does not automatically make the risk intolerable. Your statement is, however, a neat demonstration of societal risk. I haven't seen the latest numbers on the mid-air collision risk, but it wouldn't surprise me to find that societal issues helped to push CWS over the funding threshold.

[Distant Voice]

Easy Street

Bowties are used to list the triggers, or threats that may lead to an undesired event (Top Event), and the consequences if the Top Event occurs. They also display the preventive measures in place in order to avoid the Top Event and the mitigations to reduce the impact should the Top Event occur.

The Top Event for the CAA and MAA is the same, "Aircraft in close proximity with another aircraft that their safety is, or may be compromised [Airprox]" That is what we are trying to prevent, because a consequence of that occurrence is a possible collision. TCAS acts as both prevention and mitigation.

You talk about Bowtie being used for probability analysis and predicted occurrences, may I suggest that you use some historical "actuals". Since the MAA started to use Bowtie we have had seven Class A near misses and one collision, so the predictive model does not appear to be working. Focus on preventing the Top Event, then the consequences will not appear.

Why do I believe that the risk is not Tolerable and ALARP? - Simple. The Risk Register shows it to be CATASTROPHIC and REMOTE, which by the H-C and CAA matrix makes it INTOLERABLE. By the way, MAA's definition of REMOTE is highly questionable; many would suggest OCCASIONAL. With regards to ALARP, once again the Risk Register makes it clear. Under the heading "Management and Mitigation Strategies and Controls to Achieve ALARP State" is listed CWS. So if we do not have CWS we do not have ALARP. Besides who in their right mind believes that you can go from not Tolerable and not ALARP in 2011 to being Tolerable and ALARP simply by initiating a programme.

DV

[Easy Street]

It's totally irrelevant what the CAA or H-C matrices show. The Duty Holders are working to MAA regs, like them or not. CATASTROPHIC/REMOTE in the RA1210 matrix is a 'HIGH' risk which can be held by an ODH. The MAA's tolerability table in RA1210 makes reference only to annual probability of death; it's got nothing to do with individual incident outcomes.

As for ALARP, do you seriously consider it 'reasonable' to ground a combat aircraft for lack of a CWS only 2 years after funding was approved? It's almost impossible to get new kit into service any quicker. Perhaps you would like DE&S to cut some corners?

[Distant Voice]

It's totally irrelevant what the CAA or H-C matrices show. The Duty Holders are working to MAA regs, like them or not. CATASTROPHIC/REMOTE in the RA1210 matrix is a 'HIGH' risk which can be held by an ODH. The MAA's tolerability table in RA1210 makes reference only to annual probability of death; it's got nothing to do with individual incident outcomes

What a pity you feel that way about H-C (BP 1201) and the CAA, it seems that the MAA is out of step with acceptable approaches. It is important that when we use common terminology we apply common meaning. The RAF shares, at times, common airspace with the CAA, so when a collision risk is declared Tolerable and ALARP it should mean the same to both organisations. Once again death is not the risk we are mitigating (risk register indicates Mid-Air Collision - MAC), it is the consequence of a collision, which in turn is a consequence of "an aircraft being in close proximity of another aircraft that their safety is or may be compromised". TCAS (or the bespoke system) prevents the latter. An OR (Air) 1998 submission, which MoD hides, specifies the requirement as being "To automatically detect aircraft whose relative position and course pose a risk of mid-air collision and to warn the crew so that avoiding action can be taken". It does not say "To keep the death rate better than 1 in 1000 per year.

As for ALARP, do you seriously consider it 'reasonable' to ground a combat aircraft for lack of a CWS only 2 years after funding was approved? It's almost impossible to get new kit into service any quicker. Perhaps you would like DE&S to cut some corners?

The simple answer to that is "No", but I do expect the MAA and DHs to apply the same restrictions as they were prepared to apply back in 2011, when the risk was declared Not Tolerable, and Not ALARP. And with regards to "cutting corners", well, it has only taken 23 years and it's still not fitted.

May I remind you that the Nimrod force was scapped because fuel couplings and hot air pipes could not be replaced effectively. That was after one fuel fire in 30 years.

DV

[Distant Voice]

Easy Street

Can I draw your attention to page 224 at the link below. It covers a Class C Airprox between a Lossiemouth Tornado and a Airbus A319 in the vicinity of Inverness airport on 20th April 2012. It would appear that TCAS on the Airbus saved the day. I suppose MoD regarded the collision risk Tolerable and Alarp? Not sure what it would have done to the death rate figures had it happened.

http://www.airproxboard.org.uk/docs/423/BOOK%2028.pdf


The DG of the MAA claims that "bad luck" played a part in the Tornado collision over the Moray Firth, if the same bad luck had come into play on this occasion we would have been looking at multiple deaths in the air and on the ground.

DV

[Fox3WheresMyBanana]

The Tornado pulled up through the instrument approach lane to his local airport. This is unwise. The Station Flying Order Book was duly amended, although in the 1980's local routings by adjacent airfields were displayed on maps both in the FOB and in operations. Perhaps this has disappeared as a practice in the age of digital maps and planning?

Given the Tornado/Tornado mid-air was also contributed to by less than adequate range joining procedures, I think Lossie has a bunch of questions to ask itself. Would this be in Sqn Ldr Ops ToRs?

[Sandy Parts]

Fox3 - I'd have thought it would be up to the OC of any flying unit at the Station to ensure any such procedures are followed (and Staneval or similar to provide assurance of such). SLOps would be able to provide the information needed to help establish such procedures, but I wouldn't have thought it was his role to ensure they are followed by the aviators?

[Fox3WheresMyBanana]

Forgive my lack of clarity; that's what I meant - it would be given to SLOps to work out such procedures, not that it was SLOps fault.

Fox3 has visions of the SLOps' he has known making little Fox3 clay figures and
JABBING
BIG
PINS
IN!

[tucumseh]

I'm afraid family business diverts me, but my impression of some recent posts is that too many believe all this was a revelation to the MAA/MoD, so pre-2010 can just be ignored. This ongoing deceit taints everything the MAA does.

I also outlined in simple terms the process by which one can mitigate such risks, even in the face of rejection by higher committee. I imagine this did not go down well in MAA/MoD, because it goes against the notion, repeated above, that transference of risk to the SofS or a more senior rank/grade somehow absolves the junior of any obligation. One has an over-riding duty of care. Key staffs at a junior level (not a contradiction!) also have it written in to their Terms of Reference that they can over-rule such decisions using "engineering judgement" - especially if it mitigates Operational Constraints. Again, MAA/MoD don't like hearing this. Also, mandated regs require Industry appointees to initiate action, and they are given financial delegation to empower them. Not applicable in this case as the solution was already known, but the principle stands. MAA/MoD don't like this either. This attitude militates against the system working as intended.

Nor has the concept of "reasonable" time to mitigate before the clock runs on litigation been mentioned. That becomes a risk in itself, and potential mitigation includes getting off your ar*e and doing it yourself, if you know the solution - regardless of higher ups. In 1994 I was faced with precisely such a critical safety constraint/risk and took legal advice. The concept was well understood then, the advice was good, I progressed mitigation despite being told not to, and it was in-service in early 1996. My point is, this is not rocket science (it is a basic competence) and simply note this happened to me at the same time CWS was being progressed under a Technology Demonstrator Programme. The Submission to OR(RAF) in 1998 that Distant Voice speaks of was rejected; and at that point the time factor became "unreasonable". In the Risk Register, there should be at least one annual entry in each risk history, outlining who made the annual LTC bids and who rejected the programme, yet again.


By the way, having read the 1998 Submission, DDOR1(RAF) staff did a cracking job from 1991-96. But the Submission, and the completed work it describes (i.e. good to go for production in 1996), also make clear that the Tornado project office in MoD(PE) and support office at Wyton (?) would have been fully aware of events. It would be in their Risk Register, and a back up plan would (should) be in place that would be something along the lines I described above. Especially as further Development was minor, which is always a risk. CWS had been fully trialled and deemed acceptable by 1996. That mitigated most major procurement risks. Again, don't be taken in by the brief to Hammond (which must have involved the MAA), when in December 2013 he claimed CWS could not have been in Tornado in July 2012.

Fox3 - excellent posts.

[Easy Street]

DV,

Considering that a Cat C airprox is defined by the UK Airprox Board as one in which 'No risk of collision existed', I am certain that both MoD and MAA would consider the risk associated with that event both Tolerable and ALARP. Indeed, until 3 years ago, Cat C was also assigned to airproxes which the board considered to be 'non-events' (Cat E was only introduced in 2011). The Tornado mid-air collision risk is broken into three categories, Mil-Mil, Mil-GA and Mil-CAT, and Mil-CAT is considered the most unlikely. One very good reason for this is that CAT aircraft are all equipped with TCAS and at least one member of a Tornado formation will always be wearing a Mode 3/C squawk. If the analysis was being done purely on Mil-CAT collisions, there would be absolutely no case for fitment of CWS to Tornado. CWS is being fitted to address the Mil-Mil and Mil-GA risks, of which the former is (no surprise) the most likely.

To further illustrate how unreasonable it would be to ground the Tornado fleet for lack of a CWS, just consider what other mid-air collision mitigations must have already been discounted in reaching the current declaration of ALARP. For example, the ODH could insist that all Tornado flying be conducted under Instrument Flight Rules and ban autonomous low flying, while requiring the aircraft to be in continuous receipt of a Radar-based air traffic service. That would eliminate the mid-air collision risk almost at a stroke. But, it is not considered reasonably practicable, given the need for operational training to maintain readiness for the aircraft's declared roles (although training for low-intensity operations could probably take place under such constraints). Despite the impracticality, you can be totally assured that such a step would be taken in preference to grounding the fleet. Your suggestion that grounding is the only thing that would make the risk ALARP is totally unrealistic.

Your comparison with the Nimrod fuel system risk is also inappropriate; that risk arose from a physical characteristic of the airframe, and modification was the only possible fix. However, CWS is not the only mitigation to the mid-air collision risk. If the programme failed tomorrow, alternative steps could be taken to keep the risk below the tolerability threshold. Nimrod didn't have that luxury.

I also outlined in simple terms the process by which one can mitigate such risks, even in the face of rejection by higher committee. I imagine this did not go down well in MAA/MoD, because it goes against the notion, repeated above, that transference of risk to the SofS or a more senior rank/grade somehow absolves the junior of any obligation. One has an over-riding duty of care.tuc, that's all very well when it comes to implementing safety-enhancing modifications. It doesn't read across to the sphere of operations, though. Otherwise, what is the point of a system of risk escalation? When a DDH has applied all reasonably practicable mitigations to an operating risk, but it is still too much for him to bear, he escalates it to the ODH. If the ODH is allowed to tolerate the risk, he can sign as saying so and operations can continue. That process is entirely pointless if the DDH then says "well it's still above my risk threshold, so I'm stopping anyway". Instead, the DDH carries on operating under the ODH's 'top cover', while applying whatever mitigations he can to keep the risk to a reasonably practicable minimum. Which, effectively, is what your junior engineer was doing when unilaterally applying safety enhancements.

[Growbag]

Not quite true Easy. The CWS is being fitted as mitigation for all MAC risks. Cat A airproxes have occurred with CAT, whether they had TCAS or not, and whether the Mil ac has been squawking or not. The likelihood of the occurrence is of course a factor, but a large part of the impetus of the programme being re-instated came from the societal risk of a Mil-Cat collision and the asymmetric response that it could create. Mil-Mil (and the sub-sections within that category) are more likely due to more flights taking place in uncontrolled airspace, but with air congestion and fast/pointy aircraft operating close to busy controlled airspace, airproxes and the possibility of MAC exist and happen with increasing regularity. The Cost Benefit Analysis of CWS vs CAT would probably concur with your view that "there would be absolutely no case for the fitment of CWS", but the reality of the situation was that this spectre was the reason it was reinstated after the SDSR.

[Cows getting bigger]

Are we losing the plot, just a little bit? If the GR4 warrants a CWS, why doesn't every other aircraft out there warrant the same?

I'm sat reading a report whereby four USAF personnel were wiped out in their MH60 having whacked into a flock of geese (http://www.usafe.af.mil/shared/media/document/AFD-140709-005.pdf). It seems to me that a fair bit of pragmatism has been applied in the report; they're not hunting down the MoD for the lack of accurate goose information. Alternatively, the Tornado mid-air almost goes as far as questioning the colour of ink used on the auth sheets.

Surely we need to strike a balance here? I'm all for safety management and hazard analyses but don't we need to question things when we get into Tippex sniffing, HSE mode?

[Easy Street]

Growbag,

All true. The 'societal risk' captures the need to be seen to do something, which is the unfortunate position we've got ourselves into.

CGB,

I'm not aware of any front-line combat aircraft having a CWS, and there are plenty out there with poorer cockpit visibility than the Tornado. However, 'no-one else has one' does't mean that it's impracticable to have one. I think the focus has fallen upon Tornado because it does a lot of flying at low level, without any kind of surveillance service, mixing with autonomous traffic, often at the lower end of VMC criteria, with the crew spending at least some of their lookout time ensuring they don't hit the ground. DG MAA seems to be trying his best in the Convening Authority comments to build a societal case for installation of CWS in Typhoon and F-35, but the different operating environments of those aircraft (much greater use of segregated airspace, under some kind of surveillance or control) mean that the risks do not read directly across from Tornado. Besides, if anyone thinks that it would be remotely practicable to install a CWS in Typhoon or F-35 at anything other than prohibitive cost, then please do tell how; perhaps you could apply the same techniques to installing the operational capabilities that we are paying through the nose for! I'm not aware of any stealthy TCAS antennae being available COTS, before anyone asks.

[salad-dodger]

All true. The 'societal risk' captures the need to be seen to do something, which is the unfortunate position we've got ourselves into.
You are wrong, however tongue in cheek you may be trying to be. Addressing a societal risk is not just about being seen to be doing something.

There are societal risks associated with nuclear power generation, bulk fuel storage, chemical plants etc. they don't just have to be seen to be doing something, they have to actually reduce the risk, often disproportionately so, because of the potential for wider damage to the industry.

So, should the worst occur, eg MAC with CAT then the RAF's (and other Mil aviation) freedom to operate and train within UK airspace would be massively reduced.

Not a difficult concept, just take off the blinkers and think about it.

S-D

[Easy Street]

S-D, yes, sorry for being tongue-in-cheek. ALARP still applies to societal risks, though, and I'm unconvinced that even the spectre of a Mil-CAT collision is enough to tip the scales of reasonability and practicality for installation of CWS to Typhoon and F-35. Even a podded solution would be likely to fall foul of the unbelievable timescales involved in systems integration on those platforms.

[Chugalug2]

Easy Street, please don't take offence, but I find that your ingenious arguments, for not doing this or questioning that, convince me of the need to remove such discussions from the deliberations of endless Whitehall meetings and place them in the hands of a body with the Authority to insist on the implementation of programmes, such as Military CWS, as and when deemed necessary. That would be the MAA, just as soon as they become an Authority that is.

It is all very well to say:-
if anyone thinks that it would be remotely practicable to install a CWS in Typhoon or F-35 at anything other than prohibitive cost, then please do tell howWhy not keep it simple? No bells or whistles, just an off the shelf TCAS would have prevented this accident, and would cover most other situations, with the exceptions of military formations and dynamic manoeuvres when the answer is probably to switch off all or some of the alerts.

CAT has managed the 100% fit required by the CAA, despite:-
much greater use of segregated airspace, under some kind of surveillance or control So why can't UK Mil?

The real issue that I have with your position is that you proffer alternative scenarios of ever increasing unlikelihood in order to show that doing nothing is in comparison very reasonable and responsible. Thus was the Hercules refused ESF for decades until the inevitable (though no doubt 'highly unlikely') happened and ten people were killed.

Aircraft have been bumping into each other since the start of powered flight. We now have a very reliable system to stop it. Let's just be sensible and fit it to all our large and/or fast military aircraft.

[Distant Voice]

Why not keep it simple? No bells or whistles, just an off the shelf TCAS would have prevented this accident, and would cover most other situations, with the exceptions of military formations and dynamic manoeuvres when the answer is probably to switch off all or some of the alerts.


An off the shelf TCAS was available in 1991, but rejected as being unsuitable for FJ. Now, 23 years latter, we have decided to fit it (I think).

DV

[Easy Street]

Chug, I'm not arguing against installation of CWS in Tornado. I have been attempting to demonstrate why the risk is still considered tolerable and ALARP while the kit is under development, in response to DV's suggestions that it was not. I'm glad that CWS is being fitted and yes, there was a relatively easy (if sub-optimal) solution. If it's considered 'ingenious' to point out flaws of substance in DV's allegations of intolerability and non-ALARPness, would you instead prefer that we take decisions based purely on unsubstantiated statements of a somewhat headline-grabbing nature?

The point about F35 and Typhoon is that they operate in vastly different environments to Tornado. Not only that, they have better cockpit visibility and are both equipped with air-air radars and passive detection systems. They also fly proportionally fewer hours per crew due to advances in synthetic training (substantially so for F35). Now that doesn't mean that they shouldn't have CWS, but it does change the cost-benefit balance compared to the Tornado case. As for societal risk, how would MOD's reputation suffer if it became known that we, alone among F35 partner nations, had compromised the stealth characteristics of the aircraft by cutting holes for after-market TCAS? Besides, would that not make the aircraft unfit for its operational purpose, much like an ESF-less C130?

[tucumseh]

I have been attempting to demonstrate why the risk is still considered tolerable and ALARP while the kit is under development

Not applicable in this case, as that phase was completed in the 90s. Was it tolerable and ALARP during the 16 years the Requirement was, apparently, frozen through lack of action? You are compartmentalising the risks to the present day and current initiative to resurrect this old abandoned requirement. That is a typical MAA/MoD ploy and, yet again, seems to be related to the dogma that nothing went wrong pre-1998, and everything was wrong from 1998-2010. The very fact that many infinitely more complex risks were successfully mitigated with effortless competence in these periods is conveniently ignored, especially by the MAA. They never want to ask Why?

The argument presented in this case simply does not stand the legal test, because the “reasonable time” to install the kit was exceeded. By MoD’s own admission it was good to go in 1996. (Withholding this information from inquiries was a separate, illegal act). The risk may have been ”tolerable and ALARP” for, say, the 2 years necessary to launch procurement and begin embodiment; but the failure (flat refusal) to meet this obligation created other, equally critical, risks. (Corporate, Management, Financial etc.) While I acknowledge nothing is more critical than loss of life, the existence of and refusal to mitigate these other risks demonstrably led to other accidents and deaths. THEY are definitely not tolerable and ALARP. Risk Management rules demand one assesses these risks in the round.

The status of the risks associated with CWS itself changed as soon as it became obvious the “reasonable time” would be exceeded. The probability of the risk (not fitting CWS on time) occurring became 100% (obviously, in about 2000). In practice one gets a red flag in your Risk Register because “100%” is not an acceptable entry. If the probability is 100%, it is not a risk (in the sense it MUST be mitigated to below 100%; for example, by approving funding). It MUST be escalated; for example, the SofS would need to issue a formal statement that he accepted the consequences. Did he? Was he even advised? How one deals with that is dependent on many factors, but an utterly crucial formal ruling exists whereby the Chief of Defence Procurement AT THIS TIME (Sir Robert Walmsley) upheld the creation of 2nd and 3rd Risk Registers, progressively removing such embarrassing MoD-owned risks, thus concealing the facts from auditors and investigators. Various Ministers have stated they are content with this, which may be of interest to the “Missing Files” inquiry!






tuc, that's all very well when it comes to implementing safety-enhancing modifications. It doesn't read across to the sphere of operations, though. Otherwise, what is the point of a system of risk escalation? When a DDH has applied all reasonably practicable mitigations to an operating risk, but it is still too much for him to bear, he escalates it to the ODH. If the ODH is allowed to tolerate the risk, he can sign as saying so and operations can continue. That process is entirely pointless if the DDH then says "well it's still above my risk threshold, so I'm stopping anyway". Instead, the DDH carries on operating under the ODH's 'top cover', while applying whatever mitigations he can to keep the risk to a reasonably practicable minimum. Which, effectively, is what your junior engineer was doing when unilaterally applying safety enhancements. Like the MAA/MoD (I know, because I’ve listened in despair at them making this mistake) you seem to confuse Attaining and Maintaining airworthiness, and Fitness for Purpose. I’m talking about the first two; you’re correct if addressing the last. But they (MAA/MoD) don’t have the luxury of despair.



The “Junior Engineer” I mentioned was a civilian Staff Officer grade (in his post, by definition an experienced Engineer), one below the minima required to enter MoD(PE), and was addressing Attaining and Maintaining, which would avoid problems at Front Line and the need for Commanders to consider FFP, except in cases of equipment failure or logistic breakdown. This last sentence, in it’s entirely, is an alien concept in today’s MoD, so I accept very few understand it! But understanding it and perhaps re-introducing the concept, would make the MAA/MoD’s job a lot easier; and I, certainly, would look more kindly upon them for at least trying.

[Chugalug2]

Easy, tuc has dealt with your attempted denunciation of DV's points far better than I could. So I merely add, "wot he said!".

how would MOD's reputation sufferbelieve me, that is not a problem.

we, alone among F35 partner nations, had compromised the stealth characteristics of the aircraft by cutting holes for after-market TCAS?Then don't cut holes, find another solution. Let the ingenuity be expended there instead of in endless years of not doing anything.

[Distant Voice]

It's totally irrelevant what the CAA or H-C matrices show. The Duty Holders are working to MAA regs, like them or not. CATASTROPHIC/REMOTE in the RA1210 matrix is a 'HIGH' risk which can be held by an ODH. The MAA's tolerability table in RA1210 makes reference only to annual probability of death; it's got nothing to do with individual incident outcomes

I should point out that prior to RA1210 (Pre 2011?) BP 1201 was the standard. Based on this document, which was in use by IPTs, the collision risk classification is UNACCEPTABLE [Intolerable]. So what has happened in order to make this risk Tolerable? - RA1201 has lowered the standard. What does the table mean by 1 in 1000? What units apply, man-year, flights, flying hours. Besides this table refers to the "overall Risk of Death from operating aircraft" not individual risks.

Another issue is that concerning the meaning of "Remote", which is an important parameter when classifying a risk. Have you any idea how the MAA came up with "Likely to occur one or more times in 10 years", an interpretation which is completely out of step with the general definition. Who in their right mind can believe that 120 Class A's an 18 collisions since the aircraft entered service is Remote. Occasional, the next level up, is more fitting. OR getting back to BP 1201, "Probable".

I am sure that all these issues will be cleared up by the FAI

DV

[tucumseh]

"Another issue is that concerning the meaning of "Remote", which is an important parameter when classifying a risk. Have you any idea how the MAA came up with "Likely to occur one or more times in 10 years", an interpretation which is completely out of step with the general definition. Who in their right mind can believe that 120 Class A's an 18 collisions since the aircraft entered service is Remote."

Absolutely right.

Also, one needs to understand inter-relationships and dependencies. My concern here is the recurring nature of risks and failures, and "stove-piping". An example;

Tornado ZG710 (Patriot shootdown) and the Sea King mid-air (same day in 2003) had a common factor - the same individuals refused to direct that the known and notified risks be mitigated. Their ethos and behaviour were major risks to MoD's Air Systems, not just individual platforms. The 2 Star involved also had management oversight responsibility for ensuring Nimrod MR2 was airworthy. Also, the MRA4 programme. And Chinook Mk3. (That's some track record and he was duly made CB).

Similarly, the same risk that came to fruition on ZG710 (increasing likelihood of friendly fire, caused by refusal to properly integrate failure warnings) was only mitigated on AEW Mk2 by ignoring direct orders to leave it unsafe. The IFF project office refused to make their system safe, making false declarations that it was. The AEW programme manager fixed his aircraft during the Mk7 programme, but the recommendation for a fleet inspection of Tornado was rejected by two 2 Stars; in 1998 and 2002. ZG710 proved they did nothing. Even after the senior Reviewing Officer DIRECTED it be made safe, they took no action for over 6 years. Yet a more complex fix in AEW took days.

So, the same risk was mitigated on one platform, but not on others. Was it in all applicable Risk Registers? No, only one. At higher levels, no action was taken, so the risk associated with their refusal to meet legal obligations remained - and remains, because the MAA/MoD know about it and continue to maintain nothing untoward occurred. In turn, THIS risk has been at the root of numerous other fatalities. Associated with this risk is that the senior ranks are permitted to judge their own case. These risks are enduring, and the probability of occurrence increases daily because the ethos is taught to all new generations.


Clearly, at some level, commonality exists between ZG710 and the Moray Forth mid-air, because the risks associated with this Corporate abrogation of responsibility, both on Tornado and in the wider MoD, still exist.


Please don't interpret this as the entire MAA/MoD being bad. Drawing up a simple family tree of all the accidents we discuss here quickly illustrates just a few common names. (And, by MoD's own admission, the same person notifying the risk!). It only needs one, especially if it is the one charged with oversight. Worse, if he happens to be mentor and patron of the dolt who regards functional safety as optional. Oh God, I'm back on the Wg Cdr Spry thread. Never mind six degrees of separation. Here there are three at most, between every accident.


Not one of the above issues has ever been acknowledged or investigated by MAA/MoD.

[Easy Street]

Was it tolerable and ALARP during the 16 years the Requirement was, apparently, frozen through lack of action? You are compartmentalising the risks to the present day and current initiative to resurrect this old abandoned requirement

I've deliberately compartmentalised my arguments to the present day because the subject of my posts has been limited to the continued operation of the aircraft while integration and installation of the current incarnation of CWS is completed. I have not addressed the question of whether the risk was tolerable and ALARP from 1996-2012; indeed your evidence strongly suggests that it wasn't. As I've made clear, though, I consider it to have been tolerable and ALARP since the decision to reinstate the CWS programme. Whether or not the risk was ALARP during the 2000s is not relevant to its status today, given that we can't turn back the clock and retro-fit the system. The current duty holders can only play the cards they've been dealt.

[Chugalug2]

ES:-
Whether or not the risk was ALARP during the 2000s is not relevant to its status today, given that we can't turn back the clock and retro-fit the system. The current Duty Holders can only play the cards they've been dealt. "Not me Chief, I'm airframes!"; your quote exactly encapsulates the other worldliness with which the MOD does Air Safety. The current duty holders are part of the same system that said in effect "No" repeatedly to CWS, and future Duty Holders will no doubt disassociate themselves from this one in turn when they say "No" to, for instance, all FJs being fitted with CWS.

It is the 'Stove Piping' that tuc mentions that is the most insidious part of the MOD machine. The same man can undermine the safety of different fleets, and thus be a threat to them all, but a subsequent fatal accident to one of them is dealt with in isolation, or at most seen as involving that fleet alone. The rest have to wait patiently for their 'remote' accidents to happen in turn. Predictable and predicted, but not at the MOD!

[tucumseh]

I've deliberately compartmentalised my arguments to the present day because the subject of my posts has been limited to the continued operation of the aircraft while integration and installation of the current incarnation of CWS is completed. I have not addressed the question of whether the risk was tolerable and ALARP from 1996-2012; indeed your evidence strongly suggests that it wasn't. As I've made clear, though, I consider it to have been tolerable and ALARP since the decision to reinstate the CWS programme. Whether or not the risk was ALARP during the 2000s is not relevant to its status today, given that we can't turn back the clock and retro-fit the system. The current duty holders can only play the cards they've been dealt.



Thank you Easy Street. But while I understand what you say, the danger is of being sucked in to the MAA/MoD dogma I mentioned, that Haddon-Cave handed them a huge “RESET” button which permits them to ignore everything that happened in the past. This would be an insult on so many levels, not least to those who perished.




I accept that, strictly speaking, the status of this specific risk has changed, and the Risk Register (if manipulated in a certain way) may cough out “Tolerable and ALARP”. But, as Distant Voice says, what criteria are used? Common sense (and mandated procedures in my day) says, given the history of repeated refusal to mitigate, one simply cannot reset to zero and say the same old risk mitigation plan WILL be effective. History shows the same plan was NOT effective (not least because of the MoD ethos that safety is optional and can be waived to save time and money). This ethos persists today, and MoD is quite happy to state this in writing (DE&S policy branch, to be precise). You cannot reset the probabilities of occurrence to the original figures. They MUST reflect history, trends and reality. Bluntly, they must reflect the fact that many senior staffs are hostile to what the project is trying to achieve. That alone would prevent Tolerable and ALARP. It is not As Low As Reasonably Practicable, because the same individuals are fighting against you, and they have a long and successful track record of winning and enjoying top level support. This may be in secondary or inter-related risks, but it MUST be there and linked to the main risk. All this would combine to push up the Risk Score. Also, the Project History Sheets (do they even exist?) must be referenced in the Risk Register. Not just the current "project", but the entire requirement. And not just referenced, but read and understood by all concerned. Perhaps more importantly, also understand how others have successfully fought your enemy off (e.g. the AEW example I quoted). And why they failed as well (e.g. Tornado/Patriot). The paper on that one case should be required reading for ALL in DE&S and MAA.




The elephant in the room is that MAA/MoD conveniently ignores that the causes and/or contributory factors in each of the many accidents we discuss here were predicted, predictable, notified and ignored. Ignored by the predecessors, mentors and tutors of those in charge today, who continue to protect them. This approach arises from the fact the MAA is built on two lies – that everything was fine until 1998 (Haddon-Cave) and the regulations are rubbish (MAA/MoD). To admit either is wrong would be a major step forward. At the moment, the MAA is seen to tread water at best, because much of its effort concentrates on the regulations, not implementation. Yet again, we have in CWS an example disproving the first lie; and MAA seen to gloss over it.

So, I do not believe this long standing risk that is neither Tolerable nor ALARP, and has come to fruition (causing deaths), can be reset to Tolerable and ALARP just because MoD has been (reluctantly) forced to think about it by these deaths.


This is the worst kind of management artifice.



Again, a history lesson, which few in MoD know about. Distant Voice and Angus Robertson MP were lied to by MoD when seeking papers on this crash; as they have lied to everyone I know who asks such questions. (ASaC, Patriot, Chinook, Nimrod, C130 and so on). It should not take the persistence of a few retired old lags to force MoD in to accepting legal obligations, yet demonstrably that is what has happened. MoD would quite happily have done absolutely nothing in each case if they could have got away with it.

[Minnie Burner]

This is all navel-gazing bonkers.
How the hell did we cope 40 years ago when the RAF had more squadrons than it now has FJs?
By the way, Typhoon & Lightning II shouldn't need CWS: if they don't know where ever other b@stard* is they should be sent back to the factory for a refund.

*That's co-op & non co-op b@stards, squawkin' or otherwise.

[Sandy Parts]

"By the way, Typhoon & Lightning II shouldn't need CWS: if they don't know where ever other b@stard is they should be sent back to the factory for a refund." - love it :p
I'm sure the info will be onboard the a/c somewhere in one of the many 'systems' and can be displayed at the press of a switch. However, will the 'operator' be able to assimilate it when it is needed?

[Minnie Burner]

If s/he can't S/HE needs to go back to the factory, too.

[Chugalug2]

MB:-
How the hell did we cope 40 years ago when the RAF had more squadrons than it now has FJs? Very well, because Air Safety spending was ring fenced, SVOs did not seek to subvert it by ordering the suborning of the Regulations, experienced and trained engineers knew the Regs and implemented them to the letter, instead of being sacked and replaced by those who didn't and weren't, and the Regulations were gradually modified and updated instead of being trashed and replaced from an MAA Year Zero.

In other words we had been spared an H-C 'Golden Period' back then!

[Chugalug2]

Deliverance, nobody is saying that 40 years ago everything was perfect, it never was and it never will be. All we are saying is that a sustained attack on Military Air Safety was later made from which it still hasn't recovered. Why that is is the crux of the matter. It is my belief, and that of others, that it is because those who carried out that attack, and those who then covered it up, are still being protected.

If that is accepted then the only solution is to move Air Safety governance away from those who are thus subverting it, which means outwith the MOD. Ditto all the above wrt the MilAAIB. Once those two bodies are made independent of the MOD, and of each other, then the real business of Air Safety can begin.

If then the MAA requires all FJs to carry TCAS then they must, and yes the tax payer will pay for it. If they don't then they won't. The MAA will be the Regulatory Authority, not the MOD, not the SoS, not the RAF, not the CAS, certainly not me, but the MAA.

As to Accident Investigation, ditto wrt the MilAAIB.

As to GA, ditto wrt the CAA.

[tucumseh]

Deliverance

You make perfectly fair points which deserve discussion.


I think we must accept that very few accidents have a single cause. The “Reason Model”, which MoD teaches, characterises it as many slices of cheese, with many holes, whose size is constantly changing. The “accident trajectory” occurs when they momentarily line up.



Problems ARE always present (i.e. as you say, nothing is ever perfect) but the number of slices and fewer/smaller holes are defences in depth. Correct implementation of mandated regulations is one of the biggest and most important defences. In doing so, you avoid the avoidable, leaving time and resources to manage the unavoidable. In Tornado, CWS is one defence, which as you and others say we have done without until now.

But the problem Chug speaks of is that MoD has quite deliberately stripped away the defences. MoD staffs are now spending time and money on retrospectively managing the avoidable. Not just avoidable; but quite deliberate decisions taken to render aircraft unsafe, despite many warnings. For example, the un-ring fencing of airworthiness funding in 1991 and 3 successive years of 28% cuts. I accept that, to today’s staffs, they are faced with this frustration. But I also believe there to be very few in MoD who can articulate cause and effect, which makes it very difficult to make a case for resource.


The ASaC mid-air was a perfect example and the BoI, uniquely in my experience, talked about the defences being stripped so much that crews were only left with one; their own eyesight, at 0400, in pitch darkness, after a recent sand storm. Systems which many pilots had barely thought of (because, unwittingly, they had other defences) became critical. In that case, the BoI did very well given they were serially lied to and deceived, with crucial files “missing”. This Tornado mid-air isn’t too different in most respects.



But sometimes the defences you build just cannot prevent recurrence. Especially when the legal obligation to try to avoid recurrence is deliberately ignored and the oversight process suborned. (Chinook ZD576 is a good example). In this case, as Distant Voice said, there were far too many Tornado mid-airs and near misses and OR(RAF) correctly ran a requirement for a CWS. Sometimes you must temporarily accept the risk (and try to bolster other defences) because the technology simply isn’t available or, commonly, is too heavy and bulky for a small aeroplane like Tornado. For example, wire-strike warning technology has always been needed, but it wasn’t until 1986 it was miniaturised to an acceptable degree. Not sure when that Tornado requirement is going to be resurrected, or if it has been embodied in Typhoon and F35. (The designer sits patiently awaiting MoD – I’m off to see him shortly and perhaps waste a good walk!) It may be that the RAF decided not to proceed in 1986 because other defences were deemed sufficient, but I mention it because it has resonance with this CWS case.

One crucial piece of evidence Haddon-Cave used (but presented as his own) was the relative inexperience of the MoD staffs who manage all this. The last major aircraft programme I managed saw the prime contractor appoint the company’s most senior programme manager as Risk Manager. In purely grade terms he was more senior to the programme manager. By 1996 he knew all about MoD’s run down of its airworthiness system and exploited it mercilessly. (H-C studiously avoided this bit). By contrast, my 2 Star flatly refused to approve me having a Risk Manager at all. I did it myself, but senior management issued orders that no-one was to engage in Risk Management, or submit Risk Notifications. In 7 years, only one notification was submitted. Yet the biggest risk was inability to achieve airworthiness certification, RTS or enter Service, because the same management had directed that, for example, the Mission Trainer (among other airworthiness pre-requisites) should not be procured. Ever. The same management who ignored the recommendation to conduct fleet checks on Tornado IFF functional safety. Mitigation was to completely ignore our 2 Star, and treat him as if he didn’t exist. Which was actually pretty easy, as he made no effort to do his job anyway. Too busy making sure his ethos was embedded in his pet projects, Nimrod MRA4 and Chinook Mk3. Successfully, to be fair, as the predicted came to pass.



Therein lies the root of our problems. It only takes one or two to undermine the whole shebang. I often wonder what steps the MAA would take if that happened today. That 2 Star, and his bosses, may be retired, but he has been replaced by those he taught. Do they have their SQEP status withdrawn for example? If a procurement 1 or 2 Star isn’t a SQEP in his field, surely they must go? I hear whispers the MAA is quite robust in this area, which if true is good news. They’re learning to implement mandated regulations, and avoid the avoidable!

[Distant Voice]

In 1991 a specification was drawn up for Fast Jets for a piece of airborne equipment "to enable a very significant reduction in the risk of mid-air collisions"; in effect make the collision risk ALARP. The specification called for;

(1) Combined closing speed of 1000 kts
(2) Host bank angle of 60 degrees with 15 degree roll rate/sec
(3) 2g turns by host aircraft
(4) Maximum search range of 18 nm
(5) +/- 60 degree of azimuth from host's boresight and +20 degrees and -10 degrees of elevation
(6) Operates within the altitude range 200 - 5000 ft
(7) Provide alerts within 15 secs to interception (Tau). (a) Threat level 1, where Tau is between 5 and 15 secs. (b) Threat level 2, where Tau is between 0 and 5 secs, of pop-up target at 2 nm or less.
(8) Discriminate between threats separated by at least 1 nm in slant range.

The flight trial results and the 1998 OR(Air) document make it clear that the specification was met. Unfortunately, the programme was halted and with it the progress towards ALARP. Despite all the "smoke and mirrors" between 1998 and the time of the Moray Firth collision, the specification requirement was not fulfilled and the risk of collision remained NOT ALARP.

Currently, we are in the process of evaluating a piece of off the shelf equipment which falls short of the 1991 (ALARP) specification, and as a consequence the collision risk remains NOT ALARP. Probably that is the reason why the Risk Register shows no projected change in the Risk Index after TCAS has been fitted. It now seems a case of fitting any collision warning system simply to address the "societal concern".

N.B. This shold be read in conjunction with posting #250 "What is Tolerable"

DV

[Easy Street]

The flight trial results and the 1998 OR(Air) document make it clear that the specification was met. Unfortunately, the programme was halted and with it the progress towards ALARP.

Is there any documentation which indicates why the programme was halted? For example, was the equipment (despite its apparently successful trial) deemed incapable of being integrated at reasonable cost?

[Distant Voice]

Is there any documentation which indicates why the programme was halted? For example, was the equipment (despite its apparently successful trial) deemed incapable of being integrated at reasonable cost?

None that can be located, at present. It seems to have got lost in that "Golden age" that H-C referred to in his report.

The programme was costed and the the OR(Air) document states that "The maturity of the design and technology allows design to proceed straight into prototype/C model production". The ISD was given as 2004, which is in line with the 1998 SDR statement.

Perhaps the OR(Air) of the day will be able to give some sort of explanation at the FAI. I should add that that there were one or two big-hitters who were copied the 1998 OR (Air) document, including ACAS (Sir Jock Stirrup), and I of FS(RAF)

DV

[tucumseh]

For example, was the equipment (despite its apparently successful trial) deemed incapable of being integrated at reasonable cost?

Easy Street & DV

If you don't mind, I can answer.

The statement;


"The maturity of the design and technology allows design to proceed straight into prototype/C model production"


by definition means that the necessary Technology and System Integration Readiness Levels had been achieved, permitting the approving authority to sign for go ahead to launch production.

These two terms have changed a number of times over the years, but the meaning has remained constant; as directed by SofS based on advice from the Chief Scientific Advisor.

Regulations say that the overall TRL or SIRL for an aircraft or system defaults to the lowest TRL or SIRL. So, for example, on Chinook Mk2 in 1993, while much of the Mk2 was at TRL/SIRL 6 or 7 (necessary to achieve, in today's money, Main Gate), the FADEC Safety Critical Software was at no more than Level 3 (i.e. grossly immature, in fact "positively dangerous"), so the entire Mk2 defaulted to 3. This is a fundamental rule of programme management. That is, no (legal) RTS could exist, as there was no proper authority to even begin conversion. Hence, Boscombe's refusal to fly/ grounding.

In stating this in his submission to OR(RAF), the Staff Officer is confirming the programme is at the necessary maturity level. No Staff Officer would make such a Submission without first having drafts approved, if only because he would not wish to place a Star rank in the position of rejecting something he had already approved. Such prior approval, in this case to conduct a TDP, would have had an aim - to achieve a certain TRL/SIRL, or determine what TRL/SIRL extant technology was at. Confirmation that this had been achieved would already have been sougth and provided - not least because payment would depend on it.

Hope this helps.

[Chugalug2]

ES:-
why the programme was halted?It had the misfortune to exist in H-C's 'Golden Period', as DV points out. You don't need to look much further than that, other than to identify who it was who pulled the plug on it

[lederhosen]

Whilst in level flight in my 737 I experienced a resolution advisory with a tornado. Apart from the mandatory paperwork where I assessed the risk of collision as very low I was left with the impression that TCAS gave me better situation awareness than the tornado appeared to have as he crossed under me from left to right. We were VMC and ATC had warned me of the trafic. Nonetheless I was surprised by the event.

[Lordflasheart]

Grüße Herr Lederhosen, das ist sehr interessant.

Whilst in level flight in my 737 I experienced a resolution advisory with a tornado. Apart from the mandatory paperwork where I assessed the risk of collision as very low I was left with the impression that TCAS gave me better situation awareness than the tornado appeared to have as he crossed under me from left to right. We were VMC and ATC had warned me of the trafic. Nonetheless I was surprised by the event.

If I remember correctly from a long time ago, in order for a TCAS equipped aircraft to generate a Resolution Advisory (RA) the conflicting aircraft must also be TCAS equipped. If the conflicting aircraft is only transmitting IFF (squawking) the TCAS equipped aircraft will only generate a Traffic Advisory (TA.) The conflicting aircraft will know nothing except from ATC, eyeball or onboard radar.

In the case of the A319 and Tornado Airprox at Inverness Scotland, 20th April 2012 (See Distant Voice's Post 284) the A319 could only have generated a TA on the RAF Tornado – as the report confirms with the "traffic traffic" call. Even then, it requires the TCAS to detect an appropriate Squawk.

The difference roughly speaking between RA and TA – It is mandatory to follow a RA - If it says "Climb" you must climb. You would have some serious explaining to do if you did not follow an RA. It is not mandatory to take a specific action for a TA – because a TA will not include any manoeuvre instructions. If some other circumstance suggests action is required for a TA, such as turning away based on a visual, there is nothing to stop you taking it. Bear in mind that TCAS only issues height instructions – TCAS does not issue horizontal manoeuvre instructions.

For Lederhosen to experience a genuine RA on a Tornado, that suggests his particular Tornado was equipped with TCAS. Not Brit obviously, but perhaps German or Italian etc. The Tornado should therefore also have been aware of the 737 and received an RA via his own TCAS.

I am open to correction on any of the above.

Sofar I don't recollect seeing any mention of TCAS or CWS in relation to other Tornado operators. Perhaps they quietly got on with it years ago. This might spice up the current debate.

Does anyone have any info on possible TCAS or CWS equipment fitted to Tornados or other FJs of the Luftwaffe or other Air Forces ?

LFH

[Easy Street]

Lord Flash,

Your memory has failed you; the quote below is from this Eurocontrol bulletin (http://www.skybrary.aero/bookshelf/books/1682.pdf) (see case study #3):

RAs are only coordinated between two TCAS equipped aircraft: If both aircraft are TCAS II equipped then the RAs are coordinated to ensure that manoeuvres are compatible. An RA can be generated against all altitude reporting aircraft (equipped with a Mode S or Mode A/C transponder) regardless of whether they carry TCAS.

As far as I know there are no combat aircraft anywhere in the world fitted with TCAS (there are some fast-jet trainers that do have it now, e.g. Hawk T2 and Tucano). I think Tornado will be the first combat type. Some of the more modern ACMI pods have a collision warning function, but they only work cooperatively with similarly-equipped aircraft.

lederhosen,

I assume that congratulations are in order. Good game, great goal, very happy to see fellow Europeans on top! Anyway:

Apart from the mandatory paperwork where I assessed the risk of collision as very low I was left with the impression that TCAS gave me better situation awareness than the tornado appeared to have as he crossed under me from left to right. We were VMC and ATC had warned me of the trafic.

Very difficult to say what level of awareness that crew would have had. What airspace class were you in? If class E or G then it's most likely a case of the Tornado applying see and avoid, and misjudging the degree of separation required to prevent you receiving an RA. The only legal requirement on VFR aircraft in classes E and G is to avoid collision; there is no requirement to avoid other aircrafts' RA bubbles. It's good airmanship to do so, but it's very difficult to judge how much separation is required to avoid an RA. The only guaranteed way is to apply at least 1000ft vertical separation, which might not always be possible due to weather or adjacent controlled airspace. What looks 'close' to a 737 pilot may well look 'distant' to someone used to joining tankers, etc. Chances are, if you thought the risk was very low, they would have thought it non-existent.

[Distant Voice]

Some of the more modern ACMI pods have a collision warning function, but they only work cooperatively with similarly-equipped aircraft.


Tornado has RAIDS, which has a collision warning software option. Unfortunately, this was not taken up when the equipment was purchased back in 2002.

I understand that RAs will only be generated for aircraft above 1000 ft. Neither of the "Moray Firth" aicraft would have received one, had they been fitted with TCAS. On the other hand the bespoke equipment would have given a Threat Level II alert, as this was designed for the Fast Jet low level environment (200 - 5000 ft). See posting #313.

DV

[Onceapilot]

Not sure I understand your point DV? I expect most people would support a working bespoke FJ system, but why slag off TCAS? Basic TCAS would have provided traffic awareness. Surely your point should be that they were not even provided with TCAS, let alone a FJ optimised version.

OAP

[Easy Street]

DV,

I recommend study of the TCAS II specification before making posts which appear to imply that TCAS would have been of no use in the Moray accident, which is how I read your previous. TCAS gives Traffic Alerts at all heights. RAs with a descent component are suppressed below 1100ft radalt, while RAs with a climb component are suppressed above an altitude specified in type-specific software. All RAs are suppressed below 1000ft. This behaviour is all written in the TCAS standard. The Tornados would have known about each other's presence through TA had they been fitted with the equipment.

OAP,

DV is trying to show that even with TCAS on the way, the Tornado collision risk is not ALARP. Suggesting that TCAS would not have prevented the accident, either through ignorance of its function or deliberate omission of some basic facts, doesn't strike me as a particularly robust line of argument! Just as with RA 1210 a couple of pages ago, I've pointed him in the right direction for some corrective reading. Let's see where that takes us.

[Lordflasheart]

Thank you for the correction and link, Easy Street - Re Post 320

Lord Flash, Your memory has failed you; the quote below is from this Eurocontrol bulletin (http://www.skybrary.aero/bookshelf/books/1682.pdf) (see case study #3):

Quote:
RAs are only coordinated between two TCAS equipped aircraft: If both aircraft are TCAS II equipped then the RAs are coordinated to ensure that manoeuvres are compatible. An RA can be generated against all altitude reporting aircraft (equipped with a Mode S or Mode A/C transponder) regardless of whether they carry TCAS.

I should have done my homework myself, instead of letting the dog do it for me. Apologies for my misleading post.

LFH

[ShotOne]

But OAP is making the very good point that while a bespoke FJ TCAS would be great, holding out for the moon and stars may well leave us with nothing at all.

Re. your earlier response to Lederhosen, while it may not be a strict legal requirement to avoid an airliners TCAS bubble, not doing so without a good reason is surely inconsiderate and unprofessional? Even if he felt, as you charitably allowed, the risk was non-existent the tornado pilot ought to have considered the consequences of passing so close.

[Easy Street]

ShotOne,

I got what OAP was saying, thanks (and agree with it); I was trying to help him resolve his stated confusion at DV's rather misleading post.

As for avoiding the RA bubble, we're in violent agreement. I said it was good airmanship to avoid it, and explained why that is sometimes easier said than done. Did you read that bit?

[dervish]

A lot of this goes over my head but chug got it right in an earlier post. There are some who start attacking the individual if they don't like the facts. It doesn't help but says a lot.


Suggesting that TCAS would not have prevented the accident, either through ignorance of its function or deliberate omission of some basic facts, doesn't strike me as a particularly robust line of argument!

What DV did was quote an entry in an MoD risk register which anticipated no projected change after TCAS has been fitted. Now you've pointed it out, will MoD change the register? That is the issue, not DV quoting what MoD claim.

Also, easy street, you floated the idea that CWS may be too expensive to integrate and tuc offered a reasonable answer (which I recognise from the Mull of Kintyre evidence.) I wonder if tuc's answer came as a surprise to anyone in MoD, which would explain a lot about why we are where we are.

I think we're losing sight of the thrust of the thread. Guys died and MoD told porkies about when the kit that may have prevented it could have been in the aircraft. A fatal accident inquiry is needed.

[Distant Voice]

Easy Street, what I said was;
I understand that RAs will only be generated for aircraft above 1000ft. Neither of the "Moray Firth" aircraft would have received one, had they been fitted with TCAS
What I did not say
TCAS would have been of no use in the Moray accident]
What the SI reports says (1.4.4.129);
ASTON 1 and ABBOT 2 would have been given a TA, 23 secs before impact and an audio warning. Neither oral nor visual alerts would have been generated, since both aircraft were below 1000 ft AGL (where the generation and announcement of RAs is suppressed by TCAS II logic).
DV is trying to show that even with TCAS on the way, the Tornado collision risk is not ALARP.
Correct. Because we are fitting a piece of civilian kit that was rejected back in 1991 due to its unsuitability for the FJ environment. This is supported by the SI report (1.4.4.109)
ACAS II has been designed for civil aircraft and the surveillance requirements are based on typical performance envelopes of such aircraft.........UK FJs routinely manoeuvre outside the design parameters
Furthermore, the Risk Register indicates that no risk reduction can be anticipated once TCAS II is fitted. A point that may have been lost on some people, but not Dervish. He sees the relevance of such a statement.

Onceapilot
Not sure I understand your point DV? I expect most people would support a working bespoke FJ system, but why slag off TCAS? Basic TCAS would have provided traffic awareness. Surely your point should be that they were not even provided with TCAS, let alone a FJ optimised version.
You are correct, basic TCAS would have provided traffic awareness, and the SI report makes that quite clear. I am not slagging it off. The point I was trying to get across is that having identified the limitations of TCAS back in1991 a bespoke FJ collision warning system was successfully developed and flight tested. It was designed to operate at low level. Of course the RAIDS collision warning option could have been provided back in 2002, once someone decided not to go ahead with the bespoke system.

DV

[Sandy Parts]

A small point but may help understanding. I was always told that rather than think of a 'bubble' around an aircraft, think of a long pointer expanding into a cone ahead of the aircraft. That is the 'tickling stick' that will cause the possible confliction warnings due to closing flight paths. Hence the problem where a/c in the circuit at Kinloss may 'tickle' the TCAS on a/c approaching Inverness even though the circuit a/c is in a turn onto downwind. Unfortunately, we never got the chance to worry about such issues on the MRA4 in the end.

[Distant Voice]

Just as with RA 1210 a couple of pages ago, I've pointed him in the right direction for some corrective reading. Let's see where that takes us.

Easy Street, I am glad you have brought that issue up once again, because I would like to direct you to the Nimrod Review document for some "corrective reading". At recommendation 22.5 Haddon-Cave calls for the "redrafting" of BP 1201, not for a replacement (RA 1210) with lower standards.

DV

[ShotOne]

"A fatal accident inquiry is needed" ...to what possible benefit? It will cost millions, probably more than fitting TCAS would cost, zero chance of anyone who deserves it receiving any meaningful sanction. In the highly unlikely event the MOD were found guilty of anything they'd be fined which would come out of the defence budget, i.e. we'd have to pay it.

[Chugalug2]

Dervish:-
Guys died and MoD told porkies about when the kit that may have prevented it could have been in the aircraft. A fatal accident inquiry is needed. Shotone:-
...to what possible benefit? So that people realise that Air Safety is not safe in the hands of the MOD. It took a Coroner to tell the RAF that there is something wrong with their bloody aircraft because they didn't want to admit it themselves. Nothing's changed and it never will, unless and until Regulation and Investigation are independent of the user (MOD/RAF/RN/Army) and of each other. If that
will cost millions, probably more than fitting TCAS would cost,then that is part of the cost that is still being paid in blood and treasure just because certain VSOs once had a 'good idea'. If you think that the cost of an FAI is high then what about the cost of the avoidable predictable accidents that are still to come?

[Easy Street]

DV,

At recommendation 22.5 Haddon-Cave calls for the "redrafting" of BP 1210, not for a replacement (RA 1210) with lower standards.

Be that as it may, RA 1210 is the regulation in force, and it is pointless to say things like 'Catastrophic / Remote = Intolerable' just because it says so in an ancestor of that regulation, or in a recommendation that was not adopted. You may well have a justified objection to the MAA or the MOD over that state of regulatory affairs, but unless the RA is overturned, it will continue to define the acceptable levels of risk for duty holders, who are the people taking the decisions to keep aircraft flying.

[Distant Voice]

Be that as it may, RA 1210 is the regulation in force, and it is pointless to say things like 'Catastrophic / Remote = Intolerable' just because it says so in an ancestor of that regulation, or in a recommendation that was not adopted.

Easy Street, one thing to remember, RA 1210 did not come into existence until the end of 2010. So no matter how strongly MAA/MoD may defend this document, which I consider not fit for purpose, from the early 2000 all IPTs (Integrated Project Teams) were mandated to use BP 1201. If the risk was set to Catastrophic/Remote at that time, then the risk was not tolerable. However, using the BP 1201 criteria the risk would probably be assessed as being Catastrophic/Occasional, or even "Probably".

Having said all that, it makes a nonsense of MAA/MOD's approach to risk assessment, if they think that by generating a new document (RA 1210) they can make a risk, that was once considered to be Intolerable, Tolerable.

DV

[Chugalug2]

Easy street:-
RA 1210 is the regulation in force,... unless the RA is overturned, it will continue to define the acceptable levels of risk for duty holders Well, be that as it may, Easy Street, but if the BMA announced that henceforth it would be using the Boys Bumper Book of DIY Brain Surgery as its defining reference for overseeing the performance of surgeons, would you be inclined to put yourself under their knife?
The MAA is trying to do Air Safety Lite and failing spectacularly in the attempt. RA 1210 is symptomatic of that failure. It was written by people who need to learn airworthiness rather than trying to define it for others. In short, it is as potentially dangerous as the BBBODIYBS

[Distant Voice]

RA 1210 is symptomatic of that failure. It was written by people who need to learn airworthiness rather than trying to define it for others
So who wrote RA 1210 (and the other RAs)? What were their qualifications? Who approved the end product? Was it Air Marshal (Retired) Sir Colin Terry, Chairman of the MAA Safety Advisory Committee? For those of you who may have forgotten Sir Colin Terry was Chief Engineer (RAF) from1997 to 99 and must have been aware of all the airworthiness issues outlined in NART and CHART that lead up to the Nimrod and Chinook accidents. He was also aware of the requirement to install CWS in Tornado GR4s, as this was specified in the 1998 SDR. As the previous MAA DG put it "a former RAF engineer of some repute"

DV

[tucumseh]

I must admit I'm glad I no longer have to do this on a daily basis, because if RA1210 was imposed upon me I'd raise a blanket MF765 (Unsatisfactory Feature Report) on it. Pending an answer (which would never arrive, as no-one in the MAA would know what to do) I'd ignore it and use regulations which remain consistent and make sense. I'd like to see the MAA arguing against that. Duty Holders must read RA1210 and ask "How on earth........." You all have my sympathy.


I ask myself what is better - this "new" MAA system or what went before.


Pre-MAA you were told not to implement perfectly good regs if time or cost was in peril. The choice was simple, you did as you were told or you met your legal obligation. Most accidents we discuss here can be traced to the former. Tornado/Patriot and MoK are obvious examples. DE&S still adhere to this policy/practice, which I suggest is what the MAA should be concentrating on. The proof, if any were needed, is contained in the audit reports the MAA commissioned.


Today, you have an extra choice. The "new" MAA regs, which contradict both the DE&S policy and "old" regs, despite many of these "old" regs still being mandated (mainly because the MAA don't actually know they exist).


Some have been cancelled without replacement - for example, it is patently obvious the author(s) of RA1210 have never heard of Def Stan 05-125/2, yet it is THE bible and adherence to it avoids or provides the solution to 99% of all problems you will ever encounter. Think about it. A mandated Air/Land/Sea Standard has been cancelled by the Air domain without replacement. What arrogance and ignorance. Does the MAA realise that it is still invoked in, for example, the Army's flagship Infantry programme?


Look at what worked in the past, not what didn't work. You'll learn more.

[Distant Voice]

Does Mr Dunne really believe in what he says? I would have thought that any risk associated with aviation would be based on flying hours, or flights, and not man-years, as presented in RA 1210.

Anyway, both CAA and BP 1201 documents refer to Equipment and Operational risks. EASA was never mentioned in the question put by Angus Robertson.

House of Commons Hansard Written Answers for 15 July 2014 (pt 0002) (http://www.publications.parliament.uk/pa/cm201415/cmhansrd/cm140715/text/140715w0002.htm#14071576000075)

DV

[salad-dodger]

Does Mr Dunne really believe in what he says? I would have thought that any risk associated with aviation would be based on flying hours, or flights, and not man-years, as presented in RA 1210.

I would expect the risk to be understood in terms of flying hours, or whatever other scaling factor is relevant to the industry or field concerned, e.g. controlled flying hours for ATM. In the case of the MAA/MoD it then also chooses to 'normalise' this to risk to the individual per annum. All quite normal and allows comparison and measurement against HSE guidance and the MoD's legal obligations.

S-D

[Distant Voice]

I would expect the risk to be understood in terms of flying hours, or whatever other scaling factor is relevant to the industry or field concerned, e.g. controlled flying hours for ATM. In the case of the MAA/MoD it then also chooses to 'normalise' this to risk to the individual per annum. All quite normal and allows comparison and measurement against HSE guidance and the MoD's legal obligations.


Thanks S-D, I understand that logic, but working backwards what does the risk of one death in 1000 per year mean in terms of flying hours? The HSE figure was arrived at for people in industry working a 40 hour week for, say 48 weeks a year. That equates to the risk of one death in 1,920,000 hours (1000 x 40 x 48), which is the boundary between Tolerable and Intolerable. Comparing like with like, that would mean the tolerable level for the Tornado risk was better than 1 in 1,920,000 flying hours, which I do not feel is being achieved. The figures, Class A misses and collisions per year, do not stack up to anything like that.

DV

[salad-dodger]

DV. The risk should be worked out for the individual's exposure, so one would need to take into account factors such as fleet size, flying hours for the fleet and possibly squadrons (depending on differences) and crews, types of flying/roles as they may carry differing risks and exposures. The risk is also calculated for 1st, 2nd and 3rd parties, broadly speaking you could probably think of that respectively as aircrew, ground crew and the public. I'm not familiar with the Tornado, but that breakdown won't be far off.

All of this would then be used to calibrate the risk classification matrix, especially the boundaries between intolerable and tolerable/ALARP.

S-D

[tucumseh]

Regardless of the finer points of Risk Management the real problem here is that the MAA in its present form is not the answer.

Primarily because it simply will not acknowledge what the question is.

People didn't die because the regs were wrong. They died because senior staffs issued wasteful policies and then, to generate funding to conceal the waste, issued orders not to implement perfectly good regs (savings at the expense of safety). And to make sure they could not be implemented, withdrew funding. And too many obeyed.

None of this is in doubt. Original papers commencing June 1987 were submitted to Lord Philip. MoD's own auditors confirmed it in reports dated January 1989 and June 1996. Haddon-Cave ignored these reports and claimed the problem commenced in 1998. More recently, the MAA has been claiming 2002. (Allegedly the year Safety Cases were mandated. Contradicted somewhat by the 1992 policy mandating them for modification programmes, like Chinook and Nimrod. The Nimrod Safety Case task was conducted poorly in the early 2000s, but the real problem is that work on it commenced 10 years after it was first directed. And even then, prior to 1992 MoD required industry to have robust "safety arguments" - the only real difference was MoD management was vested in a different department). Sorry to repeat this, but the MAA continue to distort the truth by making these false claims in every presentation they give.

Until MoD/MAA acknowledges the truth, it cannot possibly proceed in the right direction. It has issued rafts of new or updated regs, but how to ensure staff will meet the legal obligation to implement them? This basic problem remains, and the upper echelons of DE&S is choc full of people brought up on the "safety is a waste of money" policy of the 90s/00s.

[Distant Voice]

The risk should be worked out for the individual's exposure, so one would need to take into account factors such as fleet size, flying hours for the fleet and possibly squadrons (depending on differences) and crews, types of flying/roles as they may carry differing risks and exposures. The risk is also calculated for 1st, 2nd and 3rd parties, broadly speaking you could probably think of that respectively as aircrew, ground crew and the public.

So, this is something that AOC 1 Group would be required to calculate, and defend at a FAI.

DV

[Madbob]

S-D

To assess risk in the way you suggest i.e. to relate it to an individual's exposure just ain't going to happen, commendable as it might be as a yard-stick of risk.

I'm long out of the RAF and my experience was in the 1980's.....back then the RAF lost close to 15 aircrew KILLED every year, that doesn't include those that were able to eject and survive, some of whom were badly injured in the process......

Losses were sometimes down to pure aircrew handling/operating error but many were partly down to poor risk management, others were due to structural failures (Buccaneer x2 and F4 x1) and the two biggest "gotcha's" were mid-air collisions and target fixation on a range or when doing a SAP.

The Jag Squadrons had it bad for a number of years particularly and reasons for this were many. Single seat, low level, marginal power excess (even on 2 :(:(), small wing, poor nav kit (NAVWASS) and a demanding role, particularly for the recce boys who also had a massive recce pod to lug around. Count the sqns..... 1 at Laarbruch, 4 at Bruggen, 2 at Coltishall and a big OCU at Lossie - say 8 squadrons with 200 pilots regularly flying them at any one time. Big if here, if you were on a three year tour (so were one of those 200) and 5 crew were killed every year from the Jag world you'd be looking at 7.5% as being the probability that you might be DEAD in 3 years.......similar stats could be found in the Harrier world too I suspect.

I could put names and faces to a number of those killed in accident then:(:( and I am only glad that in spite of this accident, they are far less frequent than they were 30 years ago. Other similar accidents that spring to mind are the Harrier mid-airs over Wisbeach and Otterburn, a Jag/Tornado mid-air and a Jag/Jag mid-air in Cumbria, a Jag/Cessna in Wales, a Tornado/JetRanger mid-air in Lancashire and various range-related accidents from Holbeach/Wainfleet/Tain, Capa Frasca and Nordhorn.

None of this excuses the behaviour of the MAA/MAIB/MoD but I think sometime it is best to have a certain amount of perspective. Flight safety was far from perfect 35 years ago. Did accident rates deter me from wanting to be a pilot or from flying a particular aircraft type? Answer NO. Would today's flight safety regime deter me from flying in the RAF today? Again NO. Could the RAF/MoD do more to improve flight safety? Answer... an emphatic YES.

But just as many aircrew in WW2 had to make do with going to war in obsolescent equipment with aircraft such as Fairy Battles and Bristol Blenheims, even biplanes such as the Gloster Gladiator years after they had been superceeded by aircraft such as the Mosquito and Spitfire it is not reasonable for every platform in service to be the latest model.

The chance of a fatal accident if flying SLF in a civil airliner is something like 1.6 x 10( - power 6). It will never get anywhere near that in military aircraft ops (even in peacetime) and if the goal is to do so the only way that to be achieved would be to ground all mil a/c now.

The lesson here is surely, learn from this accident, try an mitigate future risks (within reason), remember with affection those killed, and carry on with what aircrew do best - FLY.

MB

[salad-dodger]

MB

You are wrong, this is the approach that is already being taken. It might not be perfect yet, it might not be pan-MoD, but it is happening.

By the way when I say individual, I mean per person or type of operator, not Flt Lt X or Sgt Y.

S-D

[salad-dodger]

So, this is something that AOC 1 Group would be required to calculate, and defend at a FAI.
There is a blurring of responsibilities in the MoD between DE&S and the DH that causes problems in this area. The MRP tries to make it clear, but it doesn't work all that well in practice. The DH will say that only they can truly control the risk to life, i.e. the individuals exposure, and they would be right. But it is often DE&S, in combination with the supplier, who really (should) understand the equipment and how it contributes to the risk. So in reality, they need to work together.

I will leave you to decide who should prepare the risk assessment and have to defend at any FAI.

I don't think you need the links below DV, but they may be of benefit to others:
http://www.hse.gov.uk/risk/theory/r2p2.pdf
and
http://www.hse.gov.uk/pubns/indg163.pdf
These are the UK HSE's interpretations of the law and how to comply. Clearly the examples used are much simpler than military aviation, but the basic principles are the same and the law applies equally to simple and complex systems.

Of course the other major problem the MoD has is applying this to different scenarios, e.g. combat or combat support versus routine training etc. The crew of XV230 would have been exposed to pretty much the same (AAR related) risks on a training mission as they were flying over Afghanistan. The main difference is the benefit that is being delivered by taking the risk. That is very hard to measure and why that decision sits with the DH. Of course, if your safety assessment and safety case is so badly flawed that you don't even know or understand the risk, then..................

S-D

[tucumseh]

salad-dodger

You are not my target audience because you understand. I repeat myself because the turn-over in a 250+ strong MAA, and the wider MoD, must mean a great many at any one time do not understand and/or are not told the truth.

Please carry on discussing the finer points. It is interesting to see how often MoD has changed its approach to risk analysis, risk evaluation and risk management. With the passage of time, MoD policy and practice has become ever more contradictory. My approach was, when in doubt, adhere to the Chief Scientific Advisor's Guidelines for Technical Scrutiny. (Called "Guidelines", but mandated upon all Air Systems Controllerate staff).

[tucumseh]

There is a blurring of responsibilities in the MoD between DE&S and the DH that causes problems in this area. The MRP tries to make it clear, but it doesn't work all that well in practice. The DH will say that only they can truly control the risk to life, i.e. the individuals exposure, and they would be right. But it is often DE&S, in combination with the supplier, who really (should) understand the equipment and how it contributes to the risk. So in reality, they need to work together.


Excellent.

Now read Wg Cdr Spry thread and the comments on the new definition of Functional Safety. It then becomes obvious why there is blurring and confusion.

A key question is, for EQUIPMENT fitted to an AIRCRAFT, who owns the Equipment Safety Case? And what happens when the Equipment Safety Case is valid for one aircraft, but not for another?

The answer and how to manage the risk has always been well known. But not resourced and no longer taught. To such a degree you now get Wg Cdr Spry's safety organisation getting the definition completely wrong. That means DE&S and RqMs no longer have a policy basis for financial bids to do the job properly.

This failure contributed significantly to the Tornado/Patriot and Sea King ASaC accidents in 2003 and, of course, Nimrod XV230.

[Easy Street]

DV,


Round numbers only: if the normal annual activity rate of a Tornado crew is 200 flying hours per year then the tolerable (according to RA1210) incidence of fatal mid-air collision, based on first-party casualties only, is one fatal collision per 100,000 flying hours (on the assumption that both crew are killed). This is 500 crew-years' worth of activity. If there are 50 Tornado crews at any one time, this is one fatal collision every 10 years.


Even though I've picked deliberately round numbers, you can see that these are much more 'in-the-ballpark' than the millions of hours you quoted. Another point is that Cat A airproxes are not fatal. Not even all mid-air collisions are fatal (I can think of at least 5 off-hand in which all survived, whether through ejection or safely landing the damaged aircraft). So airprox and collision rates don't provide as straightforward an input into the risk calculations as might be expected.

[tucumseh]

Round numbers only: if the normal annual activity rate of a Tornado crew is 200 flying hours per year then the tolerable (according to RA1210) incidence of fatal mid-air collision, based on first-party casualties only, is one fatal collision per 100,000 flying hours (on the assumption that both crew are killed). This is 500 crew-years' worth of activity. If there are 50 Tornado crews at any one time, this is one fatal collision every 10 years.


Serious question.

Having abandoned such numerical assessments on legal advice (issued by DLS(RAF) in 1992), when did MoD start doing it again, and why?


RAF Cranwell and Controller Aircraft started including this in their training at the same time as the repeal of Section 10 of the Crown Proceedings Act (1947). The CAA the same year.

[Distant Voice]

If there are 50 Tornado crews at any one time, this is one fatal collision every 10 years.


We are not talking about fatal collisions, we are talking about RISK of collision, or risk to life (RtL), and that is what RA 1210 fails to address.

Another point is that Cat A airproxes are not fatal. Not even all mid-air collisions are fatal (I can think of at least 5 off-hand in which all survived, whether through ejection or safely landing the damaged aircraft). So airprox and collision rates don't provide as straightforward an input into the risk calculations as might be expected.

Sorry, but according to DG MAA the only thing that prevents a Class A from not being a collision is "luck". It was "bad luck", according to him, that played its part over the Moray Firth in July 2012. So every Class A is a potential collision and a RtL. Seven Class As and one collision during 2012 and 2013 is not a tolerable situation.

Do not follow your figures. How do you arrive at 100,000 flying hours based on the 1 in 1000 rate?

DV

[Lima Juliet]

DV

I sat on the UK AIRPROX Board for 3 years. Your analysis of Cat A is flawed in my opinion; if you look at risk of collision and RTL then you could argue that every time 2 seperate aircraft get airborne there is a RTL and risk of collision!

Even a Cat A doesn't tell the full story as in most cases the assessment is purely subjective - don't forget the definition of an AIRPROX...

An AIRPROX is a situation in which, in the opinion of a pilot or air traffic services personnel, the distance between aircraft as well as their relative positions and speed have been such that the safety of the aircraft involved may have been compromised. (ICAO Doc 4444: PANS-ATM).

I've added my bold for reference.

Sometimes a Cat A AIRPROX was not a unanimous vote - so that could also blur the overall picture when a panel of a dozen or so Board members could all have differing opinions.

All said, the UK AIRPROX Board data is useful for an indicator of risk, but needs to be done carefully if it is to support any safety case. In my humble opinion of course.

LJ

PS. Here are the categories (note not classes or classifications):

Risk Ratings

Risk level assessments are made on the basis of what actually took place and not on what may or may not have happened. There are four categories, A - D agreed at international level, and one UK category, E, as follows:

A Risk of Collision: aircraft proximity in which serious risk of collision has existed.
B Safety not assured: aircraft proximity in which the safety of the aircraft may have been compromised.
C No risk of collision: aircraft proximity in which no risk of collision has existed.
D Risk not determined: aircraft proximity in which insufficient information was available to determine the risk involved, or inconclusive or conflicting evidence precluded such determination.
E Met the criteria for reporting but, by analysis, it was determined that normal procedures, safety standards and parameters pertained.

[dervish]

IMHO the last 2 posts emphasize the confusion that reigns. What Leon says sounds sensible, but DV was just quoting what the MAA DG said. And DV is right saying it is risk of collision that's at issue, not an outcome of collision.


And then further confusion raised by the legal services advice issued 22 years ago. I think that's a quite important question because if no-one knows why MoD changed back again to using numbers, how do we know if the legal advice itself was changed? That would be another reason to question the validity of RA1210. :\

[Distant Voice]

if you look at risk of collision and RTL then you could argue that every time 2 seperate aircraft get airborne there is a RTL and risk of collision!


Not really. Both the MAA and CAA use "Bow Tie" to assess risk. The Hazard, as defined by both, is aircraft operations in Class G airspace. A RtL incident is created when there is loss of control of the Hazard, the MAA indicate that as being an AirProx, and the MAA as being "aircraft in close proximity of another aircraft that their safety is compromised" - Airprox?

So it could be argued that there is a RtL for every Airprox, but I limited it to Class A.

By the way, RA 1210 states that "near misses" should be taken into consideration when assessing risk.


DV

[Easy Street]

Do not follow your figures. How do you arrive at 100,000 flying hours based on the 1 in 1000 rate?

In hindsight the flying hours are a bit confusing and are not necessary to reach the 'one fatal collision every 10 years' conclusion:

Tolerable first-party fatality rate = 1 per 1000 population at risk per year (RA1210)
therefore
Tolerable number of first-party fatalities per year = Population at risk / 1000
which equals
(Number of crews * 2) / 1000
which equals
Number of crews / 500

If there are 50 crews then the tolerable first-party fatality rate is 0.1 crew per year, or one crew per 10 years.

The amount of flying that would be conducted in that period is:

(200 hours per crew per year)*(50 crews)*(10 years) = 100,000 hours

[Distant Voice]

I understand that AVM Atha (ODH) did not sign off on the No 1 Group Tolerable and ALARP statement until 31st Oct 2013, which is about the time the SI board concluded their investigation. The question has to be asked, "Who was responsible at the time of the accidient?"

DV

[Distant Voice]

Just read that the probabilty of a collision event per flight hour between GR4 and another military aircraft is 4.30E-07 (1 in 2,325,581). The statement goes on to say that assuming 212 hrs of flying per crew per annum, this calculates as a per annum risk of collision with military aircraft of 1 in 10969.

But there are 94 crews, each flying 212 hrs, which gives a annual flying rate for the fleet of around 20,000 hrs. Isn't this the figure that should used, which gives a annual risk of collision for the fleet as 1 in 116?

DV

[Wrathmonk]

DV

I can see what you are trying to show but in my non-mathematicians mind I would say the first paragraph is correct because it is pertinent to one crew at a time and only when they fly (and because all 94 crews could never be airborne at the same time). There will be an element of "fudge" for the number of military aircraft airborne at any one time (which may be higher or lower at any particular time of day or location). If the figures in para 2 were correct most RAF aircrew would have at least one midair per year (based on an average sortie length of 1.5hrs)!

[Onceapilot]

Well, I can think of 5 unsighted RAF Tornado mid-air's where all 10 aircraft (not all Tornado/Tornado) were lost, and several others where they did see each other.

OAP

[Distant Voice]

Watched several Tornado aircraft head north yesterday from Lossiemouth to the Tain range. I sincerely hope that all colision warning mitigations are in place and that the aircraft are not operatiing with the sort of limitations that were in place at the time of the accident over two years ago. No word yet on the Warton CWS trials.

DV

[Distant Voice]

This is the latest from MOD on the CWS (TCAS II) fit. It has always been my belief that the TCAS programme was part of a stalling game so that the risk could be declared ALARP. It will never be fitted to Tornado, but remain as an ALARP programme.

http://www.theyworkforyou.com/wrans/?id=2014-10-15.210783.h&s=speaker%3A11189+section%3Awrans#g210783.q0 (http://www.theyworkforyou.com/wrans/?id=2014-10-15.210783.h&s=speaker%3A11189+section%3Awrans#g210783.q0)

DV

[gasax]

I read these threads with a combination of dread and hope. This one has headed in the dread direction unfortunately.

If the MOD are genuinely using Bowtie type methodologies without a proper numeric or quantified assessment they are being deliberately casual and legally non-compliant (suitable and sufficient risk assessment!).

The risk which the previous posts have struggled with have confused posters. With a fleet the risks which must be assessed are the fleet risks - not the individual crew risks. If you have 40 aircraft then the 40 aircraft need to be protected. Protecting one aircraft makes for a 'lucky' crew or two but does not address the fleet issues.

If potential collisions are occurring - and I'll accept that the category or assessment does make a real difference then this is a pretty poor situation where there is an obvious technical 'fix'. Simple cost benefit takes the cost of the modification versus the cost of life saved - severely modified by the ready availability of a technical solution which could easily be incorporated into standard operations.

For training operations to subject aircraft crew to a real collision risk seems to me utterly appalling. Simple procedures could eliminate it. If you decide to operated aircraft in close proximity under high stress situations as a matter of training realism or something similar then sensible engineered barriers become essential - apart it would seem in the MOD .

[tucumseh]

If the MOD are genuinely using Bowtie type methodologies without a proper numeric or quantified assessment they are being deliberately casual and legally non-compliant (suitable and sufficient risk assessment!).

I've closely followed DV's excellent work on this accident and made a number of observations.

1. Numerical risk assessments were outlawed by the CAA in the early 90s and MoD immediately fell in to line. They have never explained why they have (apparently) changed back. It must be very confusing to those FEW in MoD who actually do Risk Management.

2. Throughout the 90s and 00s, MoD's stated policy on Risk Management was - "Wait to see if the Risk materialises, then do something". In furtherance of this poilcy, programmes were denied the mandated resources to appoint a Risk Manager. The inevitable happened - MoD lost its corporate knowledge. (Read the Wg Cdr Spry thread!) When something happened, it often involved loss of life. Accidents that fall in to this category include Sea King ASaC, Tornado/Patriot, Nimrod, C130, Chinook and this one under discussion. That is, the Cause(s) and Contributory Factors were all known and notified years in advance, and conscious decisions made to wait to see if they materialised.

3. Allied to this, and your own comment, in this period MoD policy was to ignore altogether the concept of trend failures and the need to apply mitigation to the WHOLE fleet. In particular, Adam Ingram when Min(AF) stated a number of times in the mid-00s that it was completely irrelevant if a serious safety fault was known to exist in one tail number; that could not be used as evidence of the POSSIBILITY of the same fault existing in any other in the same fleet. This was utterly deranged but a natural progression from the Chief Engineer's policy of 1991 to cease all trend failure analysis, as part of his policy of running down the management of airworthiness.

There are exceptions to the above, but only because some decided to ignore these policies. In April 2005 MoD claimed in a briefing to PUS that, as of September 2004, none were left in MoD; but I'd disagree. Perhaps a handful do. It is those few who aircrew rely upon. Everyone needs to understand that for well over 20 years they have been the subject of outright hatred from senior staffs.

But latterly, in particular this last year and coinciding with the appointment of the new CAS, it has been very noticeable that MoD's approach has changed, at long last. Why? It is tempting to speculate he has read the evidence withheld from him in 1994. And to address your point; their answers in this case may claim they use Bowtie, but the detail they contain reveals many don't understand it or find it difficult articulating an answer when they know fine well the rules they operate under are so contradictory. The above explains why.

[Chugalug2]

tuc:-
with the appointment of the new CAS, it has been very noticeable that MoD's approach has changed, at long last.Then time is of the essence and cannot be wasted with yet more new initiatives and yet more sign writing within the MOD. Too many people have died, and too many lives are still at risk. UK Military Airworthiness Provision must come under an external and independent Regulator, headed by a civilian DG (though still call it the MAA by all means).

Ditto all that for the MilAAIB, which must also be independent of the MAA.

Then and only then can the long and weary business begin of making the CAS's fleets airworthy again.

Self Regulation Doesn't Work and in Aviation It Kills!

[gasax]

Thank you both for the explanation and background. My risk management is around what people like to call 'high integrity' organisations - which is often something of an oxymoron!

Self regulation can and does work - but the organisation has to have some decent values and ethics, and sanctions. In the MOD the only sanction appears to have been promotion! Haddon Cave did at least ruffle some feathers but...

Most of my work is with the HSE - HID and peripherally the CAA. neither organisation can bee said to be a shining light. The HSE do have some good people, CAA oversight has been casual at best.

There is no magic bullet but I read there are further delays in equipment fit to address this issue - politically I suspect they hope the Tornado will be out of service before the kit has to be fitted.

Perhaps it is naïve to expect the military to have much of a conscience and so at least an 'arms length' regulator would be better.

[Chugalug2]

gasax:-
Self regulation can and does work - but the organisation has to have some decent values and ethics, and sanctions.We'll have to agree to disagree over that one. My belief is that Self Regulation is the British Disease, whether it be by the Police, Doctors, Lawyers, or the MOD. Of course those who come under those headings will be outraged at such a suggestion and angrily testify to the dedicated and honourable people that regulate their particular patch. Well they would, wouldn't they?

The particular problem with aviation is that it is trying to kill you all the time and only professional and expert input at every stage from start to finish will lend itself to obviating such malevolent intent. The particular problem of the UK Military's particular problem is that professional expertise was arbitrarily dispensed with by the RAF Chief Engineer and replaced by those prepared to sign off the Regs as complied with, even though they hadn't been. A few years of that and there is an irredeemable gap in the continuous auditing process that is the very lifeblood of Airworthiness Provision.

That such suborning can be occasioned by a few VSOs is the reason that UK Military Airworthiness must be vested in an independent Regulator which it isn't right now. Ditto the MilAAIB.

it is naïve to expect the military to have much of a conscience and so at least an 'arms length' regulator would be better. More disagreement. It isn't the UK Military that lacks a conscience. I would suggest that there are generally higher moral standards and empathy in the UK Armed Forces than in the UK Civil Population. It wasn't they that set out recklessly and malevolently to sabotage the very aircraft and equipment on which their lives depended, but those who inhabited the murky MOD corridors of power. They are not "the military", though I confess that many wore the uniforms of RAF VSOs. They had ceased to be "the military" the moment they set out to betray their juniors.

[Distant Voice]

Just noticed a note at the bottom of the "Hazard Data Criteria" page associated with Nimrod. The information comes from BP1201, which was the document used prior to the new MAA regs, and referred to in a letter, dated 11th Feb 2011, by AVM Bagwell (AOC No.1 Group). The note reads "The Baseline Safety Case generally employs only qualitative probabilities in risk assessment". Unfortunety, AVMs Bagwell and Atha appear to have gone down the "numbers" route in order to justify their Tolerable and ALARP statements. Numbers that were provide in a report by QinetiQ, and a report that MoD is having problems locating.

In addition they, with the aid of the new MAA regs, have been able to downgrade the frequency of the risk from OCCASIONAL to REMOTE. The original definition for OCCASIONAL was, "Likely to occur during the operational life of a particular fleet", and for REMOTE, "Unlikely to occur at all during the operational life of a particular fleet". We now have in the new regs, OCCASIONAL - "Likely to occur one or more times per year", and REMOTE - "Likely to occur one or more times in 10 years". So what was OCCASIONAL (or even PROBABLE) is now REMOTE. However, what is important is what was the true risk on the lead-up to the accident, and at the time that Bagwell and Atha signed off in 2011, it was OCCASIONAL (and CATASTROPHIC) which makes it an INTOLERABLE risk. I put the frequenct as being OCCASIONAL because between 1984 and 2009 the fleet was involved in a total of 9 mid-air collision accidents.

Normally, a combination of risk frequecy and severity determines the risk index; Broadly Acceptable, Tolerable, Undesirable or Intolerable, but this is no longer applied. Instead we compare the mathematial probabilty of a risk of death with a 1 in 1000 figure from an HSE document. A figure which is based on industry where people are exposed to a risk for some 2000 hours per year not 212 hours (Tornado aircrew), and a figure which the HSE have stated does not cover a flying environment.

If this is an example of self regulation then it is time to think again.

DV

[tucumseh]

Self regulation...........

MoD has this week advised Sir Jeremy Heywood KCB, CVO, Secretary of the Cabinet and Head of the Civil Service, that it should remain an offence to refuse to obey a direct order to make a false declaration regarding airworthiness and financial probity. To issue such an order is not an offence.

To obey such an order is to commit fraud and constitutes misconduct in public office.

Sir Jeremy accepted this advice and personally signed the letter containing his ruling on 28th October.

At least they're consistent. As far as I know, this ruling was first made in December 1992 by Director General Support Management (RAF), the immediate subordinate of the Chief Engineer. As you say, no values or ethics.

Count the dead......

[5 Forward 6 Back]

MoD has this week advised Sir Jeremy Heywood KCB, CVO, Secretary of the Cabinet and Head of the Civil Service, that it should remain an offence to refuse to obey a direct order to make a false declaration regarding airworthiness and financial probity. To issue such an order is not an offence.

To obey such an order is to commit fraud and constitutes misconduct in public office.

Sir Jeremy accepted this advice and personally signed the letter containing his ruling on 28th October.

This still amazes me; do you have a link to a copy of the letter, or is anything regarding this publicly accessible..?

[Wander00]

Have neither this ruling nor its logic been challenged in, nor considered by the higher courts

[baffman]

MoD has this week advised Sir Jeremy Heywood KCB, CVO, Secretary of the Cabinet and Head of the Civil Service, that it should remain an offence to refuse to obey a direct order to make a false declaration regarding airworthiness and financial probity. To issue such an order is not an offence.

To obey such an order is to commit fraud and constitutes misconduct in public office.

Sir Jeremy accepted this advice and personally signed the letter containing his ruling on 28th October.

Important stuff, but I'm puzzled as to what status such a ruling could have.

As you say tucumseh, obeying an order to make a false declaration is likely to result in a criminal offence, including an offence under the Armed Forces Act. Such an order would therefore be an illegal order.

I am well aware that it's not as simple as that in practice, but the law seems straightforward enough on that point, and I don't see what difference a letter from Sir Jeremy could make.

Incidentally, for the present the offence of corporate manslaughter is still available in extreme cases, subject to all the exclusions which apply specifically to the armed forces. However, some campaigners propose that the offence should be removed altogether from the armed forces, including in the UK and in peacetime.

[Distant Voice]

The 2011 version of MAA regulation RA 1210 makes two very clear statements;

"The goal of risk management is to show that safety risks can be tolerated and are at levels that are ALARP; merely identifying and mitigating risks is not in itself sufficient.

AND

"ALARP is essentially the "stopping condition" for risk reduction, so justifying and recording how this is reached is an important and vital step in safety management. A DH is required to make an argument that risks have been made ALARP; however, the validity of this argument can only be decided definitively by the courts, if an accident occurs." [My emphasis]

As AVMs Bagwell and Atha both signed off in 2011 to say that the risk of collision was Tolerable and ALARP, and an accident has occurred, then it is mandated that they should stand up in court and justify their decisions. The place to do that is the FAI.

DV

[Chugalug2]

baffman:-
...the law seems straightforward enough on that point, and I don't see what difference a letter from Sir Jeremy could make.All the difference in the world I suspect. The MOD has previous regarding sticking to the verdicts of its various kangaroo courts and discounting all evidence to the contrary. Remember the "no new evidence" mantra over the Mull of Kintyre ROs Finding?

Their stance is one of prevarication and obduracy no matter what is put before them. With the unwillingness of the likes of the Provost Marshal and the Thames Valley Police to investigate the alleged issuing of illegal orders by RAF VSOs, it seems that the MOD alone is responsible for enforcing that particular aspect of Military Law. Unsurprisingly it chooses not to do so either. Yossarian would have understood, I'm sure.

[tucumseh]

Thank you for your comments. I could have chosen any number of relevant threads to post Heywood's ruling on, but did so here to highlight the absurdity of the MAA's position in this ongoing Tornado case. The ruling itself is nothing new, and will not change as long as senior staffs are permitted to judge their own case. My point is, the MAA is fully aware of it and, apparently, say nothing. Or if they do, they're quickly put back in their box.

DV rightly points out what the new MAA regulations say (the same as the old regs). The bit about "merely identifying and mitigating risks is not in itself sufficient" is key here, because directly linked to the above ruling is the practice that identifying the Risk in the first place is not to be tolerated; never mind mitigating, validating and verifying the mitigation and keeping correct records of all actions. The same people made that ruling and robustly implement it. On 15th December 2000 the 2 Star in charge of, inter alia, Nimrod MRA4 and Chinook (Mr Ian Fauset CB), used adherence to this regulation as justification for upholding disciplinary action. To many that may seem a lifetime ago, but Heywood's letter (above) actually refers to that case, citing Fauset's ruling. (As MoD point out, I am the only person who disagrees with this ruling, so there can be no objections to naming the people who apparently speak for the entire MoD and Government!)

The contradictions are clear, as is MAA's position, lodged firmly between a rock and hard place. The only way to break free is to be independent. They are headed by a raft of senior officers, up to 3 Star rank, and there is no way in this world any of them will stand up for you in the face of such rulings by their mentors. If any want to prove me wrong, please get in touch and I'll supply ALL the relevant papers. But wait, you already have them because they were provided in the evidence pack to Lord Philip, which you saw before his report was issued. And I KNOW your bosses, past and present, have read it again more recently.

As I've said before, MoD relies on the fact very few current or ex employees have the financial means to take such a matter to court. In the UK the Government offers no assistance in such cases. Corporate Manslaughter? A key component of proving this is identifying a "directing influence". Any reasonable person would consider the above ruling a bit of a giveaway, but Ministers, CPS and Police are willfully blind.

[Distant Voice]

MoD admits failure to fit Tornado collision devices - The Scotsman (http://www.scotsman.com/mobile/news/uk/mod-admits-failure-to-fit-tornado-collision-devices-1-3669923)

Does anyone know during which scheduled servicing TCAS is being fitted?

DV

[peppermint_jam]

DV, based on the ammount of work needed, I'd guess it'd be either tied in with minor/major if due, or the selected aircraft would be called in to the sheds purely to have the MOD embodied.

[Distant Voice]

“While the introduction of TCAS on Tornado will add an additional layer of safety, there are already a multitude of measures in place to minimise the risk of midair collision.”

MoD, and their advisers, still do not know the difference between "Prevention Controls" and "Recovery Controls".

DV

[Distant Voice]

On 27th Jan, MoD stated,

Trials in the Tornado GR4 aircraft have revealed that modifications are required to existing aircraft hardware and software in order to ensure compatibility with the Honeywell Traffic Alert and Collision Avoidance System II (TCAS II). Work is continuing to resolve these issues and once further trials and testing has been completed we will be in a better position to determine when the full capability will be available. The Ministry of Defence is committed to obtaining early beneficial use of TCAS II and is embodying the system in as many Tornado GR4 aircraft as possible to operate, initially, in Traffic Advisory mode.

Seems as though there is an integration problem, reminiscent of the Tornado/Patriot issue back in 2003. Let's get it right this time (BAE Systems have only had the contract for two years). We do not want the CWS problem to be made worse by the "It worked OK on the bench, Chief, so it must be OK in the aircraft" approach.

DV

[Tester_76]

"It worked OK on the bench, Chief, so it must be OK in the aircraft" approach.

It does work on the aircraft - those in the know can read the 41(R) OpEval and Advice to Aircrew reports which followed BAES trials last year.

[Distant Voice]

Tester you say,

It does work on the aircraft - those in the know can read the 41(R) OpEval and Advice to Aircrew reports which followed BAES trials last year.,
This seems to be at variance with what MoD and others are saying. It may be working on the aircraft but there appears to be problems with integration. The IFF mode 4 worked on the aircraft back in 2003, but it was not correctly integrated.

DV

[dervish]

Tester 76

Reading the reports, DV is right. OK last year doesn't mean ok in 2003 and 2012. It just means someone might have eventually done their job properly after too many fatalities.

DV Has the legal profession decided if this is to go to fatal accident inquiry yet?

[Distant Voice]

DV Has the legal profession decided if this is to go to fatal accident inquiry yet?

The simple answer is NO.

Fatal Accident Inquiries in Scotland are held in terms of the Fatal Accident and Sudden Deaths Inquiry (Scotland) Act 1976. There are two classes of inquiry in terms of the Act, mandatory inquiries in terms of Section 1 (1) (a) of the Act which apply to deaths which have either resulted from an accident occurring while the person was in the course of his or her employment or where a person was at the time of their death in legal custody, and Section 1 (1) (b) which covers all the rest and is at the discretion of the Procurator Fiscal.

On the face of it it seems a clear cut case that the Tornado deaths fall under Section 1 (1) (a) and an FAI is mandatory. However, the current debate is about whether or not members of the services are employees. MoD believe they have special dispensation under Scottish Law which places service member in the Section 1 (1) (b) category. That is why we did not have an FAI for the Glen Kinglass accident back in 2009.

This interpretaion goes against the ruling of Lord Neuberger in the Snatch Land Rover case. He declared the members of the services are employees and MoD is their employer.

DV

[Chugalug2]

DV:-
the current debate is about whether or not members of the services are employees.I wonder if members of the UK Services consider themselves to be employed or not? I certainly did. Perhaps we should get NZ Judge Lowell Goddard to give a ruling, on the same basis that she is investigating child abuse in the UK, ie that she is not part of the British Establishment.

[dervish]

Thanks DV. So, I've been unemployed most of my adult life. Backdated benefits?

Seriously though, does that mean the Mull of Kintyre FAI was in to the passengers and not the RAF crew? It'd explain why MOD thought it could ignore the sheriff.

[Distant Voice]

Seriously though, does that mean the Mull of Kintyre FAI was in to the passengers and not the RAF crew? It'd explain why MOD thought it could ignore the sheriff

That is a possibility. The recent FAI into North Sea helicopter crash went ahead under the mandated route because civilians were involved. The Glasgow Pub accident will go the same route for the same reason.

Lord Neuberger stated, "The duty of care owed by the Ministry of Defence, as employer, to the members of the armed forces, as employees, does exist and has been recognised, without demur, by the courts. It includes a duty to provide safe systems of work and safe equipment.".

As Lord Neuberger is the President of the Supreme Court of United Kingdom, of which Scotland is a part, his ruling must cover all legal systems. In the case of the 2012 Tornado accident MoD (the employer) failed to provide a save system of risk assessment and safe equipment for the three crew members (employees) who lost their lives. The way forward seems clear to me.


DV

[alfred_the_great]

It depends - was it ALARP, noting that "reasonable" includes cost implications.

[Distant Voice]

It depends - was it ALARP, noting that "reasonable" includes cost implications.

Do not understand the point you are trying to make. ALARP has got nothing to do with FAI.

DV

[alfred_the_great]

An Employers responsibility to an Employee on H&S grounds, which is what I think your quote from Lord N referred to (given the "safe system of work" section), is based on a principle of ALARP.

[Distant Voice]

An Employers responsibility to an Employee on H&S grounds, which is what I think your quote from Lord N referred to (given the "safe system of work" section), is based on a principle of ALARP.

My reference to Lord N's ruling was to support the claim that members of the services are employees, and that the mandatory route of the FAI act should be followed.

Safe means more than ALARP, it means Tolerable and ALARP (you can not have Intolerable and ALARP). According to the MAA RA the Duty Holder is required to justify his Tolerable and ALARP statement in a court of law, in the event of an accident. Let's not forget that this so called "safe system" resulted in the death of three people and the loss of two aircraft.

DV

[alfred_the_great]

It could indeed be safe with the death of 3 people; safe does not equal zero deaths.

[Chugalug2]

safe does not equal zero deaths.

So safe does not equal safe then?

[airpolice]

I suspect he means that Zero Deaths does not equal Safe.

[Chugalug2]

Well I don't AP, when he also says:-
It could indeed be safe with the death of 3 people

[PeregrineW]

I work as a safety engineer in the UK rail sector. Although the rail sector has its own standards (national and European), all of these are subservient to the law of the land, i.e. the Health and Safety at Work Act.

It's a long time since I worked for the MoD in any capacity, and my service predates the MAA and a lot of the new thinking surrounding safety of military aircraft, so please forgive me if I make any erroneous statements or assumptions about the manner in which the law applies to military aircraft in the 21st Century.

The ALARP principle (or SFAIRP - So Far As Is Reasonably Practicable in HASAW terms) is quite simple to apply in theory. All risks must be reduced to a level that is tolerable (what is meant by "tolerable" must be defined in the responsible organisation's Safety Management System) and furthermore must also be reduced to a level that is As Low As Reasonably Practicable. At this stage, as has been pointed out, cost comes into the equation.

Basically, what has to be done is this. For each risk, once it has been mitigated down into the "tolerable" region, further mitigation measures should be sought, and MUST be implemented UNLESS it can be shown that the cost of doing so is grossly disproportionate to the safety benefit to be realised through implementation of this mitigation.

In the UK rail industry, grossly disproportionate is generally taken to mean more than three times the safety benefit, measured in terms of equivalent fatalities. The VPF (Value of Preventing a Fatality) is around £1.7m, more if we are talking about multiple deaths (due to public aversion to this sort of accident).

So, if your identified safety measure will cost £3m to implement, but will save at least £1m in equivalent fatalities, then it must be implemented in order to justify ALARP.

Of course, it's never this easy in practice, as the true cost and value is always open to argument and horse trading. And we don't expect, with any complex system, to ever achieve zero fatalities. The word "safe" actually means "acceptably unsafe", although no-one will ever use that phrase in a safety case...

[alfred_the_great]

But if the cost of putting into place a mod is £50 million, and would only save 5 lives, then it can be considered too much and set aside under an ALARP principle.

[PeregrineW]

Well, I don't know what the figure is that the MoD uses for VPF, but on those figures, in the rail industry, the £50m mitigation would not be implemented, and the current solution would be deemed ALARP (always assuming that the risk without mitigation was not intolerable).

[tucumseh]

Elephant in room...... MoD 2 & 4 Stars, successive Mins(AF) and Head of Civil Service (e.g. Sir Jeremy Heywood only last October) have trumped the ALARP and VPF principles by formally ruling such systems need not be functionally safe. They may be fitted, but they don't have to work. MAA are aware and are party to these rulings, two senior RAF officers having been named therein. Privately, I know they don't agree, but must do as they're told or resign. The trouble with the MAA being under the MoD thumb.

First things first. Sort that one out.


PeregrineW - good post. The figure in MoD used to be about £4M but is now the £1.7M you quote.

[PeregrineW]

Back in my Boscombe Down days, we were pushing to have all software on which the safety of the aircraft depended subjected to static code analysis (proof of software correctness). We had some success with this on the C130J project, but were told that the upgraded Harrier HUD didn't need to be developed in this manner as the HUD wasn't the "primary source of speed, attitude, and altitude information" for the pilot. Instead, he was supposed to refer to the basic air/gyro operated instruments, which were mostly obscured by his knees and certainly not directly in his line of sight.

In those days, Their Airships used to make it up as they went along, and it seems times haven't changed much!

[tucumseh]

PeregrineW

Your words will be ringing bells with those old hands familiar with the Mull of Kintyre case. Here is an extract from the main submission to Lord Philip's review, which he accepted. It seeks to establish that MoD lied about Boscombe and Static Code Analysis, and MoD were less than amused that the actual policy author came forward to confirm MoD lied.


Extract.... (sorry, formatting may be odd) (Discussing MoD's claims....)

Boscombe Down Tasking


It is therefore wrong to say;


“Boscombe Down wished to verify the software in the FADEC system using their preferred method known as Static Code Analysis.”


It is irrelevant what Boscombe “wished” to do; the responsibility to reconcile the FADEC specification, contract terms and conditions, Trials, Evaluation and Acceptance Plan, Boscombe Down tasking and their ability to carry out that tasking lay entirely with MoD. It failed in this duty.


The following is also wrong.

“The Department chose to terminate the EDS-SCICON contract at this point because the requirement for Static Code Analysis was an internal Boscombe Down policy, not supported by Defence Standards.”

Clearly, the requirement to conduct SCA was enshrined in MoD policy, which (obviously) sits above Defence Standards in the standards hierarchy. In fact, the policy specifically warns, at Annex A, A8.2 (Standards), that RTCA DO 178A and Def Stan 00-31 are less than rigorous as they do not include SCA. RTCA DO 178A was the standard against which FADEC was developed. Such a specific warning in the policy should have raised alarm.


(and a little later...........)



Summary


DUS(DP)’s policy invokes Static Code Analysis. Subsequently, Def Stan 00-55 confirmed and detailed two basic approaches to safety critical software:


· The use of formal methods (correct by design), and,
· The static analysis of the code (conformance with the design)


The nature of FADEC software required (in the words of DUS(DP)’s policy) “sophisticated mathematical proving”. SCA is such a methodology and, to this end, Boscombe Down was provided with MALPAS and SPADE.

[Distant Voice]

A CBA report, prepared during 2011 by DSTL for the implementation of CWS on Tornado GR4 aircraft, came up with an overall cost of £7 million for each life lost. This includes all training cost. The report also recommended that a Gross Dispropotion Factor (GDF)of 9.9 be used, where, according to HSE guidelines, 10 is at the Tolerable/Intolerable boundary and 1.0 at the Tolerable/Broadly Acceptable boundary. So you can see how expensive the 2012 collision was; £210 million. Not ALARP.

In his Tolerable and ALARP statement of 11th Sept 2011 AVM Atha used an overall cost figure of £4 million and a GPF of 1.0. He also concluded that, based on historical data, that there would be one fatality over the next 25.8 years, which equated to 0.15 fatalities before the OSD. He came up with an disproportionate cost of just £0.6 million and declared the risk as being ALARP

That is why AVM Atha must explain the justification for his statement in a court of law, as per MAA regulations.

DV

[Easy Street]

If we're expected to believe that marginal gains in safety justify the investment of £70m per life saved, then the safety system will eventually eat itself through poor behaviours as people desperately try to preserve capability. Can you imagine the fuss if it turned out an equivalent amount was being invested in life-extending drugs by the NHS?

[dragartist]

Did those involved in 230 not frig the numbers to make it look better than it actually was.


Easy, reading between the lines I don't think people are that interested in preserving capability. The reason I say this is that a good number of my ex colleagues have moved away from jobs developing capabilities to positions of monitoring with "safety and airworthiness" in their job titles in order to retain their jobs.

[Chugalug2]

ES:-
Can you imagine the fuss if it turned out an equivalent amount was being invested in life-extending drugs by the NHS?False analogy. The equivalent fuss would be that millions had been cut from life extending drugs development, but that they had been signed off as fully developed and life extending anyway, and then prescribed by the NHS with resulting needless deaths and massive costs down the line.

What goes around comes around, and it is all around us at the present. As tuc says, unless and until the elephant in the room is acknowledged by the MAA and dealt with accordingly there are going to be more needless deaths, more added costs, and an ever greater debilitating effect on capability.

MRA? You ain't seen nothing yet, this nettle needs grasping by what remains of the Royal Air Force and well before it gets that telegram from HMQ!

[Distant Voice]

ES I am not sure how you arrived at,

If we're expected to believe that marginal gains in safety justify the investment of £70m per life saved

An investment of around £56 million for fleet embodiment could have saved the lives of three people, valued at £210 million; hardly a marginal gain.

DV

[tucumseh]

I think we all appreciate there isn't, and can't be, a one size fits all policy. That is one of the main reasons why certain key staffs are required to exercise engineering judgement. I happen to agree with this policy. What I don't agree with is the practice whereby staffs with no engineering background whatsoever are permitted to self delegate and overrule properly formulated decisions, or make engineering decisions that are manifestly unsafe.



The other key aspect is if you study the accidents we discuss here, Chinook ZD576, Nimrod XV230, Hercules XV179, Tornado ZG710 and so on, in all cases simply following the regulations would in all probability have prevented the accident (by eliminating events and factors that led to cause) and that in most cases this would have been cheaper and quicker. None of these aircraft satisfied the design and airworthiness regulations (which are all about safety).



As an example, one time I was faced with such an overrule, on an IFF system, the project office responsible flatly refused to integrate Mode 4 failure warnings (the same primary factor that caused ZG710 to be shot down). This saved them the princely sum of SFA. All they had to do was refuse to pay up and the contractor would have had to do his job properly, which would have taken less time as they actually had to amend the design pack to ensure it was non-compliant!! Aircrew on detachment to Boscombe Down pleaded for the regs to be implemented and were ignored. When the aircraft was delivered to me (to conduct a mid life upgrade) it cost me £4M to do this work - and of course that doesn't count the modification work on the Fleet and the impact on Operational Effectiveness. As the money had already been spent (on nothing) the rules (quite rightly) said I could not be given any more, so as well as time and money being lost, some capability had to be sliced out of the aircraft spec. Both Director General Air Systems 2 (the Nimrod MRA4 and Chinook HC Mk3 2 Star) and the Chief of Defence Procurement specifically ruled all this was acceptable, and that the IFF project office had been correct to knowingly pay for, accept and deliver a functionally unsafe aircraft (which is to commit fraud). And the RN could swivel if they didn't like it. And swivel they did. And the RAF did nothing, despite a recommendation that they check their own IFF failure warning integration, hence ZG710 was unsafe on 22.3.03.


As ever, the MAA are aware and support these decisions.



The herd of elephants I talk about!

[tucumseh]

dragartist

jobs developing capabilities to positions of monitoring with "safety and airworthiness" in their job titles in order to retain their jobs.

You are quite right there. I know that in the RN the posts with "management" in their description (for example, what are called Requirements Managers nowadays) were changed to "monitoring" in 1988; as a result of the Hallifax Savings. The RAF formally followed a few years later, but in practice had already changed. RqM defaulted to MoD(PE), so it was a matter of sheer luck if the project manager had the necessary background. I detested those prats who said "Yes, I've monitored the situation, and know the aircraft is unsafe", and walked away.

In April 2003 MoD briefed PUS (the Chief Accounting Officer) that there was only one employee in DPA or DLO (now, broadly, DE&S but with many functions removed) who thought it correct to implement "safety and airworthiness" or financial probity regulations. That claim has a been repeated many times since by various Mins(AF). Clearly, it is wrong (although a few who believe it correct post here!), but it is another elephant that must be removed before the MAA can make any progress.

The frightening thing is, when signing such balls successive Ministers and Heads of the CS don't say "WHAT?!" and demand an explanation. And MoD has very senior staffs who actually think it clever to admit this to Ministers. Both lack the mental capacity to associate their policy with scores of avoidable deaths.

[pulse1]

Just came across this and thought it worth posting;

BBC News - No inquiry into Tornado crash deaths (http://www.bbc.co.uk/news/uk-scotland-highlands-islands-31859020)

[dervish]

The news is getting some coverage up here but from what I read on pprune this new excuse that the MAA investigation is sufficient doesn't stand up and is at odds with what the Procurator Fiscal and Crown Office have been saying.

[airpolice]

Tucumseh needs to get into a position where he can be asked some leading questions which will extract either answers or clear avoidance of facts.

If the decision not to have a FAI into this crash can't be overturned, then some local political pressure needs to be brought into play.

It's election time, some local activists should be getting a commitment from candidates to have this investigated.

AP

[The Old Fat One]

The news is getting some coverage up here but from what I read on pprune this new excuse that the MAA investigation is sufficient doesn't stand up and is at odds with what the Procurator Fiscal and Crown Office have been saying.

In a statement, the Crown Office said: "After thorough consideration of the circumstances of the case, Crown Counsel have concluded that all the relevant issues have been comprehensively examined in the course of the Military Aviation Authority report and could not have been better considered in any FAI.

I guess pprune is a bit off on then?

PS 10 seconds on Google is all it takes guys.

[Distant Voice]

This is about protecting very senior RAF officers who signed off to say it was safe to operate Tornado GR4 (Tolerable and ALARP) in Class G airspace without CWS. They should, according to MAA regs, justify their decision in a court of law. The previous DG MAA stated in a letter to the 2nd PUS in Feb 2011 that their assessment was flawed, and concluded by saying "I feel safe to assume that, were a catastrophic collision occur, those involved in delaying or deleting the programme would inevitably face detailed scrutiny."

Also, the Crown Office needs to bring its interpretation of "employee" in line with Lord Neuberger's ruling in the Snatch Land rover case. The crews were MoD employees, and this mandates an FAI.

DV

[dervish]

TOFO

Not sure what you're getting at there but distant voice's last post and lots more in this thread reveal a contradiction between what the MAA originally said and what the crown office now attribute to the MAA. Both should be required to clarify their position.

[Distant Voice]

In a letter dated 17 Dec 2010, released yesterday as a PQ, AVM Bagwell (AOC No1 Group DH) states that the Tornado collision risk "is currently assessed as ALARP (Temporal) as a CWS solution is due for delivery in 2013".

Sorry, AVM Bagwell, but there is no such thing as "ALARP (Temporal)". This is a state, now used by MoD, where DHs believe that as long as there is some sort of a programme in place, no matter how long, the risk can be considered to be ALARP.

The Temporal element applies to the "R" in ALARP, according to Lord Cullen's guidance in the Edwards v The National Coal Board case. In his findings "time or trouble" are linked and regarded as a "sacrifice", or costs to be borne by a company or organisation in order to achieve ALARP. To view "time" in the manner used by AVM Bagwell and MoD can only be seen as a let out, not a sacrifice.

DV

[Distant Voice]

Not sure what you're getting at there but distant voice's last post and lots more in this thread reveal a contradiction between what the MAA originally said and what the crown office now attribute to the MAA. Both should be required to clarify their position.

I refer to the stance taken by the previous DG, the current DG sees things differently. There have been several meetings between the Crown Office and the DG, but nothing between the Crown Office and families, apart from updates. Families have not had a direct input.

DV

[A and C]

The Miltary are not the only ones with their heads deep in the sand when it comes to collision warning systems EASA is just as bad.

The Idiots at EASA just want to make lots of money from it.

They have already approved the ADS-B system that is about to be fitted to my aircraft for use in a wide range of aircraft with American type certificates, however I am allowed to fit the system to my aircraft but because my aircraft has an EASA type certificate EASA want me to get a supplemental type certificate ( STC ) to switch on this already IFR approved kit.... Cost £15k !!

When you look at the attitude of the UK CAA and NATS the contrast is stark, these organisations are activly pursuing the safely advantages of ADS-B to the point that NATS are running a trial for the use of non- IFR approved GPS units as the sorce for ADS-B, with the UK CAA waving the fees for modification oversight for aircraft participating in this research.
This research has to be done with Annex 2 and homebuit aircraft as for reasons outlined above EASA annex 1 aircraft can't take part.

ADS-B offers real safety benefits for all who use the sky, not only to avoid collisions but I also understand that the security services are keen on it as a way of monitoring uncontrolled air traffic.

While I apologise for taking this thread off topic I want to highlight the appalling attitude of EASA when it comes to the advancment of safety for both civil and military aviators using new but proven technology.

[Chugalug2]

Your point taken A and C, and all that have shelled out the Dane-Geld to whatever authority will no doubt empathise with you but..
did EASA ever set out to deliberately suborn Airworthiness provision, to the extent of issuing illegal orders to do so, and thereafter orchestrate a cover up which protected those responsible?

In a week that, after more than a quarter of a century, finally exposed official lies covering up the death of 96 football fans as due to negligence rather than drunkeness, we may view with jaundiced eyes official inquiries and their like that repeatedly assure us that there is nothing new to see here, move along now, we've all got homes to go to.

Official corruption infests the corridors of power in our land. In the end only the courts can provide a solution.

[EAP86]

I believe this relates to a policy documented by the MAFTR (MAA predecessor) around the mid-noughties which said that so long as you had a current effective programme in place to address a risk, the hazard could be regarded as ALARP. While the creation of the "Temporal ALARP" concept was regarded as slightly unnecessary, it was recognised that it fitted with the understanding of the ALARP concept. In rough terms, 'instant' risk mitigations may not be possible and it wasn't judged reasonable to abandon defence of the realm, therefore a court would accept that the existence of a current mitigation programme was an acceptable approach.

[tucumseh]

Haddon-Cave, Ch 19.8

‘The ALARP rule is one of the fundamental tenets of safety and a basic concept; and yet there is confusion in some (senior) quarters [of the RAF and MOD] as to the relationship between ALARP and the ‘tolerability’ of risk, and also a lack of appreciation in others as to the temporal and financial flexibility inherent in the ‘R’ in ALARP.While I never used the term "ALARP (Temporal)", I was certainly always aware of the legal obligation to reduce risk as soon as reasonably practicable, because the clock ran on litigation as soon as a technical solution became available. Our airworthiness letters of delegation were changed in the early 90s to reflect this more forcibly, given the repeal of Section 10 of the Crown Proceedings Act. Training also changed, at Cranwell and in PE. I used the "clock running" argument many times to acquire funding.

Very often the technical solution is known, but not available due to (e.g.) space constraints in aircraft. For example, the LIDAR Wire Strike Avoidance system developed by RSRE Malvern in the 80s was physically too large for Tornado, although it exceeded the distance/wire diameter spec by a huge margin, so ALARP was achieved because no practical solution was available AT THAT TIME. However, there is an enduring obligation to maintain progress, not just forget the risk because it was, at one point, ALARP by default. In that case, MoD stopped funding LIDAR work some years ago and all staff were made redundant; including the inventor. The MAA doesn't mention that when tagging wire strike as a major risk.

While he doesn't explain himself (mainly because he couldn't publish any evidence that contradicted his decision to name and blame those he did) this is what H-C is getting at. The failure of senior staffs to meet this enduring obligation. Related to this, there is the policy that risks can be ignored until they actually manifest themselves. Again, Tornado offers a good example in ZG710 (2003 Patriot shootdown, the specific risk having been notified in 1998 and ignored).

Given the evidence uncovered by Distant Voice, the current risk is unlikely to be ALARP (Temporal) because, by any reasonable interpretation, MoD have not met this enduring obligation to continue unhindered development of CWS. I'd qualify that by saying the Duty Holder may have decided the original agreed mitigation (CWS in a generic sense) is no longer valid, but as the risk to life is obvious I'm sure he has made his obligatory written declaration to this effect and his Service and Political seniors have agreed, also in writing. And that his alternative mitigation is recorded and in hand.

Another factor here is that, fairly obviously, there must be an associated Operational Constraint and/or associated Limitations in the RTS. And the Whole Aircraft Safety Case will reflect all this. Lawyers would have to argue what timescale was reasonable, but given the successful trials were in the early 90s, it is for MoD to prove compliance, not for anyone else to prove the negative. Any gap in CWS/collision avoidance related development would be evidence of non-compliance.

As EAP86 says, the term should be unnecessary and its use indicates an acceptance of H-C's criticism; which in turn was notified to H-C in evidence thus demonstrating prior knowledge within MoD. This prior knowledge is a crucial aspect, so why did H-C present his report as revelations?

[alfred_the_great]

Another factor here is that, fairly obviously, there must be an associated Operational Constraint and/or associated Limitations in the RTS.

Nope. There may be an Operating Constraint, but there will be no Operational Constraint. It is not for the DDH, ODH or SDH to curtail the operational commander's risk.

[tucumseh]

ALF

I suspect we're talking about slightly different things. I'm referring to the Service led process whereby the inability to operate in accordance with the Statement of Operating Intent and Usage is considered by what I know as the Constraints Assessment / Working Groups (chaired by your DEC branch, for each aircraft Mark). Constraints are classified Critical, Major or Minor; with "Safety" appended if necessary. This determines procurement priorities and is the forum at which Front Line can best influence procurement decisions.

DEC is obliged to run requirements for all Criticals. (In practice, Majors and Minors seldom succeed, unless they can be subsumed within the solution for a Critical). This is what prioritises his annual workload. It is during this process that "temporal" may be appended; that is, the reasonable time it takes between identification of the risk and successful mitigation. If DEC's bid fails, then "temporal" must be removed and the risk is not ALARP. At this point, the Secy of State (theoretically) personally owns the risk and he must accept this in writing. This is where I believe the MAA's main role is. Clearly, the original Tornado CWS mitigation failed, so the risk cannot be said to be ALARP. It may be they got round this by "resetting" the risk when they decided to resurrect CWS a couple of years ago. But that would hide the underlying problem, which would seem to be a failure to do anything for 20 years.

If the "issue" is not considered to be a Constraint, then it is a Limitation; and enters the RTS as such. Hence the relationship to the Safety Case and Airworthiness.

Given the background explained by Distant Voice, clearly the lack of CWS has been tagged as a Critical Constraint for well over 25 years, because funding has been endorsed - witness the successful Tornado trials of the early 90s. Had it been a Limitation, no such funding would be available and, by definition, the risk could never be ALARP, temporal or otherwise, without significant changes to the SOIU and all that this entails. The bottom line is that in the early 90s the trials report said "ready to go", yet post-Moray Firth (July 2012) MoD claimed lack of CWS was not a factor because it could never have been in the aircraft in 2012. THAT, I think, is the basic contradiction that concerns Distant Voice. What happened between the early 90s and 2012?

I accept that, almost inevitably, terms will have been changed regularly over the years, but the basic process remains the same. Let us agree on that. The last CAG/CWGs I went to referred to them as Operational Constraints and Limitations. Ultimately, their role is to assist getting the Operational Commander the tools necessary for his task; for example, an airworthy aircraft. Then he can make his Fitness for Purpose (operational) decision. Hence, attaining Airworthiness precedes Fitness for Purpose. We already know the difference isn't really taught in MoD (see XV179 Inquest).

[dervish]

Maybe CWS was delayed for 20 years by some dickwad arguing over 'operating' and 'operational' instead of concentrating on substance. :ugh:

FWIW, as he's obviously talking about feedback from operational experience I think he got it right.

[alfred_the_great]

Dickwad - smooth.

You going to tell Haddon-Cave that he's a dickwad, and that one of his key recommendations is not, actually, substantial? Para 21.39 allows operators to go beyond the RTS, 21.44 removes the Operational Leadership (i.e. with OPCON and COM) from the Duty Holder Chain, viz.

Such guidance must recognise that Operational Commanders
may be required to make operational decisions at short notice in a highly dynamic and intense environment; Para 21.44

All seems perfectly sensible to me.

But, of course, you know better.

[Distant Voice]

Twenty-three years of inactivity to put right what was known to be wrong shows a gross breach of a relevant duty of care owed by the MOD, not only to the deceased, but to all those who fly in Tornado GR4 aircraft. Who will bring that charge against them?

Failure to submit an accurate Tolerable and ALARP statement by AOC No 1 Group, which resulted in the loss of life. Who will bring that charge against him?

DV

[baffman]

...Also, the Crown Office needs to bring its interpretation of "employee" in line with Lord Neuberger's ruling in the Snatch Land rover case. The crews were MoD employees, and this mandates an FAI.
Interesting point: in other words, that the Crown Office COULD have initiated a Fatal Accident Inquiry on public interest grounds, but an FAI would be MANDATORY if the deaths were regarded as having occurred "in the workplace".

I suggest this is not exactly the same issue, although related, as the "duty of care" question considered in the Snatch Landrover case.

Presumably this did come up at some stage during debate about the Coroners and Justice Act 2009. It certainly should have done.

Taking up DV's point, if it is not too off-topic I would be very interested to know whether the experts here consider that a fatal service flying accident in the United Kingdom should lead to a MANDATORY inquest/FAI, or not.

[Distant Voice]

I suggest this is not exactly the same issue, although related, as the "duty of care" question considered in the Snatch Landrover case.


I referred to the Snatch Land Rover case becuase Lord Neuberger made it clear that members of the armed services are "employees", somthing that the Crown Office refuse to accept. Neuberger said;

"The duty of care owed by the Ministry of Defence, as employer, to the members of the armed forces, as employees, does exist and has been recognised, without demur, by the courts. It includes a duty to provide safe systems of work and safe equipment."

Taking up DV's point, if it is not too off-topic I would be very interested to know whether the experts here consider that a fatal service flying accident in the United Kingdom should lead to a MANDATORY inquest/FAI, or not.

I do not regard myself as an expert, but in my opinion they should be mandatory. In the event of an accident the SI team is bounded by the TOR set by the convening authority, an FAI/Inquest can operate outside this constraint. It is easy to think that an SI will address all the problems, but experience tells me otherwise. The coroner at the Nimrod inquest uncovered several important facts, overlooked by the Board of Inquiry (now SI), which resulted in him ruling that the Nimrod Mk2 fleet was not airworthy and should be grounded until risks were made ALARP. In the Red Arrow ejection seat case, it became clear during the course of the inquest the the Mk10 ejection seat does not have a safety case.

DV

[Distant Voice]

para 1.4.6.595 of the SI report states, "During the elevation to SDH, further mitigation measures were suggested and discounted due to their severe impact. There is no record of the SDH actively considering futher measures and accepting responsiblity for not taking them. It was this view that nothing more could be done, that supported the belief that the current mitigation was "fit for purpose" and therefore was ALARP".

The SI panel concludes at para 1.4.6.605. a. (5) that the MAC risk mitigations fell short of what is considered Reasonably Practicable, and therefore not ALARP.

Question: Where is the recommendation to put that right, or did the DG disagree with that finding?

DV

[tucumseh]

In the event of an accident the SI team is bounded by the TOR set by the convening authority, an FAI/Inquest can operate outside this constraint. It is easy to think that an SI will address all the problems, but experience tells me otherwise. The coroner at the Nimrod inquest uncovered several important facts, overlooked by the Board of Inquiry (now SI), which resulted in him ruling that the Nimrod Mk2 fleet was not airworthy and should be grounded until risks were made ALARP. In the Red Arrow ejection seat case, it became clear during the course of the inquest the the Mk10 ejection seat does not have a safety case. I agree. We already know the MAA does not meet MoD’s own criteria for “independence”. The undue influence brought to bear on SIs is reason for components of the inquiry to be overseen by an independent body. MoD has been caught lying far too often and this militates against one of the main aims, to prevent recurrence.



A FAI (or Coroner’s Inquest) offers a better chance of the truth being uncovered. Not because MoD will tell the truth - it never will - but because knowledgeable witnesses can be called. MoD actively prevents this on BoIs/SIs and, with slightly less success, on Inquests.



However, there are still obstacles to overcome. The first, is the cost of engaging decent legal representation. In many countries, the families of deceased servicemen are afforded state funding. A good example is the Sea King ASaC inquest. The QC representing the family of one pilot was pretty good, but MoD witnesses still misled by omission and commission and he never got beyond first base with questions. The Coroner encouraged this by actively supporting MoD and refusing to allow key questions. In fact, the father the QC represented was far more knowledgeable, but the Coroner told him to shut up, in clear breach of the rules permitting family members to question witnesses. In short, the MoD is permitted to treat Inquests like an extension of the BoI. Secretive, obstructive and not interested in the truth if it involves senior officers and officials.



This obvious collusion between MoD and Coroner is common. DV talks of Mr Andrew Walker, the Nimrod Coroner. It looks like he was a rare exception. When he wouldn’t buckle, the Government tried to change the Coroners rules, they gagged supportive MPs (e.g. Sir Roger Gale, who had been making a nuisance of himself on ASaC by asking relevant questions the BoI had avoided) and Mr Walker’s treatment by Haddon-Cave showed the latter in his true light.



I’m afraid it is no coincidence that all the cases we discuss here have been “won” through retirees speaking up. That is a good lesson, and the start should be key posts being one’s final post.

[Chugalug2]

There is nothing that tucumseh has written here that comes as a surprise. On the contrary, as a follower and occasional contributor to the ever growing lists of UK Military Fatal Air Accident threads that fill this forum, I have been aware of everything he says for years now. Despite all that it comes as a shock to see it so succinctly laid out in one post. This is a shocking indictment of a country that was once the standard from which others took their cue and strove to emulate.

If this were merely about financial misappropriation or political corruption then no doubt many would merely shrug their shoulders and say, "Yeah, well, what can you do?". Can anyone here deny that they know now how deeply flawed is UK Military Air Safety, and how many lives its dysfunctional condition has cost, never mind the vast sums of public money squandered? How can it be left to a very few individuals to tackle a monumental scandal that shames us all, and in particular the good name of the Royal Air Force?

I suggest that everyone should look not at this from afar, but inwardly to themselves and ask not, "What can you do?", but rather, "What can I do?". Every effort made to support the fight to reform UK Military Air Safety undermines those forces that actively strive to prevent that ever happening.

[Distant Voice]

The SI panel concludes at para 1.4.6.605. a. (5) that the MAC risk mitigations fell short of what is considered Reasonably Practicable, and therefore not ALARP.


The DG of the "independent" MAA tries to play down the SI panel's conclusion by remarking, in the Convening Authorities Comments, that,
However, I am not persuaded that HQ 1 Group risk management process did not reduce the risk of Mid-air collision to the position of As Low As Reasonably Practicable (ALARP), bearing in mind the activity over the years to reduce the Mid-air risk and the significant work predating the accident in HQ 1 Group (and Air Command) into this risk, including that generated by the Senior Duty Holder following a spike in Air Proximity (near-miss) reporting. Moreover, a fully funded programme for the fitment of CWS to Tornado existed and was being pursued by DE&S with full haste and thus satisfying the 'R' in Reasonable in the ALARP mnemonic

I take this as a statement by the DG to protect a SDH from having to justify his management system and ALARP statement in court; as require by RA1210. There is no evidence shown in the No 1 Group Tolerable and ALARP statement, in force at the time of the accident, that near-misses had been included in the risk assessment process, the statement only talks about actual deaths from past collisions.

Clearly, the DG had his head in the clouds when he wrote that statement. The panel makes it clear in para 1.4.6.601 that, "there were several mitigations in place to avoid MAC, nearly all either did not work, were not applicable or were not adhered to". Furthermore there was no "fully funded programme to fit CWS" at the time of the accident, that did not happen until around November 2012.

Finally, the biggest misunderstanding within the MAA and MoD is that regarding the "R" in Reasonable. The temporal element of "Reasonable" has got nothing to do with the time permitted to reduce a risk to ALARP, it is time in terms of a cost; manhours to cover the necessary modifications. The idea that there is such a thing as ALARP (Temporal) was dismissed recently by Lord Cullen when the idea was put to him.

The sad thing is is that the DG of the MAA has been advising the Crown Office of Scotland that there is no need for an FAI, because all is covered by his SI report.

DV

[Distant Voice]

Just tracked my grandson's flight from London to Edinburgh using a £2.99 app know as Flight Radar 24. This app tracks all civilian flights IN THE WORLD, giving height, position, ground speed, and vertical speed. I find it inconceivable that we can not provide our Typhoon/Tornado aircraft with a similar system for civil and military aircraft.

DV

[Courtney Mil]

FR24 is impressive, yes? But it's only a website using secondary radar, partly from amateur spotters, using ADS-B. You may notice that a lot of mil ac are missing from the picture. You may not have noticed that the system is neither authenticated nor secure. It is an up and coming system and it has the potential to use satellite receivers.

But for the purposes you are implying, we already have systems to do collision avoidance; they just haven't paid for it to go into the entire RAF fleet.

[Skeleton]

DV it is a good point but replicating FR24 in the Military environment would be problematical to say the least. The coverage in Europe is ok provided the aircraft has the right radar (A lot do not) but the data from the US is lousy and a lot is subject to a time delay, with no info on type or destination etc. Here in Oz I can assure you where FR24 thinks my jets are is not even close to where they actually are at many points across the globe. It is not the golden app it is made out to be.

[Easy Street]

I think it's a damn good job that most military aircraft don't appear on FR24. It would be like offering a seat at the ACMI debrief to every single intelligence agency in the world. Changes of heading after simulated missile shots would be quite obvious and repeated observation would allow our tactics to be analysed and countered.

Before anyone suggests that Mode S could be disabled inside segregated airspace like the MDAs to prevent such analysis, I'd point out firstly that collisions are most likely to occur between aircraft operating as part of the same package, so by the logic of combat aircraft needing a collision avoidance system Mode S should always be on, and secondly that we conduct much tactical activity outside of segregated airspace.

[Distant Voice]

Two issues that do not appear to have been adressed by anyone are;

(a) As both aircraft waited to join the range why were they orbiting in opposite directions?

(b) Knowing that the normal SSR radar system was out of action why wasn't a feed taken from the SSR radar at Inverness airport? It is understood that positional data was taken from this system during the Service Iquiry.

DV

[airsound]

There's some wonderful MoD-speak in a piece on Forces TV - where the ministry is trying to defend a lack of action on the TCAS/CWS front.

But Forces TV also mentions reports of CAS warning Sec Def about the risk of Typhoon/passenger aircraft collision.

Worth a look
MoD Defends Fast Jet Collision Avoidance Policy | Forces TV (http://www.forces.tv/20383571)

airsound

[Distant Voice]

This MoD spokesperson is talking out of the wrong end of his body. The majority of civilian aircraft CAN operate with TCAS. This is an MoD attempt to justify over 20 years lack of progress. If we all follow their logic we would not bother fitting headlight to cars because they could not "remove the threat of collision" at night.

DV

[Chugalug2]

Forces TV:-
Under half of British Tornado GR4s have a traffic collision avoidance system (TCas) despite a government pledge to install them nearly 20 years ago, according to the Independent newspaper.

Harumph! Bloody mistake giving the Twenty-Minuters a parachute. Undermines a proud tradition of pointless sacrifice!

[MAINJAFAD]

(b) Knowing that the normal SSR radar system was out of action why wasn't a feed taken from the SSR radar at Inverness airport? It is understood that positional data was taken from this system during the Service Inquiry..


The data taken from Inverness SSR came off their own data recorder, not an MoD one as the Inverness SSR data was not feed into the RAF ATC tower for a whole host of reasons:


1. The Radar at Inverness does not belong to NATS or the MOD, therefore it will cost the MOD money to rent its use and for the Airport to run it at times that suit the MoD and not the Airport.


2. The Civil radar will need data link equipment that will provide a data signal that is compatible with the MoD system which is around 30 years old. If not compatible some form of data conversion equipment will be required at the MoD end, plus the data link equipment compatible with the civil radar. Equipment has to be procured, installed and a service support contract for the system has to be funded.


3. Communication link costs. This is the big one. The Radar has to be linked to tower by a dedicated continuous telecommunications link for the life of the system. The only reliable way of doing it is by land line. In this case you are tied to a single provider as it is they who own all of the telecommunications infrastructure on the MoD estate. Imagine what the cost of a five year long telephone call would be, because if the contract for the service is that long that is how long that single line would have a running call on it (plus line rental at commercial rates).


To give you a clue on how much it costs the MoD to rent the use of a civil radar, some of the contract costs are on the internet (I've no idea if this cost includes the rental and usage cost of the land lines).


https://data.gov.uk/data/contracts-finder-archive/contract/1125982/
https://data.gov.uk/data/contracts-finder-archive/contract/1193802/


In simple terms, its not cheap and not easy.

[tucumseh]

Mainjafad

Very interesting. £391k for a 6 year contract in the example quoted. Making a case for such an Inverness facility would be easy. Finding £391k is a 5-minute job. The Services routinely "forget" to include much larger requirements and any DE&S project officer should be well versed in delivering it. On one of my last programmes before retiring, the RN said they didn't need a mission trainer so there was no funding granted. They did, it cost £22M and finding that that was off-loaded to the office junior as a half day job. Money isn't the issue I'm afraid. More likely some VSO not wanting to admit the need (probably related to DV's underlying concern). That's the way MoD works - you wait until he's gone, then re-submit and get it approved retrospectively. (On the same programme, an entire new comms system was approved to enter development, 3 years after embodiment). I'm not up to date by any means, but Crowsnest is a good current example. That whole FOAEW/MASC thing stalled for many years for similar reasons. The FOAEW "requirement" was years behind its predecessor, but the PM only found out when conducting interviews to fill posts. He'd spent an entire tour not realising the link between AEW Mk2 > ASaC Mk7 > his upgrade. When something like that happens to an anointed one, the system quietly closes ranks and the front line requirement is forgotten. Sorry, a little cynical but true!

[Distant Voice]

In simple terms, its not cheap and not easy

On 3rd July 2012 we lost three lives and two Tornado aircraft, how cheap does it have to be?

Also, in view of the importance of having height information I would have thought that a simple call from Lossie ATC to Inverness informing them of the lack of Kinloss SSR information, with a request to keep a watching brief between certain times. On the other hand, perhaps pride got in the way.

DV

[MSOCS]

Perhaps pride got in the way?

Seriously DV?! You seem hell bent on pointing the the finger here with your clear armchair theorems. Nobody wanted to die that day. Nobody. Unless you've cast iron proof to back up such a distasteful comment I politely invite you to keep such disrespectful theories in your suspicious mind, Poirot!

How about we mourn lost friends, understand the nature of military flying, learn the lessons, invoke change that makes a difference (not just for change's sake) and try to be better at what we do?

That approach is fundamentally human and more wholesome than your finger-wagging clap trap.

Rant over.

[Chugalug2]

MSOCS:-
How about we mourn lost friends, understand the nature of military flying, learn the lessons, invoke change that makes a difference (not just for change's sake) and try to be better at what we do?


I mourn the loss of the 3 that died on 3 Jul 2012, not because they were friends, I didn't have the honour of knowing any of them, but because they were fellow aviators whose deaths were unnecessary and avoidable. If they had died in combat then it would indeed be in
the nature of military flying

They didn't though, they were simply holding clear of the Tain Air Weapons Range awaiting clearance to enter. Neither knew the other was there because they were not told, and their aircraft were not fitted with TCAS. As to
learn the lessons

You will forgive me if I curl a churlish lip, having been assured of that by just about everybody after every tragedy that should not have happened. So,"Yeah, right!". Similarly with
invoke change that makes a difference (not just for change's sake)

Let me guess. Compulsory FAIs for Military Air Accidents in Scotland, fitting TCAS to all RAF FJs as an urgent priority, ensuring that the MAA and the MilAAIB be made independent of the MOD and of each other, would all be change for changes sake, right?
try to be better at what we do?

No! Try to be the best! We were once the world leader in Military Air Safety. What went wrong?

[Distant Voice]

I politely invite you to keep such disrespectful theories in your suspicious mind

This is not a theory, it is fact. The lack of SSR was a contributing factor to the accident, and the question I am asking is why wasn't Inverness considered as a back-up. What was the back-up? These are the type of questions that would have been asked at an FAI, had one taken place.

On the subject of FAIs, my armchair finger-wagging clap trap has ensured that during the course of this year it will become mandatory for all military fatal accidents in Scotland to result in an FAI. Something that has been avoided for over 40 years.

DV

[MSOCS]

DV, your inflammatory opinion that it was, "perhaps pride that got in the way" is what is finger-wagging clap trap.

Anything people do to make things better is great, but don't guess at motives or pride causing such things when you clearly don't have the evidence to back up such claims. It ruins your otherwise noble intentions.

Chugalug, you are splitting hairs chap. Trying to be better is reality. Being the best is, well, frankly, not. I'd argue no death is necessary. There are duties of care in war and in peacetime. We train as we fight, but it does not absolve us to be as safe as we can. That's the point of "the nature of military flying" comment - to be better at our jobs we subject ourselves to risks that are, where possible, bounded. Goal posts shift with time and as lessons are learned about what we do. To discuss hindsight is valuable only if lessons are learned. To use it as an "I told you so" isn't.

Both aircraft were at low level; a tactic fundamentally designed to defeat radar, which is exactly the things you are arguing weren't used effectively - probably because they wouldn't have been. I don't know your background but I suspect only a few here have much experience at 100-250ft and 8 miles per minute.

[Chugalug2]

The BoI reported the collision at or about 900' AMSL over the sea and, as they were both holding, 8 miles a minute would seem to be a bit OTT wouldn't it?

So they couldn't be seen not because of radar avoidance practice, but because of the shortcomings that DV has raised, and hence weren't warned of one another's presence by R/T. If they had been fitted with TCAS then they would have been warned of one another's presence by TCAS, but they weren't, so they weren't!

You may think all that is splitting hairs, the UK Military Regulator thinks all that is splitting hairs. Others, like me, disagree.