Nimrod crash in Afghanistan Tech/Info/Discussion (NOT condolences)
Join Date: Nov 2007
Location: scotland
Posts: 102
Likes: 0
Received 0 Likes
on
0 Posts
Helgar, I hope I didn't give you the impression that I think you are the cause of a needless discussion. My criticism was directed to the media, who published an article that was clearly meant to stimulate a discussion, which I (and I forget that others do not have the opportunities that I have, to find the facts) wrongly described as needless. It should be needless in a Nimrod crewroom, but valuable in a bereaved family's home. For that slip of the tongue I apologise.
Dodgysootie:
Yes, there would be a momentary pressure surge, which would be felt throughout the pipework (but not in the tanks), right back to the refueller's pump, which should react.
Mick,
As I have indicated above, I should not have used the word "needless". If Shona and Helgar are concerned about the QQ report, I agree that it needs discussion and clarification. QQ are not experts on the technicalities of all aircraft. I don't doubt their expertise in safety matters and specific subjects such as combustion analysis, fluid dynamics and aerodynamics, etc. Their suggestion that we consider re-installing the 5 tank overpressure warning is based on insufficient information (and thats our fault, I guess, for not giving them the full history), However, the IPT will doubtless give it due regard and for the reasons I have stated the device will probably not be needed. Its unfortunate that it provoked a headline moment for the press which then gave rise to family interest.
With reference to flow rates, yes, before the accident, we did experience fuel flow greater than the max permitted rate quoted by QQ. That specification in the QQ report was new to me (and most other aircrew, I believe) when I read it. I would be very interested to know where that max flow rate is published. There is no way that the Release to Service flight trials unit would approve the use of tanker pumps that would exceed manufacturers' published limits on the receiver's aircraft.
Since Dec 06, we have drastically reduced flow rates, markedly reduced the amount of fuel we can put into each tank and taken steps to obviate pressure surges. There are no more pressure surges any more. These changes in our proceures were done solely as a precautionary measure to ensure that AAR is now conducted even more comfortably within the bounds of safety.
Therefore, with the QQ report as a basis, the operational measures now in place make the fuel system, as designed, more secure than ever before.
The fuel leak on XV235 came out of the blue. We had not spilled a drop of fuel during AAR since Oct 06 before that incident. As I have mentioned before, the investigation into that incident is now complete. We await its publication. I would be very surprisd if the cause of that leak is down to flow rates, pressure spikes, age of the pipes or the reliability of the seals.
Ed Sett
Dodgysootie:
when the second to last tank is shut off, would there not be a pressure increase or 'pressure spike' down the 5 tank refuel line as a result?
Mick,
As I have indicated above, I should not have used the word "needless". If Shona and Helgar are concerned about the QQ report, I agree that it needs discussion and clarification. QQ are not experts on the technicalities of all aircraft. I don't doubt their expertise in safety matters and specific subjects such as combustion analysis, fluid dynamics and aerodynamics, etc. Their suggestion that we consider re-installing the 5 tank overpressure warning is based on insufficient information (and thats our fault, I guess, for not giving them the full history), However, the IPT will doubtless give it due regard and for the reasons I have stated the device will probably not be needed. Its unfortunate that it provoked a headline moment for the press which then gave rise to family interest.
With reference to flow rates, yes, before the accident, we did experience fuel flow greater than the max permitted rate quoted by QQ. That specification in the QQ report was new to me (and most other aircrew, I believe) when I read it. I would be very interested to know where that max flow rate is published. There is no way that the Release to Service flight trials unit would approve the use of tanker pumps that would exceed manufacturers' published limits on the receiver's aircraft.
Since Dec 06, we have drastically reduced flow rates, markedly reduced the amount of fuel we can put into each tank and taken steps to obviate pressure surges. There are no more pressure surges any more. These changes in our proceures were done solely as a precautionary measure to ensure that AAR is now conducted even more comfortably within the bounds of safety.
Therefore, with the QQ report as a basis, the operational measures now in place make the fuel system, as designed, more secure than ever before.
The fuel leak on XV235 came out of the blue. We had not spilled a drop of fuel during AAR since Oct 06 before that incident. As I have mentioned before, the investigation into that incident is now complete. We await its publication. I would be very surprisd if the cause of that leak is down to flow rates, pressure spikes, age of the pipes or the reliability of the seals.
Ed Sett
There is no way that the Release to Service flight trials unit would approve the use of tanker pumps that would exceed manufacturers' published limits on the receiver's aircraft.
Join Date: Mar 2002
Location: Henley, Oxfordshire
Posts: 165
Likes: 0
Received 0 Likes
on
0 Posts
EdSett
To be fair it didnt provoke any headlines, it was a brief line in a piece that was headlined Browne Misled MPs on Nimrod and concentrated on his apparently bogus claim that QQ had said the aircraft's fuel system was safe when the risk was in fact tolerable but not ALARP, which as we have rehearsed endlessly here does not amount to safe. The discussion over the two one-line points which I included and you responded to is interesting but I hope irrelevant to current safety because both relate to AAR.
There were 30 recommendations that had to be carried out for the risk to the aircraft to be ALARP and only five relate to AAR. The key question I asked the MoD and they were not able to answer was: "Have they been carried out and if so had they been carried out when Browne stood up and cited the QQ report as showing the fuel system was safe?" If people want I can post all 30 recommendations here and let you take the QinetiQ experts apart piece by piece but the MoD and the RAF can't on the one hand rest on the report for showing the system is safe and at the same time say the people writing the report didn't know what they were talking about.
As for Shona's post, I got the impression her concerns were about the report as a whole rather than one or two isolated lines from it.
Its unfortunate that it provoked a headline moment for the press which then gave rise to family interest.
There were 30 recommendations that had to be carried out for the risk to the aircraft to be ALARP and only five relate to AAR. The key question I asked the MoD and they were not able to answer was: "Have they been carried out and if so had they been carried out when Browne stood up and cited the QQ report as showing the fuel system was safe?" If people want I can post all 30 recommendations here and let you take the QinetiQ experts apart piece by piece but the MoD and the RAF can't on the one hand rest on the report for showing the system is safe and at the same time say the people writing the report didn't know what they were talking about.
As for Shona's post, I got the impression her concerns were about the report as a whole rather than one or two isolated lines from it.
Beagle, you are of course correct, but so too is the essential point. If the data presented is true, then there has been a breakdown of the system integration and safety management processes, whereby the physical safety of each aircraft system may be safe in isolation, but functionally unsafe when mated and used.
However, EdSett is not wrong as for some years now (in my experience) Trials Installation aircraft have often acted as the sole Integration Rigs, for a variety of reasons. (Boscombe, especially, rightly complain about this). Primarily, as a means by which prime contractors can transfer risk back to MoD. That is, they claim “It works on the bench, so it’ll work on the aircraft”. They claim payment from a gullible non-engineer project manager and later, when the problem appears, stick their hand out saying “You paid up, our job was complete, we need more if you want it to actually work”.
This was formally condoned by 2 and 4 Star in DPA, and confirmed under FoI.
However, EdSett is not wrong as for some years now (in my experience) Trials Installation aircraft have often acted as the sole Integration Rigs, for a variety of reasons. (Boscombe, especially, rightly complain about this). Primarily, as a means by which prime contractors can transfer risk back to MoD. That is, they claim “It works on the bench, so it’ll work on the aircraft”. They claim payment from a gullible non-engineer project manager and later, when the problem appears, stick their hand out saying “You paid up, our job was complete, we need more if you want it to actually work”.
This was formally condoned by 2 and 4 Star in DPA, and confirmed under FoI.
Join Date: Mar 2002
Location: Henley, Oxfordshire
Posts: 165
Likes: 0
Received 0 Likes
on
0 Posts
Tucumseh said:
Which is presumably why the QinetiQ report said:
The AAR system had been in use for 25 years when QinetiQ made this statement.
the physical safety of each aircraft system may be safe in isolation, but functionally unsafe when mated and used.
The fuel system for the Nimrod is understood as is the fuel system for the Tristar. When these systems are combined, however, during AAR, the mated system is in effect a new third system that it is believed, will behave differently from the separate Nimrod and Tristar fuel systems. While some activities have been undertaken to understand how this system responds, further work is required to understand how the mated system responds and behaves during AAR operation.
To be fair it didnt provoke any headlines, it was a brief line in a piece that was headlined Browne Misled MPs on Nimrod and concentrated on his apparently bogus claim that QQ had said the aircraft's fuel system was safe when the risk was in fact tolerable but not ALARP, which as we have rehearsed endlessly here does not amount to safe. The discussion over the two one-line points which I included and you responded to is interesting but I hope irrelevant to current safety because both relate to AAR.
There were 30 recommendations that had to be carried out for the risk to the aircraft to be ALARP and only five relate to AAR. The key question I asked the MoD and they were not able to answer was: "Have they been carried out and if so had they been carried out when Browne stood up and cited the QQ report as showing the fuel system was safe?" If people want I can post all 30 recommendations here and let you take the QinetiQ experts apart piece by piece but the MoD and the RAF can't on the one hand rest on the report for showing the system is safe and at the same time say the people writing the report didn't know what they were talking about.
A interesting example of why it is easy to get things wrong is your quotation of QinetiQs comment:
Further consideration should be given to the AAR procedures to ensure that tank 5 does not suffer from over-pressurisation, including reinstatement of the tank 5 over pressurisation warning
Join Date: Aug 2007
Location: St Annes
Age: 68
Posts: 638
Likes: 0
Received 0 Likes
on
0 Posts
25 years...
not really.
In my youth we prodded VC10's, Victors of course, and Hercs...I think the problem is that the Tristar came later to the party, and everyone figured 'well. all the others were okay, why should Tristar be any different?'.
(This is) personal opinion based on limited understanding now, but I'm surprised that nobody seems, prior to the crash, to have known (or considered the implications of, at least) the difference in pressure during AAR as tanker type is changed. Mind you, I'm even more flabbergasted to discover that the extra conditioning that was plumbed in when converting to the Mk2 was never intended to be used in flight - did I read that right? 20 odd years back I was simply told 'oh we need that'....it was as remarkable then as having a port wing....
Please remember to blame the people making decisions 20+ years ago, not those currently in post who inherited what they had every reason to believe was a well tried, reliable system. It is NOT reasonable to expect people like Martin Cannard to take up a post and promptly nip down the line, spanner in hand, to double check 25 years of received wisdom - whoever decided not to prove the system properly post Falklands did so 5-10 years before Martin was a 2nd Nav on 206. (A bloody good one, by the way).
Dave
(edited for small typos and, as ever, spellinge)
not really.
In my youth we prodded VC10's, Victors of course, and Hercs...I think the problem is that the Tristar came later to the party, and everyone figured 'well. all the others were okay, why should Tristar be any different?'.
(This is) personal opinion based on limited understanding now, but I'm surprised that nobody seems, prior to the crash, to have known (or considered the implications of, at least) the difference in pressure during AAR as tanker type is changed. Mind you, I'm even more flabbergasted to discover that the extra conditioning that was plumbed in when converting to the Mk2 was never intended to be used in flight - did I read that right? 20 odd years back I was simply told 'oh we need that'....it was as remarkable then as having a port wing....
Please remember to blame the people making decisions 20+ years ago, not those currently in post who inherited what they had every reason to believe was a well tried, reliable system. It is NOT reasonable to expect people like Martin Cannard to take up a post and promptly nip down the line, spanner in hand, to double check 25 years of received wisdom - whoever decided not to prove the system properly post Falklands did so 5-10 years before Martin was a 2nd Nav on 206. (A bloody good one, by the way).
Dave
(edited for small typos and, as ever, spellinge)
Join Date: Sep 2006
Location: Bridgwater Somerset
Posts: 459
Likes: 0
Received 0 Likes
on
0 Posts
davejb
"Please remember to blame the people making decisions 20+ years ago, not those currently in post who inherited what they had every reason to believe was a well tried, reliable system. It is NOT reasonable to expect people like Martin Cannard to take up a post and promptly nip down the line, spanner in hand, to double check 25 years of received wisdom"
Airworthiness and the safety of aircraft is on going, just because it was OK 20 yrs ago doesn't mean you never revisit it to ensure it complies to modern standards.Everyone from groundies to Station Commander had a responsibility for the airworthiness of the aircraft. Martin Cannard et al would have known which aircraft were serviceable and what problems they may have.
The Buck stops somewhere
May I repeat what was said at the BOI Briefing 4th Dec 2007.
Question to the Secretary of State for Defence:Was XV230 safe to fly ?
Answer: In hindsight and in those particular circumstances No
What circumstances ? There was nothing unusual about XV230 in fact most witnesses told the BOI it was one of the best a/c in the fleet.
So what in what particular circumstances was it flyng.
No different from any other Nimrod, it follows therefore that all Nimrods were not Airworthy at that time .
"Please remember to blame the people making decisions 20+ years ago, not those currently in post who inherited what they had every reason to believe was a well tried, reliable system. It is NOT reasonable to expect people like Martin Cannard to take up a post and promptly nip down the line, spanner in hand, to double check 25 years of received wisdom"
Airworthiness and the safety of aircraft is on going, just because it was OK 20 yrs ago doesn't mean you never revisit it to ensure it complies to modern standards.Everyone from groundies to Station Commander had a responsibility for the airworthiness of the aircraft. Martin Cannard et al would have known which aircraft were serviceable and what problems they may have.
The Buck stops somewhere
May I repeat what was said at the BOI Briefing 4th Dec 2007.
Question to the Secretary of State for Defence:Was XV230 safe to fly ?
Answer: In hindsight and in those particular circumstances No
What circumstances ? There was nothing unusual about XV230 in fact most witnesses told the BOI it was one of the best a/c in the fleet.
So what in what particular circumstances was it flyng.
No different from any other Nimrod, it follows therefore that all Nimrods were not Airworthy at that time .
Join Date: Nov 2007
Location: scotland
Posts: 102
Likes: 0
Received 0 Likes
on
0 Posts
I'm certain that he will return to Kinloss in the top job. In the meantime....
Beagle:
Yes, agreed, if there is only one flow rate available (not including the refueller's tanks' booster pumps) from the tanker. The V force (do you remember the Vulcan tanker?), VC10 and C130 tankers had only one centre line pump associated with each HDU. The Tristar has 3 Carter pumps, of which 2 may be used in parrallel simultaneously, depending on the receiver's capability. I believe that one single Carter pump does not meet the Def Stan; two together far exceeds it. Nimrod was trialled and tested to accept both pumps simultaneously. We now (or, until recently, did) only use 1 Carter pump.
Mick, I think we can agree to draw a line under the discussion about the intentions and impact of the latest article in your paper. It remains the top UK newspaper in my eyes and I'm sure nobody would wish you to stop asking questions and doing your research.
TD:
Answer: AAR is the circumstance he refers to, IMHO.
to carry out AAR
otherwise, no argument from me.
Ed Sett
Beagle:
Other way round, surely? There's no way any aircraft should be permitted to conduct AAR unless its fuel system can safely accept the standard fuel flow rates provided by the specified tanker.
Mick, I think we can agree to draw a line under the discussion about the intentions and impact of the latest article in your paper. It remains the top UK newspaper in my eyes and I'm sure nobody would wish you to stop asking questions and doing your research.
TD:
Question to the Secretary of State for Defence:Was XV230 safe to fly ?
Answer: In hindsight and in those particular circumstances No
What circumstances ?
Answer: In hindsight and in those particular circumstances No
What circumstances ?
it follows therefore that all Nimrods were not Airworthy...
.. at that time.
Ed Sett
Join Date: Mar 2002
Location: Henley, Oxfordshire
Posts: 165
Likes: 0
Received 0 Likes
on
0 Posts
JFZ90
Your attempts to twist what I and QinetiQ said are a waste of time. The bottom line is that the report was an accurate account of what QQ said, which was not what SoS said, that was the headline news, not the over-pressurisation warning, although that is also in the QQ report and given what happened is also reportable. If the QQ experts expressed concern in a written report they must have had a reason.
EdSet
Thanks for your, as ever, reasoned arguments. I'm happy to leave discussion here.
Your attempts to twist what I and QinetiQ said are a waste of time. The bottom line is that the report was an accurate account of what QQ said, which was not what SoS said, that was the headline news, not the over-pressurisation warning, although that is also in the QQ report and given what happened is also reportable. If the QQ experts expressed concern in a written report they must have had a reason.
EdSet
Thanks for your, as ever, reasoned arguments. I'm happy to leave discussion here.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Ed Sett. With regards to knowing about fuel flow rates, the data was published by Flight Refuelling on 8-5-68.
The same document states that "Service life unlimited, with seal inspection every 5 years. Shelf life 5 years."
DV
The same document states that "Service life unlimited, with seal inspection every 5 years. Shelf life 5 years."
DV
Join Date: Apr 2008
Location: UK
Posts: 49
Likes: 0
Received 0 Likes
on
0 Posts
definition of "safe", MoD safety policy, etc.
I am not aware that the term "tolerably safe" is defined anywhere in MoD policy or regulation. However, it has come to be used, in the field of defence aviation at least, in roughly the following manner. To say an aircraft is "tolerably safe" is the same as saying that the risk associated with operating that aircraft is "tolerable" ("tolerable", as applied to risk, is a term that is well-defined in MoD policy and regulation). This is a right pain because not only does this lead to the confusion between "tolerably safe" and "safe" (which are not equivalent, as pointed out above) but also, the term "tolerably safe" is used in other contexts and industries to mean "the risk is tolerable and ALARP" (which is much closer to the MoD definition of "safe").
The distinction between "tolerably safe" (meaning the risk is "tolerable") and "safe" is not, in my opinion, well understood within the MoD. I find it very plausible that Des Browne may have been misinformed by the MoD in respect of any statements he made concerning whether or not the Nimrod in question was "safe". I would expect QinetiQ to very well understand the distinction, though I would think it regrettable if they used the terms "tolerably safe" or "acceptable" without explicitly defining them (the latter was probably used in a generic sense rather than in the sense of "Broadly Acceptable", which is also a well-defined term).
Also, some reference has been made to Def Stan 00-56, "Safety Management Requirements for Defence Systems" (from which the MoD definitions of "safe", "tolerable" and "broadly acceptable" have been taken in preceding discussion). This standard is not strictly applicable to safety management by the MoD itself. Instead, the standard is intended to specify requirements for safety management by contractors to the MoD. For example, BAE or any other supplier of safety-related military equipment.
The document that specifies MoD safety management requirements, at least for the IPTs (Integrated Project Teams) that procure and administer MoD equipment, is the Project Oriented Safety Management System (POSMS). It can be found at:
http://www.asems.mod.uk/posms_manual.htm
It shares many of the principles and definitions of Def Stan 00-56, inheriting many of the definitions directly. It is a much larger document but also provides a lot of very readable (for the layperson, I would have thought) guidance.
In my opinion, the distinction in the scope of applicability between Def Stan 00-56 and POSMS is also not well understood within the MoD and its contractors.
The distinction between "tolerably safe" (meaning the risk is "tolerable") and "safe" is not, in my opinion, well understood within the MoD. I find it very plausible that Des Browne may have been misinformed by the MoD in respect of any statements he made concerning whether or not the Nimrod in question was "safe". I would expect QinetiQ to very well understand the distinction, though I would think it regrettable if they used the terms "tolerably safe" or "acceptable" without explicitly defining them (the latter was probably used in a generic sense rather than in the sense of "Broadly Acceptable", which is also a well-defined term).
Also, some reference has been made to Def Stan 00-56, "Safety Management Requirements for Defence Systems" (from which the MoD definitions of "safe", "tolerable" and "broadly acceptable" have been taken in preceding discussion). This standard is not strictly applicable to safety management by the MoD itself. Instead, the standard is intended to specify requirements for safety management by contractors to the MoD. For example, BAE or any other supplier of safety-related military equipment.
The document that specifies MoD safety management requirements, at least for the IPTs (Integrated Project Teams) that procure and administer MoD equipment, is the Project Oriented Safety Management System (POSMS). It can be found at:
http://www.asems.mod.uk/posms_manual.htm
It shares many of the principles and definitions of Def Stan 00-56, inheriting many of the definitions directly. It is a much larger document but also provides a lot of very readable (for the layperson, I would have thought) guidance.
In my opinion, the distinction in the scope of applicability between Def Stan 00-56 and POSMS is also not well understood within the MoD and its contractors.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Squidlord; I agree with you, the statement "tolerably safe" has no real meaning. It is like saying a person is "restrively free", there is a conflict of terms.
You say that "tolerably save" is used in some industries to mean tolerable and ALARP, which is a condition I can understand. However, QineiQ make it quite clear that the fuel system is not ALARP. The term "acceptable" is used at times in the report, but according to the Concise Oxford Dictionary, "acceptable" means "tolerable". At no point in the report does QinetiQ state that the system is "broadly acceptable", because they know what that means.
Perhaps someone did misinform Des Browne, but I also believe that words were played with in order to give a false indication of the condition of the Nimrod fuel system, with current mitigations.
I understand the point you make about DEF STAN 00-56, but I would like to draw your attention to the first paragraph of that document.
"Under UK law, all employers have a duty of care to their employees, the general public and the wider environment. For the MOD, this includes an obligation to manage the safety risks associated with military systems and their operation. In addition safety is a vital characteristic of defence systems as it is often has a significant impact upon operational effectiveness. In accordance with the general guidance provided by the Health and Safety Executive, MOD will discharge this duty by ensuring that, in as so far as risks are not judged to be unacceptable, they are reduced to a level which is As Low As Reasonably Practicable (ALARP)"
DV
You say that "tolerably save" is used in some industries to mean tolerable and ALARP, which is a condition I can understand. However, QineiQ make it quite clear that the fuel system is not ALARP. The term "acceptable" is used at times in the report, but according to the Concise Oxford Dictionary, "acceptable" means "tolerable". At no point in the report does QinetiQ state that the system is "broadly acceptable", because they know what that means.
Perhaps someone did misinform Des Browne, but I also believe that words were played with in order to give a false indication of the condition of the Nimrod fuel system, with current mitigations.
I understand the point you make about DEF STAN 00-56, but I would like to draw your attention to the first paragraph of that document.
"Under UK law, all employers have a duty of care to their employees, the general public and the wider environment. For the MOD, this includes an obligation to manage the safety risks associated with military systems and their operation. In addition safety is a vital characteristic of defence systems as it is often has a significant impact upon operational effectiveness. In accordance with the general guidance provided by the Health and Safety Executive, MOD will discharge this duty by ensuring that, in as so far as risks are not judged to be unacceptable, they are reduced to a level which is As Low As Reasonably Practicable (ALARP)"
DV
Last edited by Distant Voice; 18th Apr 2008 at 16:17.
Squidlord
Good first post.
POSMS has been referred to or quoted here often, and Mick Smith recently provided a link. You are correct that it is better written than many other standards. Most Def Stans, JSPs etc originate from a time when the target audience had to have certain minimum direct experience of aircraft and their equipment. So radical have been the changes in MoD that the same audience today is likely never to have been near an aircraft, and non-engineers are permitted to make engineering decisions affecting design and safety. You will appreciate that this is a serious breaches of the regs.
May I expand on two points.
You are correct in that successive Secretaries of State (and Mins(AF)) have been misled by their MoD staffs in Ministerial responses. We all know they are not chosen for their detailed knowledge of Defence matters and they invariably simply sign what’s placed in front of them.
Noticeably, there does not seem to be a process to ensure successive and even concurrent post holders are given consistent advice. For example, well before XV230 Adam Ingram was personally advised the airworthiness regs were not being implemented properly. He denied it, despite supporting evidence in various BoI reports. Before that (in my own experience), it was CDP and his XDs; and before that………. The list goes on. Later, in the XV230 report, ACM Sir Clive Loader simply repeated this. Des Browne accepted it, yet RAF Air Staffs and Ainsworth continued to cite Ingram’s previous denial.
The bottom line here is that Des Browne has accepted that a raft of “standards”, including 00-56, 57, POSMS, 553, 123, 125 and so on, have not been implemented properly. The root problem, in a management sense, is that successive regimes in MoD(PE), DPA, DLO, DE&S, AMSO, AML and the rest have consistently ruled they may be treated as optional. (It follows that less money was spent on the subject, and it is almost impossible to resurrect an unused funding line). This is the same mentality that decreed, for example, that it is sufficient to have a Risk Register, but don’t dare ask for resources to actually mitigate the risks. Or by all means have a Hazard Log; but populate it? How odd. That Critical Design Reviews may be waived. That personnel may be disciplined for having the temerity to insist on implementing these regs (rulings upheld by the very people responsible for airworthiness and who brief Ministers). These are the real problems.
Good first post.
POSMS has been referred to or quoted here often, and Mick Smith recently provided a link. You are correct that it is better written than many other standards. Most Def Stans, JSPs etc originate from a time when the target audience had to have certain minimum direct experience of aircraft and their equipment. So radical have been the changes in MoD that the same audience today is likely never to have been near an aircraft, and non-engineers are permitted to make engineering decisions affecting design and safety. You will appreciate that this is a serious breaches of the regs.
May I expand on two points.
You are correct in that successive Secretaries of State (and Mins(AF)) have been misled by their MoD staffs in Ministerial responses. We all know they are not chosen for their detailed knowledge of Defence matters and they invariably simply sign what’s placed in front of them.
Noticeably, there does not seem to be a process to ensure successive and even concurrent post holders are given consistent advice. For example, well before XV230 Adam Ingram was personally advised the airworthiness regs were not being implemented properly. He denied it, despite supporting evidence in various BoI reports. Before that (in my own experience), it was CDP and his XDs; and before that………. The list goes on. Later, in the XV230 report, ACM Sir Clive Loader simply repeated this. Des Browne accepted it, yet RAF Air Staffs and Ainsworth continued to cite Ingram’s previous denial.
The bottom line here is that Des Browne has accepted that a raft of “standards”, including 00-56, 57, POSMS, 553, 123, 125 and so on, have not been implemented properly. The root problem, in a management sense, is that successive regimes in MoD(PE), DPA, DLO, DE&S, AMSO, AML and the rest have consistently ruled they may be treated as optional. (It follows that less money was spent on the subject, and it is almost impossible to resurrect an unused funding line). This is the same mentality that decreed, for example, that it is sufficient to have a Risk Register, but don’t dare ask for resources to actually mitigate the risks. Or by all means have a Hazard Log; but populate it? How odd. That Critical Design Reviews may be waived. That personnel may be disciplined for having the temerity to insist on implementing these regs (rulings upheld by the very people responsible for airworthiness and who brief Ministers). These are the real problems.
Join Date: Mar 2005
Location: On the outside looking in
Posts: 542
Likes: 0
Received 0 Likes
on
0 Posts
Tolerable?
As regards understanding the preceding discussion on Tolerably Safe, I think it all needs to come back to the HSE explanation rather than the defence standard. I also think it is where CAS thinks he got his "safe as it needs to be" line from.
As I've said before, have a read of "Reducing Risks, Protecting People" at http://www.hse.gov.uk/risk/theory/r2p2.htm particularly paras 122 - 133 and, as regards Tolerable, at para 124:
Spot what is missing from this sad story?
sw
As I've said before, have a read of "Reducing Risks, Protecting People" at http://www.hse.gov.uk/risk/theory/r2p2.htm particularly paras 122 - 133 and, as regards Tolerable, at para 124:
The zone between the unacceptable and broadly acceptable regions is the tolerable region.
Risks in that region are typical of the risks from activities that people are prepared to
tolerate in order to secure benefits, in the expectation that:
the nature and level of the risks are properly assessed and the results used properly
to determine control measures. The assessment of the risks needs to be based on the
best available scientific evidence and, where evidence is lacking, on the best
available scientific advice;
the residual risks are not unduly high and kept as low as reasonably practicable (the
ALARP principle – see Appendix 3); and
the risks are periodically reviewed to ensure that they still meet the ALARP criteria,
for example, by ascertaining whether further or new control measures need to be
introduced to take into account changes over time, such as new knowledge about the
risk or the availability of new techniques for reducing or eliminating risks.
Risks in that region are typical of the risks from activities that people are prepared to
tolerate in order to secure benefits, in the expectation that:
the nature and level of the risks are properly assessed and the results used properly
to determine control measures. The assessment of the risks needs to be based on the
best available scientific evidence and, where evidence is lacking, on the best
available scientific advice;
the residual risks are not unduly high and kept as low as reasonably practicable (the
ALARP principle – see Appendix 3); and
the risks are periodically reviewed to ensure that they still meet the ALARP criteria,
for example, by ascertaining whether further or new control measures need to be
introduced to take into account changes over time, such as new knowledge about the
risk or the availability of new techniques for reducing or eliminating risks.
sw
Are the numerical definitons of tolerable and broadly acceptable in relation to Nimrod safety known (i.e. is this information releasable)?
I assume "broadly acceptable" (at system/aircraft level) is up around the 10-7 / 10-8 failures (with critical safety consequences - i.e. loss of life/serious injury) per (flight) hour, but where is "tolerable" risk zone - 10-5, 10-6? I assume these numerical definitions have been set by the Nimrod project, based on extant HSE guidance & other project comparators?
Can anyone point to some example HSE type rates for different types of system/project (e.g. airliners/oil production platforms etc.)?
EDIT to add - safeware, you appear to have partially answered one of my questions a few minutes before I asked it - I didn't see your post before I posted!
I assume "broadly acceptable" (at system/aircraft level) is up around the 10-7 / 10-8 failures (with critical safety consequences - i.e. loss of life/serious injury) per (flight) hour, but where is "tolerable" risk zone - 10-5, 10-6? I assume these numerical definitions have been set by the Nimrod project, based on extant HSE guidance & other project comparators?
Can anyone point to some example HSE type rates for different types of system/project (e.g. airliners/oil production platforms etc.)?
EDIT to add - safeware, you appear to have partially answered one of my questions a few minutes before I asked it - I didn't see your post before I posted!
Join Date: Mar 2005
Location: On the outside looking in
Posts: 542
Likes: 0
Received 0 Likes
on
0 Posts
JFZ90, to try and answer all of them:
This should be available to those who have the safety case.
Military Airworthiness requirements are in JSP 553, Civil requirements are in Certification Specifications (eg CS.25). They represent single figure numerical targets rather than "zones"
The HSE guidance is based on risks to people, rather than about different technologies / industries. However, it does have some interesting stats about various activities.
sw
Are the numerical definitons of tolerable and broadly acceptable in relation to Nimrod safety known?
I assume "broadly acceptable" (at system/aircraft level) is up around the 10-7 / 10-8 failures (with critical safety consequences - i.e. loss of life/serious injury) per (flight) hour, but where is "tolerable" risk zone - 10-5, 10-6? I assume these numerical definitions have been set by the Nimrod project, based on extant HSE guidance & other project comparators?
Can anyone point to some example HSE type rates for different types of system/project (e.g. airliners/oil production platforms etc.)?
sw
Thanks safeware,
The HSE doc is interesting reading, and has a refreshing tone on how common sense needs to be applied to assessing risk.
I'm a bit rusty here, but I was under the impression that projects had to set specific targets, which was based on HSE / comparative projects but can take other factors into account (the "gas leak" example in the HSE doc is interesting in this respect). Hence in theory the Nimrod (or any other a/c) safety targets could still be different/vary from other comparative aircraft. Is there a copy of JSP553 on the interweb, or can you paraphrase the bits relating to safety targets?
Re my question on oil-rigs etc. if I understand the principle correctly the HSE outlines / can advise on a certain rate of risk to people that is publically acceptable, and uses this to set targets for/regulate operators (i.e. an oil rig operator would need to show how his procedures and systems supported meeting/exceeding the acceptable risk to people rate). Interesting to read that you're more at risk farming than working on oil rigs.
The HSE doc is interesting reading, and has a refreshing tone on how common sense needs to be applied to assessing risk.
I'm a bit rusty here, but I was under the impression that projects had to set specific targets, which was based on HSE / comparative projects but can take other factors into account (the "gas leak" example in the HSE doc is interesting in this respect). Hence in theory the Nimrod (or any other a/c) safety targets could still be different/vary from other comparative aircraft. Is there a copy of JSP553 on the interweb, or can you paraphrase the bits relating to safety targets?
Re my question on oil-rigs etc. if I understand the principle correctly the HSE outlines / can advise on a certain rate of risk to people that is publically acceptable, and uses this to set targets for/regulate operators (i.e. an oil rig operator would need to show how his procedures and systems supported meeting/exceeding the acceptable risk to people rate). Interesting to read that you're more at risk farming than working on oil rigs.
Here's an easily understood diagram from MoD literature.
Class A risks are Unacceptable. Class B and C are Tolerable, if ALARP. Class D are Broadly Acceptable.
In other words, any risk where the severity of harm is "catastrophic" (i.e. loss of aircraft) must be reduced to ALARP even if the probability of occurrence is "incredible". But, as JFZ says, individuals projects can apply their own criteria, within the boundaries of the regulations. Specifically, this does not include "It's never happened before, so won't happen".
When you map the various risks noted in BAeS and QQ reports, you'll find there are a number of Class As that were not mitigated to ALARP.
Class A risks are Unacceptable. Class B and C are Tolerable, if ALARP. Class D are Broadly Acceptable.
In other words, any risk where the severity of harm is "catastrophic" (i.e. loss of aircraft) must be reduced to ALARP even if the probability of occurrence is "incredible". But, as JFZ says, individuals projects can apply their own criteria, within the boundaries of the regulations. Specifically, this does not include "It's never happened before, so won't happen".
When you map the various risks noted in BAeS and QQ reports, you'll find there are a number of Class As that were not mitigated to ALARP.