Chinook - Still Hitting Back 3 (Merged)
Walter, have you any idea of what tuc is on about? Do you ever pause to ponder on what others have said, before you simply ignore or pour scorn on it? I have spoken up for you and said that you should be listened to, but it works two ways, you have to listen to what others say and answer questions they put to you. It has been pointed out that you purport to offer a cause to this accident, ie the misuse of PRC112, either by incompetence or malevolence, yet you offer no proof. To merely say that you imagined the scenario only to have it "proved" by the process of "QED" when you discovered that PRC112 could indeed have been fitted is total twaddle, to coin one of your phrases.
I am afraid that you are your own worse enemy, by adopting a belligerent and confrontational attitude to fellow PPRuNers who post here. To now state that they have "let down" the 29 people who perished in this tragedy is unacceptable and should be recanted.
As tuc has told you, if your theory was indeed fact, it could only have been perpetrated following the gross breaching of the Airworthiness Regulations, and if you had any sense you would see that and stop rubbishing those who have said all along that whatever happened to cause ZD576 to crash that fateful day, it was Grossly Unairworthy when it did so.
I am afraid that you are your own worse enemy, by adopting a belligerent and confrontational attitude to fellow PPRuNers who post here. To now state that they have "let down" the 29 people who perished in this tragedy is unacceptable and should be recanted.
As tuc has told you, if your theory was indeed fact, it could only have been perpetrated following the gross breaching of the Airworthiness Regulations, and if you had any sense you would see that and stop rubbishing those who have said all along that whatever happened to cause ZD576 to crash that fateful day, it was Grossly Unairworthy when it did so.
Join Date: Feb 2007
Location: Oxon
Age: 66
Posts: 1,942
Likes: 0
Received 0 Likes
on
0 Posts
Join Date: Oct 2000
Location: Retired to Bisley from the small African nation
Age: 67
Posts: 461
Likes: 0
Received 0 Likes
on
0 Posts
These pilots were very good, unlikely in the extreme to be reckless, and were familiar with that area and low flying in the region and would not have trusted either TANS nor their eyes in those conditions to judge a turn that close in at any kind of speed.
Walter
I agreed with most of that a few posts back. The bit I have a problem with is what the pilots would have trusted to.
If I had been doing this in my old Sea King, I would have relied on my Radar Operator, with a real picture of where the hard stuff was, to keep me away from it. But given that the job was to get 20+ passengers from Aldergrove to Fort George, why would I have been flying precision turns at high speed overland at the Mull when I could just have turned a bit early and headed up the side of Kintyre offshore?
In other words, what you suggest is not plausible because there is no rational explanation as to why the crew was doing it.
There are several plausible explanations as to what actually happened. We will never know which (if any) is correct. But we do know that the Chinook 2 was not certified as fit to fly at the time it crashed. We also know that Boscombe Down had actually grounded the Chinook 2s under their control, for airworthiness reasons, at the time this one crashed. Neither of those statements are conclusive. But both are highly indicative as to the cause of this disaster.
Iain
Walter
I agreed with most of that a few posts back. The bit I have a problem with is what the pilots would have trusted to.
If I had been doing this in my old Sea King, I would have relied on my Radar Operator, with a real picture of where the hard stuff was, to keep me away from it. But given that the job was to get 20+ passengers from Aldergrove to Fort George, why would I have been flying precision turns at high speed overland at the Mull when I could just have turned a bit early and headed up the side of Kintyre offshore?
In other words, what you suggest is not plausible because there is no rational explanation as to why the crew was doing it.
There are several plausible explanations as to what actually happened. We will never know which (if any) is correct. But we do know that the Chinook 2 was not certified as fit to fly at the time it crashed. We also know that Boscombe Down had actually grounded the Chinook 2s under their control, for airworthiness reasons, at the time this one crashed. Neither of those statements are conclusive. But both are highly indicative as to the cause of this disaster.
Iain
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes
on
0 Posts
Sven Sixtoo
ZD576 did not have radar, as far as I can gather.
Some time ago I posted a great deal on the route as apparent from the stored waypoints, etc.. - of particular note was the selection on 028 on the nav's HoSI course selector which suggested strongly the intention to head out to the route defined by waypoints H to B (028 at the time) after getting to the Mull - this would end up with them handrailing up the clear coastline Isly/Jura and if you are familiar with the Mull coastline you would understand that with the weather that day this was a sensible option as opposed to bumbling up the irregular coast north of the Mull.
With the prevailing local weather on the Mull, it made no sense, nor was it safe, to approach it as closely as waypoint change unless they had a specific reason to do so and some local reference.
There were several attempts to denigrate the significance of way point A, both in inquiries and in the various reports, suggesting that as it did not have so many decimal places (lat, long) that it was not as accurate as the other stored waypoints - I showed that the opposite was true. Whether this untruth repeated so often by the MOD. AAIB, and equipment manufacturers about the waypoints was down to laziness, stupidity, or an agreement to obstruct analysis of the route planning is open to debate.
Just scroll through my posts if you care as I am not bothering to repeat them again now.
ZD576 did not have radar, as far as I can gather.
Some time ago I posted a great deal on the route as apparent from the stored waypoints, etc.. - of particular note was the selection on 028 on the nav's HoSI course selector which suggested strongly the intention to head out to the route defined by waypoints H to B (028 at the time) after getting to the Mull - this would end up with them handrailing up the clear coastline Isly/Jura and if you are familiar with the Mull coastline you would understand that with the weather that day this was a sensible option as opposed to bumbling up the irregular coast north of the Mull.
With the prevailing local weather on the Mull, it made no sense, nor was it safe, to approach it as closely as waypoint change unless they had a specific reason to do so and some local reference.
There were several attempts to denigrate the significance of way point A, both in inquiries and in the various reports, suggesting that as it did not have so many decimal places (lat, long) that it was not as accurate as the other stored waypoints - I showed that the opposite was true. Whether this untruth repeated so often by the MOD. AAIB, and equipment manufacturers about the waypoints was down to laziness, stupidity, or an agreement to obstruct analysis of the route planning is open to debate.
Just scroll through my posts if you care as I am not bothering to repeat them again now.
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes
on
0 Posts
SFFP
Apart from Boeing's "Analysis of Available Data" I have not been aware of a reasonable attempt at basic analysis.
I did my own and formed an interpretation of it - I presume this is what you call "spin". I am reasonably confident that anyone doing their own analysis using the whole of the available data could only come up with the same interpretation.
Have you done any detailed chartwork at all on this crash? What is your interpretation? Perhaps you could post your efforts?
Or don't you give a damn about getting to the cause as per the airworthiness flock?
Apart from Boeing's "Analysis of Available Data" I have not been aware of a reasonable attempt at basic analysis.
I did my own and formed an interpretation of it - I presume this is what you call "spin". I am reasonably confident that anyone doing their own analysis using the whole of the available data could only come up with the same interpretation.
Have you done any detailed chartwork at all on this crash? What is your interpretation? Perhaps you could post your efforts?
Or don't you give a damn about getting to the cause as per the airworthiness flock?
Join Date: Feb 2007
Location: Oxon
Age: 66
Posts: 1,942
Likes: 0
Received 0 Likes
on
0 Posts
Out of the blue a post seemingly seeking a reason to cast aspersions on the pilots.
A familiar tactic that probably means someone has got too close for comfort on recent posts or something has happened recently during the Review to make certain people nervous.
A familiar tactic that probably means someone has got too close for comfort on recent posts or something has happened recently during the Review to make certain people nervous.
Join Date: Apr 2005
Location: France 46
Age: 77
Posts: 1,743
Likes: 0
Received 0 Likes
on
0 Posts
dervish
Don't be silly, it is a perfectly valid question - particularly as the two Pilots were the outgoing and incoming Detatchment Commanders. You may wish to consider whether the crew allocations that day were the best use of resources with the two experienced Chinook Pilots crewed together and the relatively inexperienced on Type RN Exchange Pilot crewed with a Navigator.
Don't be silly, it is a perfectly valid question - particularly as the two Pilots were the outgoing and incoming Detatchment Commanders. You may wish to consider whether the crew allocations that day were the best use of resources with the two experienced Chinook Pilots crewed together and the relatively inexperienced on Type RN Exchange Pilot crewed with a Navigator.
Olive Oil:
Indeed OO, and reckless they were, grossly reckless, criminally so perhaps. The pilots? No, not the pilots OO, the VSO's charged with the awesome responsibility of implementing the UK Military Airworthiness Regulations and thus ensuring that only airworthy aircraft are Released To Service for the Royal Air Force. Not only did they fail totally, stupendously and absolutely in that but they prevailed upon, even ordered, subordinates to do likewise. The result was a Grossly Unairworthy type, a Chinook HC2, tasked to carry these 25 security VIP's to Fort George. They never reached Fort George of course nor survived that doomed mission. Reckless hardly begins to describe such action I would suggest
.....but that does not mean they would not be reckless.
The FADEC software had not been proved to be safe.
The FADEC software has not been proved to be unsafe.
The code was in a position where the relevant checks could not be done, because it just wasn't written very well.
The FADEC software has not been proved to be unsafe.
The code was in a position where the relevant checks could not be done, because it just wasn't written very well.
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,821
Likes: 0
Received 0 Likes
on
0 Posts
Caz, if you're going to use facts I suggest you make sure they're factual. For sure, you missed at least one other Mk2 crash - ZA704 on 25 Nov 99 near Seeb.
PS. I'm not even implying that any of the post Mull crashes had airworthiness as a causal factor.
PPS. The CRM question is just as valid as all the others. I for one would love to see an inquiry that looked at all the factors rather than one that merely rolled out a specific argument.
PS. I'm not even implying that any of the post Mull crashes had airworthiness as a causal factor.
PPS. The CRM question is just as valid as all the others. I for one would love to see an inquiry that looked at all the factors rather than one that merely rolled out a specific argument.
I just googled Chinook HC2 accidents and, apart from ZD576, there have been just two - both on Active Service in Afghanistan.
Relevance?
At the time, there had been a number of Chinook crashes attributed solely to systemic airworthiness failings. (Source - Inspectorate of Flight Safety to RAF Chief Engineer, Alcock and ACAS, Bagnall). I wonder what these two will say when asked if they passed IFS's report to their respective bosses?
Of the technical recommendations, how many had been implemented by 2nd June 1994? None.
How many would have been avoided / could have been resolved by simple application of mandated airworthiness regulations? All of them.
What was the RAF's reaction to the report? Withhold it from Controller Aircraft and the Board of Inquiry, while ploughing ahead with their policy to dismantle the airworthiness system.
I suggest those are relevant facts that certain officers are finding uncomfortable reading at the moment as Lord Philip investigates their actions.
Join Date: Jun 2007
Location: Detroit MI
Age: 66
Posts: 1,460
Likes: 0
Received 0 Likes
on
0 Posts
ZH875:
I'm sorry but that is a crock, (though I'm guessing that it's not your fault that you don't know that).
Code is tested, retested ad infinitum and released. After release, it is tested in the real world. That's where the things programmers can't see, test for, think of come to light. Then amendments, (updates), are made to the original code and disseminated. Until that process has occurred through numerous cycles it cannot be considered "safe". The code they work on is called the "source code". Until the code as been through hundreds of cycles it cannot be considered "mature". Windows 2000 is mature... Windows XP is probably mature now. They've been used by millions of people and had hundreds if not thousands of updates... One wonders how many times the FADEC software was reassessed let alone updated.
I wrote my first code in 1981, (actually, in school in 1974 - but we won't count that). I subsequently taught myself Assembly Language in 1982 which is, to all intents and purposes, talking the computer's natural tongue. After leaving the RAF in 1988 I have worked continuously in the field and have learned and programmed in several languages ever since and for the last 15 years have supervised a number of programmers. I last wrote code just this morning so I can claim some "expertise" in the field.
I have read several times in this thread that the FADEC code is "un-auditable". There are just two reasons why the code could be in such a state:-
For those that think that code can be compiled, loaded to a chip and the source thrown away so the compiled code can't be decompiled... I can assure you that you are wrong. It can and will be "dragged" off the chip. Once off the chip, it's mine...
Options two and three are the more likely scenarios. Take your pick... Either way, someone in the MoD knows this, accepts this and will probably retire more comfortably for not having "blown the whistle".*
* Far be it from me to suggest that they might have been promoted for such an omission - but that's just me speculating away....
The code is there for everyone to see if there is the will to see it. The people saying it is unauditable are stupid or liars. If they don't like that statement then they can PM me for my name and address and they can go ahead and sue me. I look forward to their arguments in court.
The FADEC software had not been proved to be safe.
The FADEC software has not been proved to be unsafe.
The code was in a position where the relevant checks could not be done, because it just wasn't written very well.
The FADEC software has not been proved to be unsafe.
The code was in a position where the relevant checks could not be done, because it just wasn't written very well.
Code is tested, retested ad infinitum and released. After release, it is tested in the real world. That's where the things programmers can't see, test for, think of come to light. Then amendments, (updates), are made to the original code and disseminated. Until that process has occurred through numerous cycles it cannot be considered "safe". The code they work on is called the "source code". Until the code as been through hundreds of cycles it cannot be considered "mature". Windows 2000 is mature... Windows XP is probably mature now. They've been used by millions of people and had hundreds if not thousands of updates... One wonders how many times the FADEC software was reassessed let alone updated.
I wrote my first code in 1981, (actually, in school in 1974 - but we won't count that). I subsequently taught myself Assembly Language in 1982 which is, to all intents and purposes, talking the computer's natural tongue. After leaving the RAF in 1988 I have worked continuously in the field and have learned and programmed in several languages ever since and for the last 15 years have supervised a number of programmers. I last wrote code just this morning so I can claim some "expertise" in the field.
I have read several times in this thread that the FADEC code is "un-auditable". There are just two reasons why the code could be in such a state:-
- The company/contractor who wrote the initial code doesn't have/will not release the source code.
- Someone else won't let the original company/contractor release the source code.
- Someone doesn't want the source code decompiled so they are telling everyone it can't be done.
For those that think that code can be compiled, loaded to a chip and the source thrown away so the compiled code can't be decompiled... I can assure you that you are wrong. It can and will be "dragged" off the chip. Once off the chip, it's mine...
Options two and three are the more likely scenarios. Take your pick... Either way, someone in the MoD knows this, accepts this and will probably retire more comfortably for not having "blown the whistle".*
* Far be it from me to suggest that they might have been promoted for such an omission - but that's just me speculating away....
The code is there for everyone to see if there is the will to see it. The people saying it is unauditable are stupid or liars. If they don't like that statement then they can PM me for my name and address and they can go ahead and sue me. I look forward to their arguments in court.
AA
A very good post.
MoD's policy of the day was to obtain access to source code (especially that of Safety Critical Software) so that it could be independently validated and verified. Policy dictated this V&V was carried out by Boscombe Down.
When bidding for the job, or replying to an invitation to tender, the contractor MUST make a written statement he will adhere to this policy, which was promulgated in the form of a joint MoD/Industry agreement. Clearly, MoD must then reflect this policy in the contracts.
The Project Manager MUST demonstrate the above arrangements are in place before approval is sought to proceed with Development.
In short, the reason why V&V had not been completed on 2nd June 1994 (in fact, abandoned while Boscombe awaited a representative build standard to work on) was because these mandated regulations had not been implemented. The subsequent dissembling as MoD sought to place blame on Boscombe was disgraceful. Boscombe merely attempted to follow the regulations but were undone by MoD's refusal to and the haste to release an immature design to service.
A very good post.
MoD's policy of the day was to obtain access to source code (especially that of Safety Critical Software) so that it could be independently validated and verified. Policy dictated this V&V was carried out by Boscombe Down.
When bidding for the job, or replying to an invitation to tender, the contractor MUST make a written statement he will adhere to this policy, which was promulgated in the form of a joint MoD/Industry agreement. Clearly, MoD must then reflect this policy in the contracts.
The Project Manager MUST demonstrate the above arrangements are in place before approval is sought to proceed with Development.
In short, the reason why V&V had not been completed on 2nd June 1994 (in fact, abandoned while Boscombe awaited a representative build standard to work on) was because these mandated regulations had not been implemented. The subsequent dissembling as MoD sought to place blame on Boscombe was disgraceful. Boscombe merely attempted to follow the regulations but were undone by MoD's refusal to and the haste to release an immature design to service.
Join Date: Aug 2005
Location: Sussex, UK
Age: 58
Posts: 270
Likes: 0
Received 0 Likes
on
0 Posts
Without going into the technicalities, depending on how the system is implemented, it may be impossible to prove that it is safe. It is possible however, to prove that it is unsafe - If the code doesn't match the specification for example.
However, Tuc implies that the MOD/Boscombe Down did not have access to the source code. Is/was that the case? If so then they wouldn't have been able to fully audit it. But I'm unclear how they could have reached their conclusions below in that case...
It's been posted before on this thread, but I couldn't find it so I have posted it again. I'm not sure how much of an audit they did, but Boscombe Down did enough to find it wanting...
The report, written by a senior engineering officer at the MoD Aircraft Testing Centre at Boscombe Down, says: "The hazard analysis of Chinook Mk 2 … identifies the software in the engine FADEC as safety critical and states that 'any malfunctions or design errors could have catastrophic effects'.
"21 category one and 153 category two anomalies have been revealed. One of these …is considered to be positively dangerous.
"The density of deficiencies is so high that the software is unintelligible… Pilots' control of the engine(s) through FADEC cannot be assured."
The report said the in-service use of the Mk2 Chinook "cannot be recommended", and called for the software to be rewritten.
"21 category one and 153 category two anomalies have been revealed. One of these …is considered to be positively dangerous.
"The density of deficiencies is so high that the software is unintelligible… Pilots' control of the engine(s) through FADEC cannot be assured."
The report said the in-service use of the Mk2 Chinook "cannot be recommended", and called for the software to be rewritten.
Last edited by Thor Nogson; 8th Jun 2011 at 11:52. Reason: Typo
Just a Reminder
We will probably never have any hard evidence as to what caused the accident on that fateful day. . .But that is irrelevant. The point at issue is not whether there is new evidence, but whether the known facts justified the air-marshals in finding that the pilots had been grossly negligent.
Malcolm Rifkind, Secretary Of State For Defence 1992-1995
Join Date: Jun 2007
Location: Detroit MI
Age: 66
Posts: 1,460
Likes: 0
Received 0 Likes
on
0 Posts
Thor:
Thank you... I hadn't seen that little gem before. So the code was "auditable" but it sounds like, in the light of that revelation, we can add a fourth reason:-
4. Those charged with auditing the code find such an unholy mess they throw up their hands and give up.
I have had to update other people's code in the past and, on occasion, I find it so badly written that, rather then edit, I would rewrite from scratch for two reasons:-
Thank you... I hadn't seen that little gem before. So the code was "auditable" but it sounds like, in the light of that revelation, we can add a fourth reason:-
4. Those charged with auditing the code find such an unholy mess they throw up their hands and give up.
I have had to update other people's code in the past and, on occasion, I find it so badly written that, rather then edit, I would rewrite from scratch for two reasons:-
- I simply can't trust the code to be bug free in any, let alone all, circumstances - in the context of the FADEC code read: "safe"
- I cannot be sure in any circumstances that any edit I might do to one section of the code might not cause the unpredictable failure of another module.