Go Back  PPRuNe Forums > Aircrew Forums > Military Aviation
Reload this Page >

Chinook - Still Hitting Back 3 (Merged)

Wikiposts
Search
Military Aviation A forum for the professionals who fly military hardware. Also for the backroom boys and girls who support the flying and maintain the equipment, and without whom nothing would ever leave the ground. All armies, navies and air forces of the world equally welcome here.

Chinook - Still Hitting Back 3 (Merged)

Thread Tools
 
Search this Thread
 
Old 23rd Jun 2011, 07:08
  #7841 (permalink)  
 
Join Date: Sep 2005
Location: preston
Age: 76
Posts: 376
Likes: 0
Received 0 Likes on 0 Posts
Walter

One very simple question. What possible benefit could the SEAL and his fellow conspiritors gain by risking their lives to switch off the TANS computer?
The data inside is already stored. It is not recording crew conversations, radio calls, use of other equipment (such as CPLS, TACAN).
Why risk death to achieve, well, just what?
Please enlighten.
dalek is offline  
Old 23rd Jun 2011, 07:22
  #7842 (permalink)  
Per Ardua ad Astraeus
 
Join Date: Mar 2000
Location: UK
Posts: 18,579
Likes: 0
Received 0 Likes on 0 Posts
Guys - it is not the Tans we need to switch off - try it!
BOAC is offline  
Old 23rd Jun 2011, 08:42
  #7843 (permalink)  
 
Join Date: Feb 2003
Location: uk
Posts: 3,225
Received 172 Likes on 65 Posts
tucumseh is offline  
Old 23rd Jun 2011, 10:13
  #7844 (permalink)  
 
Join Date: Apr 2008
Location: UK
Posts: 49
Likes: 0
Received 0 Likes on 0 Posts
tucumseh (referring to my #7900):

Not sure what you're getting at here. If you aren't are familiar with the policy document, it is 49 pages long. If you are familiar with it, what part do you want me to quote?
My point is that the paragraph you quoted (I've never seen the document it comes from) does not require/mandate/regulate independent V&V (verification & validation). All it does is say that if (a big if!) independent V&V is required then access to the software must be secured by the MoD ... which is kind of obvious cos. how else is independent V&V on the software going to be carried out unless access to the software is secured.

Now, having said that, during my low-level involvement in MoD aviation software safety in the 90s (Chugalug2 - specifically around 1994-1998), I became aware of what seemed to be a working policy that safety-related aviation software should be submitted to independent V&V. I specify "aviation" because that's all I worked on and all I knew about - I don't know if that policy spread wider or not. And I can only refer to the (supposed) policy in these terms because I have no idea whether it was ever enshrined in formal regulation or not (I was "low-level").

FWIW, I am interested in whether there was any formal regulation (aviation-specific or across the board) which required MoD to submit safety-related software to independent V&V in the 90s. A piece of regulation that merely says, if you want to do independent V&V then you have to secure access to the software is of much less interest to me, both because it doesn't actually require the independent V&V and because it seems pretty nugatory.


Chugalug2:

It seems to me that de facto policy did not lead to de facto observance of the Regulations, but that is something that you [Squidlord] have said is not strictly necessary, isn't it?
No, it isn't (I'm left wondering why Chugalug2 would put such a spin on what I actually did write).

I'm also not sure what Chugalug2's general point is. Why would a de facto MoD policy (whether I am right about its existence or not) of facilitating independent V&V for aviation software have anything to do with whether or not safety regulation in general was observed or not?

Last edited by Squidlord; 23rd Jun 2011 at 10:15. Reason: clarity
Squidlord is offline  
Old 23rd Jun 2011, 16:14
  #7845 (permalink)  
 
Join Date: Aug 2006
Location: West Sussex
Age: 82
Posts: 4,759
Received 221 Likes on 69 Posts
Squidlord:
(I'm left wondering why Chugalug2 would put such a spin on what I actually did write).
Well let's see what you actually wrote:
(Oh, and strictly, I disagree with Chugalug2 when (s)he suggests that if regulation is not followed, it necessarily means the software is unairworthy. However, I do believe that if regulation is not followed then it is very unlikely that the software could be satsifactorily demonstrated airworthy (as required) - a subtle distinction.)
I suppose what grates here is that anyone charged with producing Safety Critical Software should do anything other than follow Regulations to the letter. This is the crux of the airworthiness saga traced through the Sea King, Tornado, Hercules, Nimrod and Chinook threads concerning the fatal accidents involving those types. In each case the Regulations were not followed. If they had been, Sea King pilots would not have received glare from their own HISL's. Hence they might have seen one another. Tornado IFF failures would have become apparent and hence could be reported to Air Defence Sites. Hercules fuel tanks could have received small arms rounds without immediately exploding. Nimrod aircraft could be Air Refuelled without shortly thereafter meeting the same fate. Chinooks would have had reliable FADEC's that performed to pilot input rather than their own arbitrary and unpredictable fancy. Now none of that might have avoided the accidents, we'll never know, not least because the BoI's left much to be desired, but they would at least not have been airworthiness related accidents as they are now.
So it is the proposition that you put that I cavil at, that SCS software could be airworthy even if the Airworthiness Regulations are not followed. I know that you qualify that, but I disagree with your fundamental precept and say that if the Regulations are not followed then the code cannot be considered airworthy, endex. The problem of course is that the Regulations are enforced by the same organisation sourcing it, operating it, and in the event that it ends up strewn over a hillside, effectively investigating it, ie the MOD. That is what needs to change. The expediency implicit in your proposition illustrates that need perfectly in my view.
Chugalug2 is offline  
Old 23rd Jun 2011, 17:50
  #7846 (permalink)  
 
Join Date: Feb 2003
Location: uk
Posts: 3,225
Received 172 Likes on 65 Posts
Squidlord



My point is that the paragraph you quoted (I've never seen the document it comes from) does not require/mandate/regulate independent V&V (verification & validation). All it does is say that if (a big if!) independent V&V is required then access to the software must be secured by the MoD ... which is kind of obvious cos. how else is independent V&V on the software going to be carried out unless access to the software is secured.

DUS(DP)’s policy requires the contents to be incorporated into specifications, invitations to tender (both competitive and non-competitive) and project documentation by the Procurement Executive and its Project Managers (para 0, Introduction). Para A1.1 says “This policy SHALL be adopted by all MoD(PE) branches procuring operational software-based systems”. In turn, this was reflected in Controller Aircraft Instructions, Def Stans and all Airworthiness, Technical and Financial approval delegation and training.

The policy includes a mandated Compliance Matrix to be completed during tendering. There are 29 questions, each reflecting a component of the policy. Two of them apply only to MoD Project Manager (including V&V / Acceptance Criteria), emphasising the Joint nature of the policy. Non-compliant against requirements = no contract.

The relevant Def Stan mandates Independent Validation and Verification for Safety Critical Software. The use of the term “if” in this context merely reflects the fact the policy applies to all software. Safety Critical Software was then addressed in a separate section of the policy and specific Def Stans. “Independent” is defined as being commercially and managerially independent of the Design Team “both to preserve objectivity and to minimise pressure for premature acceptance”. None of the V&V team is permitted to have any other role in the project.

There is a requirement for an Independent Safety Auditor, who can be an independent company or an independent division of the prime contractor.

The MoD PM is also required to appoint an MoD Safety Assurance Authority, usually A&AEE. While at the time part of MoD, the airworthiness delegation chain ensured they were “independent” of the PM.

The regulations are written in such a way as to offer flexibility, while emphasising where independence is required. Who fulfills what role is not mandated; but must be agreed from the outset in the Safety Plan. At that stage, funding is more or less set in concrete. In practice, A&AEE were mandated because, as part of MoD, they were classed as “intramural” and little or no funding was provided to pay anyone else! (In the same way MoD workshops were mandated and paid for separately from the Centre). Also, because V&V is a system issue. You can do all the Static and Dynamic analysis you like, but the system must be integrated and verified as e.g. DECU > FADEC > Engine > Aircraft etc. (Discuss Boeing's role in this - no-one else does!).

It is at this stage A&AEE come into their own. You can see this independence within A&AEE at work in the correspondence of the day, whereby one division expressed itself reasonably content with Mk2, but those responsible for the SCS condemned it as “positively dangerous”. A&AEE followed the rules – as one component was not sufficiently mature, the whole system (including the aircraft) defaulted to that lower level of maturity. The RAF did not follow these rules.


You could exclude A&AEE from certain roles, but needed to demonstrate adequate financial provision for extramural contracting. In the case of Chinook MLU, it is obvious A&AEE had a wide ranging and pivotal role to provide independent technical advice, V&V tasks and safety assurance. This was entirely normal at the time. It is said “A&AEE only provide advice”, but in practice their signature was mandated before technical/integration maturity and adequate safety could be declared.

A&AEE were the glue holding the process together. Interestingly, the policy requires SCS to be "coded to the satisfaction of RSRE Malvern and subjected to such additional validation and verification as (RSRE Malvern) or the Project Office may determine, to establish safety accreditation of the system”. Note: RSRE could direct this, independently of the project office; an authority vested in them at Ministerial level. (At the time, of course, RSRE were completely independent of A&AEE). In the case of Chinook FADEC, you never see this mentioned when reading the lengthy MoD diatribes against A&AEE. No-one seems to have asked what RSRE thought of the quality of a product with hundreds of problems. One assumes they wouldn’t have signed it off either.

Clearly, others may have a different view borne of their own experiences, in part caused by the flexibility the system allows; but I think most would differ only in minor detail from what I describe. For example, I’ve contracted (tasked) DRA Farnborough to do the V&V (e.g. Sonics). Also, the Service themselves, in the form of both Software Support Cells and Operators. I’ve also contracted a Design Custodian to do it (e.g. Nav). However, I have also expressly refused to allow 3rd line workshops to do it, because they did not have the necessary QA certification (AQAP 13 at the time). Much of this is down to engineering judgment.

The bottom line is that both the Project Manager and Safety Assurance Authority must co-sign, for example, the Safety Critical Software Certificate and Certificates of Design. As I said before, as A&AEE had snagged the FADEC software on so many counts, it is inconceivable they contradicted themselves by signing the SCSC; so it follows there is no audit trail to proper V&V or acceptance, meaning there is no proper authorisation to fit this SCS to a Service aircraft (as opposed to the PE Fleet).


Hope this answers your question. I did PM you and was willing to discuss this off-line, so others will please excuse the lengthy reply on what is a broad subject.


tucumseh is offline  
Old 24th Jun 2011, 08:54
  #7847 (permalink)  
 
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes on 0 Posts
dalek
<< What possible benefit could the SEAL and his fellow conspiritors gain by risking their lives to switch off the TANS computer?
The data inside is already stored. >>
Check out Tuc's excellent photo - note the unburnt grass and that the fuel tanks had ruptured on impact (no further risk of sudden fireball).
If you could recognise the nav computer that may (and did!) store invaluable data, and you didn't know any better, why not switch it off just to make sure data was not saved? As it happened, not much at all could have been done analysis wise had the STANS data been lost (pesky internal battery, eh?).
Anyway, if you were willing and able to use the data, you would surely come to the same conclusions as I in regard to a steady intended approach to a particular point and I am surprised that so many of you are reluctant to do the most basic analysis to reconstruct the final leg as much as it is possible.
At the very least it proved baseless the original official line of an inappropriate rate of climb to clear the Mull - part of the "negligence" thinking - surely enough on its own to demand the revision of the verdict.
Tuc
Got any more such photies? - eg the left hand pilot's console?

Last edited by walter kennedy; 24th Jun 2011 at 09:01. Reason: spelling
walter kennedy is offline  
Old 24th Jun 2011, 19:16
  #7848 (permalink)  
 
Join Date: Apr 2005
Location: France 46
Age: 77
Posts: 1,743
Likes: 0
Received 0 Likes on 0 Posts
Odd that Mr Ellacott, who was less than 100 yards from the crash site, never mentioned seeing anyone else as he proceeded towards the wreckage. He did state however that visibility was " nine or ten feet maximum" - which would have given the "SEAL" a few problems in locating the wreckage.
cazatou is offline  
Old 25th Jun 2011, 05:57
  #7849 (permalink)  
 
Join Date: Sep 2005
Location: W. Scotland
Posts: 652
Received 48 Likes on 24 Posts
note the unburnt grass and that the fuel tanks had ruptured on impact (no further risk of sudden fireball).
If you could recognise the nav computer that may (and did!) store invaluable data, and you didn't know any better, why not switch it off just to make sure data was not saved?

I have difficulty following your logic. If I have understood previous posts correctly about sooting patterns indicating the switch was off before fire took hold, then surely the Seal risked life and limb to check the switch was off, not switch it off?

Just so I’m clear, this isn’t the same box the Seal risked his life to retrieve and take away with him?
dervish is offline  
Old 25th Jun 2011, 06:44
  #7850 (permalink)  
 
Join Date: Feb 2003
Location: uk
Posts: 3,225
Received 172 Likes on 65 Posts
Odd that Mr Ellacott, who was less than 100 yards from the crash site, never mentioned seeing anyone else as he proceeded towards the wreckage. He did state however that visibility was " nine or ten feet maximum" - which would have given the "SEAL" a few problems in locating the wreckage.

Quite right. More importantly, nor did those who could see 500 yards.

Perhaps the SEAL approached from that direction? He'd have had perfect visibility and time to orientate himself amongst the wreckage.
tucumseh is offline  
Old 25th Jun 2011, 06:47
  #7851 (permalink)  
 
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes on 0 Posts
dervish
You need to read the AAIB report to get a picture of how the fire spread up the slopes – basically much of the wreckage had landed significantly up the slope from where the fuel tanks ruptured and the impression I get is that something like a grass fire was gradually fanned up the slopes in the strong wind – so the forward section had not been “engulfed” in flames (as some have described it) but much smoke would have been blown over it before the grass fire reached it.
While it is possible (but highly unlikely because of its mechanism) that the switch got to off on impact, it is without doubt that the STANS was still functioning up until impact; as Tucumse's query as to whether the switch being set to “off” stopped internal processing has not been answered, I am assuming that the switch had not been turned off by the crew – the data within was meaningful right up to impact and it makes no sense that they would have switched it off anyway.
Don't worry about the switch – use the miracle of the retrieved data to reconstruct the track;
it is apparent that they turned right onto a particular heading at or soon after waypoint change (HP's course selector consistent with track over ground as per retrieved data and crash position) despite that they would surely have been aware of the presence of the ground albeit difficult to judge accurately just how far it was visually – they would surely have been relying upon guidance from some reference;
look at the snapshot of engine states and control positions that only fitted with their being surprised at their imminent closure with the terrain – they must have been misled somehow as to how far to go;
thus far is fact evidenced by the available data;
I speculated that the only system that could have been available to them and which could explain how they could have been misled by its simply being out of position was CPLS – it turned out that this system was fitted;
I speculated that US personnel were stationed nearby and would have been ideal candidates to help out with a demo/exercise using CPLS as they use the system a lot – perhaps someone else was doing the ground bit, it doesn't matter at this stage.
An undeclared exercise using such equipment seems the most likely explanation and inquiry along this line should surely clear the pilots of blame – a win-win situation for all of us.
walter kennedy is offline  
Old 25th Jun 2011, 07:46
  #7852 (permalink)  
 
Join Date: Sep 2005
Location: W. Scotland
Posts: 652
Received 48 Likes on 24 Posts
as Tucumse's query as to whether the switch being set to “off” stopped internal processing has not been answered, I am assuming that the switch had not been turned off by the crew
Your logic escapes me again. Just because no one has answered a relevant question, the question should be ignored and a conclusion reached that fits your theory? That sounds like MoD logic.

it makes no sense that they would have switched it off anyway.
Don't worry about the switch
I read long ago that switching off the box was a way of clearing radio emc problems. Even if not true surely the switch position is very important as the system’s data is the basis of MoD’s argument? Not conclusive, but an unexplained coincidence that needs an answer.

– the data within was meaningful right up to impact and
The data is only meaningful if the pilots can read and make use of it. If the display was switched off…

I can’t answer my questions, or yours, but neither does anyone else. You raise good points but I think you reach pretty odd conclusions. Have you put all this before Lord Phillips? Probably best if you ask the questions but avoid the conclusions.
dervish is offline  
Old 25th Jun 2011, 09:14
  #7853 (permalink)  
 
Join Date: Sep 2005
Location: preston
Age: 76
Posts: 376
Likes: 0
Received 0 Likes on 0 Posts
It is without doubt the TANS was functioning until impact.

It certainly is not. The internal battery was allowing storage of incoming data but at the 26 (or 32 sec point before impact, depending on which document you read), the power switch was moved to the off position and NAV display and all other functions were lost.
dalek is offline  
Old 25th Jun 2011, 09:31
  #7854 (permalink)  
 
Join Date: Feb 2007
Location: Oxon
Age: 66
Posts: 1,942
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by walter kennedy
An undeclared exercise using such equipment seems the most likely explanation and inquiry along this line should surely clear the pilots of blame – a win-win situation for all of us.
Walter,

I have asked this before and you never got round to replying and I doubt that is going to change but

Who actually authorised this undeclared exercise?

The planning for such a mission would without doubt have involved the 7(SF) command chain and there would have been documented evidence to verify what had been arranged.

Or are you suggesting that the only 4 members of 7(SF) who knew what was going on were all killed that day. That their fellow det crews were unaware, the duty auth was unaware, the whole of the RAF Odiham command chain were unaware?

What scenario have for the fact that not a single soul has come forward to substantiate your claims?

Edited to ask if there are any 7(SF) Captains, past or present who tell me if the mission as proposed by Walter falls within or outside the powers of self auth that the crew may have been operating to?

Last edited by Seldomfitforpurpose; 25th Jun 2011 at 10:34.
Seldomfitforpurpose is offline  
Old 25th Jun 2011, 11:09
  #7855 (permalink)  
 
Join Date: May 1999
Location: Quite near 'An aerodrome somewhere in England'
Posts: 26,803
Received 270 Likes on 109 Posts
The leader of the team involved in the PRC-112 trial conducted on the Mull that day has recently provided the following comment:



Weird Wally, it's time for you to give up and accept that your daft theory of little green men and/or SEALs scurrying about on the Mull with their wacky wirelesses is a load of tosh.
BEagle is offline  
Old 25th Jun 2011, 18:33
  #7856 (permalink)  
 
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes on 0 Posts
dalek
for the purpose of analysis, the system was working - pls read all technical reports: several positions were stored between waypoint change and power down/impact that lay along the 035 (mag of the time).
On that final leg from waypoint change to the crash site, just ignore the switch business for the moment as it does not matter if the crew could see anything on the display, they having effectively dumped the only immediately useful STANS waypoint at waypoint change.
I believe that they were focused on something else on that leg - the usefulness of the STANS data is that it allows us to establish things like the track and the position of the last altitude update from the encoding altimeter.
Get the reports on the STANS component systems and extract for yourself the position data and reconstruct the track - then pls tell us what you make of it.
walter kennedy is offline  
Old 25th Jun 2011, 19:23
  #7857 (permalink)  
 
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes on 0 Posts
Beagles
Sounds like you've half a mind to join the airworthiness flock – that should be enough.
walter kennedy is offline  
Old 25th Jun 2011, 19:42
  #7858 (permalink)  
 
Join Date: Sep 2003
Location: Perth, Western Australia
Posts: 786
Likes: 0
Received 0 Likes on 0 Posts
SFFP
Who would have been involved in planning and authorising any such exercise is the all important question – when they are identified they would need to be questioned under oath at an inquiry whether there was any hitherto undeclared exercise extra to the ferry flight and what was the nature of it.
You also make the point that “... not a single soul has come forward to substantiate your claims.” - well, look how long it took for anyone to come forward about the very existence of the CPLS let alone that it was fitted – and then they all pulled their heads back in – it would require great personal courage or literally death bed confessions by them given the political ramifications of this disaster to security – the own goal against a large chunk of Britain – only specific questions under oath can hope to clear this up.
walter kennedy is offline  
Old 25th Jun 2011, 20:59
  #7859 (permalink)  
 
Join Date: Apr 2009
Location: Hotel Gypsy
Posts: 2,821
Likes: 0
Received 0 Likes on 0 Posts
Can we put this nonsense to bed?

The passengers were on their way to a nice long-weekend retreat (complete with golf clubs) for a retirement swan-song.

The pilots were doing a 'bus' run.

No passenger on board had a direct interest in any form of sneaky-beaky approach aid. Even if they did, what relevance would such an approach, in the circumstances presented, have to a bunch of people sat down the back of a noisy, smelly, uncomfortable Chinook? I don't recollect the accident report commenting on any of the spooks being sat in the jump seat, supposedly watching a magical CPLS approach on an aircraft that did not have a single navaid or comms box with a release to service; were Tapper and Cook really that reckless?

Walter, give up - you have taken too much bandwidth here. Most rationale people feel that the pilots may have got things wrong. However, the same people argue that the 'verdict' is unsound. Whether the actual cause was airworthiness, pilot error, state murder or little green men is not the key point. The POINT is that the MOD's findings did/do not have the necessary substance. Your argument, even if it had a single thread of credibility, undermines many more valid and convincing reasons why the MOD's stance is unjust.

Of course, like all such 'who-killed-JFK' or 'man-on-the-moon' type theories, you argument, however fantastical, always generates doubt. Such a tenuous stance is cancerous.
Cows getting bigger is offline  
Old 25th Jun 2011, 21:31
  #7860 (permalink)  
 
Join Date: Jun 2007
Location: Detroit MI
Age: 66
Posts: 1,460
Likes: 0
Received 0 Likes on 0 Posts
Of course, like all such 'who-killed-JFK' or 'man-on-the-moon' type theories, you argument, however fantastical, always generates doubt.
Having been a bit of a "spotter" on the "Who killed JFK" thing I still think there are things that don't quite fit - especially the speed and accuracy attributed to Oswald on a moving vehicle with the weapon used. There were men on the moon - no question...

Was there a SEAL on the Mull?

About the same chance as Mary Jo Kopechne surviving a night with Ted Kennedy.
Airborne Aircrew is offline  


Contact Us - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service

Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.