Haddon-Cave, Airworthiness, Sea King et al (merged)
Good as it would be in theory, I am not at all sure that the MAA can be independent. There has to be a good deal of current Military involvement, otherwise it will not be an MAA, but a CAA for the military.
At the design and support levels civilian input alone may (should) be sufficient to maintain airworthiness which is not, in my view, in the world of military aviation always the same as safety. However at the operational levels this needs to be tempered by a good deal of operational judgement and to ensure that a real operational requirement (not one for an exercise, or for training) is met. If corners have to be cut then those curtting them should know they have been cut, record this and be prepared to justify there decisions, both to operational commands and to airworthinesss authorities.
Once there are serving military people in the MAA then they are subject to all the influences that have brought us to where we are. It then comes down to culture and to rules.
The rules need to constrain the airworthiness decisions of those in operational roles and these rules need to be known and the consequences of ignoring them feared by those who apply them. It has long been one of the RN's concerns that the SMR of a ship's Flight might be subject to undue pressure from a ship CO or Flight Commander to undertake unauthorised mods or allow an unserviceable aircraft to be operated. During my time Flight Commanders knew that the system would descend hard if the rules were broken, or even bent badly, and much effort was devoted to training and supporting SMR's so they were not placed in the wrong position.
An effective airworthiness culture can also be instilled, if the will is there. Way back when, even before my time, the Fleet Air Arm had a previous airworthiness problem, albeit mainly at the operational level. The answer, and the culture changer, was called "We have a Problem". Today it would be a "change programme" or an "initiative" but a rose by any other name..... Maybe it's time for a tri-service repeat.
N
At the design and support levels civilian input alone may (should) be sufficient to maintain airworthiness which is not, in my view, in the world of military aviation always the same as safety. However at the operational levels this needs to be tempered by a good deal of operational judgement and to ensure that a real operational requirement (not one for an exercise, or for training) is met. If corners have to be cut then those curtting them should know they have been cut, record this and be prepared to justify there decisions, both to operational commands and to airworthinesss authorities.
Once there are serving military people in the MAA then they are subject to all the influences that have brought us to where we are. It then comes down to culture and to rules.
The rules need to constrain the airworthiness decisions of those in operational roles and these rules need to be known and the consequences of ignoring them feared by those who apply them. It has long been one of the RN's concerns that the SMR of a ship's Flight might be subject to undue pressure from a ship CO or Flight Commander to undertake unauthorised mods or allow an unserviceable aircraft to be operated. During my time Flight Commanders knew that the system would descend hard if the rules were broken, or even bent badly, and much effort was devoted to training and supporting SMR's so they were not placed in the wrong position.
An effective airworthiness culture can also be instilled, if the will is there. Way back when, even before my time, the Fleet Air Arm had a previous airworthiness problem, albeit mainly at the operational level. The answer, and the culture changer, was called "We have a Problem". Today it would be a "change programme" or an "initiative" but a rose by any other name..... Maybe it's time for a tri-service repeat.
N
Join Date: Nov 2003
Location: Next door
Posts: 74
Likes: 0
Received 0 Likes
on
0 Posts
Rigga,
Not sure who you are directing the "Get over the money thing". If it is me, I certainly don't want the 'cost thing' to be thrown back at engineers trying to keep an aircraft airworthy.
If it is a comment at everyone, then it is laudable, but rather naive. There is a whole section of people involved at some point in the airworthiness and continued airworthiness business, who see nothing but the cost of work required, and spend their day trying to pin the cost on someone else.
How do you enlighten them, how do you persuade them to spend money on an extra QA guy, or an Inspector of Flight Safety, or an HF Investigator etc.etc. because I can point to many accidents, where those areas have been gapped, or just not bothered about, and have be subsequently cited in the accident report.
So whether we like it or not 'the money thing' is always there
Not sure who you are directing the "Get over the money thing". If it is me, I certainly don't want the 'cost thing' to be thrown back at engineers trying to keep an aircraft airworthy.
If it is a comment at everyone, then it is laudable, but rather naive. There is a whole section of people involved at some point in the airworthiness and continued airworthiness business, who see nothing but the cost of work required, and spend their day trying to pin the cost on someone else.
How do you enlighten them, how do you persuade them to spend money on an extra QA guy, or an Inspector of Flight Safety, or an HF Investigator etc.etc. because I can point to many accidents, where those areas have been gapped, or just not bothered about, and have be subsequently cited in the accident report.
So whether we like it or not 'the money thing' is always there
SS,
Yes, the comment was tilted at you because of your quoted lines, but is actually aimed at the whole thread.
I agree there is always a cost to recognise but, as I stated, this thread should not get stuck on affordability - we will all then turn into closet accountants and talk about double-entry book-keeping.
I too have to bear costs and be aware of their implications, but I have also had to justify some substantial costs where needed and then find it.
MOD seems to have little choice but to find money for its own remedies. One cannot keep robbing Peter to pay for Paul's mistakes. "Peter" is bound to want something back at some point - and MOD has yet to outwardly recognise that there is always a penalty price to pay for every short cut.
To use Tuc's words (again) - to build on 'solid foundations' you need to put something solid down or dig down to it - and that has costs - but without that cost there is no point in continuing to expect a secure future.
Yes, the comment was tilted at you because of your quoted lines, but is actually aimed at the whole thread.
I agree there is always a cost to recognise but, as I stated, this thread should not get stuck on affordability - we will all then turn into closet accountants and talk about double-entry book-keeping.
I too have to bear costs and be aware of their implications, but I have also had to justify some substantial costs where needed and then find it.
MOD seems to have little choice but to find money for its own remedies. One cannot keep robbing Peter to pay for Paul's mistakes. "Peter" is bound to want something back at some point - and MOD has yet to outwardly recognise that there is always a penalty price to pay for every short cut.
To use Tuc's words (again) - to build on 'solid foundations' you need to put something solid down or dig down to it - and that has costs - but without that cost there is no point in continuing to expect a secure future.
Bengo
In extremely simple terms, one must break the problem down into 3 components.
1. Attaining airworthiness (before the RTS is issued).
2. Maintaining it against the endorsed SOUI and Build Standard (there is overlap, but basically after RTS issued).
3. Fitness for Purpose or Operational Airworthiness; which is where you deviate from the SOUI and Build Standard.
Your concerns (and those of others) apply to 3.
1. and 2. can be independent. This is where almost all the systemic failings acknowledged (and denied!!) by MoD occur. Solving them is a complete no-brainer. Follow the regulations. MoD's only problem is finding someone junior enough to arrange this in his spare time.
There exists a line (boundary) between 2. and 3. It is the control and management of that boundary which is important; and is what you refer to. Boundary control is a basic systems integration discipline, so it makes sense to apply that discipline to this problem. As I said above, a variation of the solution has actually been developed, approved and implemented successfully in another MoD domain (as a part-time job for one man). Those managing 2. can cross the line, but only while holding the hand of those who manage 3. And vice versa.
That requires funding, but not as much as you think. In fact, time and again it has been proven that more is wasted on mismanaging 1. and 2. than it would cost to do it correctly. Take Chinook Mk3 for example on 1., Nimrod MR2 on 2. That those responsible knew they were wasting money is maladministration - possibly the most serious offence one can level at a Civil Servant.
As MoD has fought very hard to avoid meeting it's legal obligation, I think independence is the way to go. The main benefit is this. Until now, staff can be instructed and bullied into cutting corners and they will receive no support whatsoever if they insist on meeting their obligation. (Confirmed by both MoD and Ministers, past and present; and dictated to Trades Unions who just roll over).
Properly let and managed independent contracting negates this. If MoD issued the same illegal orders to Industry (say, Westland) the company's legal eagles would be all over MoD like a rash. (I mention Westland, as they could do this with effortless competence on Rotary but, for example, I'd be concerned QinetiQ remain too close to MoD. I don't like the preferential treatment they are afforded). This is where, I think, the MAA has a key role. Policing the delegation and exercising of authority within MoD. There are a number of fatal accidents discussed here which, if you look closely, had at their root unqualified staffs making airworthiness decisions without any delegated authority whatsoever; except self-appointment. For example, the person who took it upon himself to waive Critical Design Reviews and Safety Cases, yet pay off contracts in full (which required a fraudulent statement) had no experience of aircraft (or anything remotely technical) whatsoever. But those very serious offences pale into insignificance when you consider his 2 Star and 4 Star (DGAS2 and CDP respectively) endorsed his actions, despite knowing the aircraft had been left functionally unsafe. THAT is where the MAA must go. Rebuilding the solid foundations.
The trouble with that example is, would the MAA boss carpet a 4 Star? He needs serious top cover to do that. So he needs to be completely independent from the MoD/Service chain of command. I'm told the MAA boss has this independence, but I'll hold judgment until I see evidence of a willingness to bang heads. (And in a short time, the MAA is being amalgamated with another office, so does this mean dilution of authority?).
The "management" problems I mention are above my pay grade. But the issue that directly affects and concerns aviators - ensuring the aircraft they are given are airworthy at a stated build standard - is easy. I and many others could do the bottom-up, but you need top-down support. That's where we've been failed.
In extremely simple terms, one must break the problem down into 3 components.
1. Attaining airworthiness (before the RTS is issued).
2. Maintaining it against the endorsed SOUI and Build Standard (there is overlap, but basically after RTS issued).
3. Fitness for Purpose or Operational Airworthiness; which is where you deviate from the SOUI and Build Standard.
Your concerns (and those of others) apply to 3.
1. and 2. can be independent. This is where almost all the systemic failings acknowledged (and denied!!) by MoD occur. Solving them is a complete no-brainer. Follow the regulations. MoD's only problem is finding someone junior enough to arrange this in his spare time.
There exists a line (boundary) between 2. and 3. It is the control and management of that boundary which is important; and is what you refer to. Boundary control is a basic systems integration discipline, so it makes sense to apply that discipline to this problem. As I said above, a variation of the solution has actually been developed, approved and implemented successfully in another MoD domain (as a part-time job for one man). Those managing 2. can cross the line, but only while holding the hand of those who manage 3. And vice versa.
That requires funding, but not as much as you think. In fact, time and again it has been proven that more is wasted on mismanaging 1. and 2. than it would cost to do it correctly. Take Chinook Mk3 for example on 1., Nimrod MR2 on 2. That those responsible knew they were wasting money is maladministration - possibly the most serious offence one can level at a Civil Servant.
As MoD has fought very hard to avoid meeting it's legal obligation, I think independence is the way to go. The main benefit is this. Until now, staff can be instructed and bullied into cutting corners and they will receive no support whatsoever if they insist on meeting their obligation. (Confirmed by both MoD and Ministers, past and present; and dictated to Trades Unions who just roll over).
Properly let and managed independent contracting negates this. If MoD issued the same illegal orders to Industry (say, Westland) the company's legal eagles would be all over MoD like a rash. (I mention Westland, as they could do this with effortless competence on Rotary but, for example, I'd be concerned QinetiQ remain too close to MoD. I don't like the preferential treatment they are afforded). This is where, I think, the MAA has a key role. Policing the delegation and exercising of authority within MoD. There are a number of fatal accidents discussed here which, if you look closely, had at their root unqualified staffs making airworthiness decisions without any delegated authority whatsoever; except self-appointment. For example, the person who took it upon himself to waive Critical Design Reviews and Safety Cases, yet pay off contracts in full (which required a fraudulent statement) had no experience of aircraft (or anything remotely technical) whatsoever. But those very serious offences pale into insignificance when you consider his 2 Star and 4 Star (DGAS2 and CDP respectively) endorsed his actions, despite knowing the aircraft had been left functionally unsafe. THAT is where the MAA must go. Rebuilding the solid foundations.
The trouble with that example is, would the MAA boss carpet a 4 Star? He needs serious top cover to do that. So he needs to be completely independent from the MoD/Service chain of command. I'm told the MAA boss has this independence, but I'll hold judgment until I see evidence of a willingness to bang heads. (And in a short time, the MAA is being amalgamated with another office, so does this mean dilution of authority?).
The "management" problems I mention are above my pay grade. But the issue that directly affects and concerns aviators - ensuring the aircraft they are given are airworthy at a stated build standard - is easy. I and many others could do the bottom-up, but you need top-down support. That's where we've been failed.
Mandator
The first major problem was when AMSO issued a policy in June 1987, without discussing it with anyone (especially those who would have to deal with the fallout), whereby all serviceable support spares held at contractors were to be scrapped. The purpose of these spares was to facilitate a contracted turn round time. The immediate effect was to place a high percentage of demands for LRUs at inability, with no predicted delivery date. Swiftly followed by approval to spend more money replacing the spares that had been scrapped - money which of course the MoD didn't have, because the rules rather assume you don't go around scrapping hundreds of millions of pounds worth of perfectly serviceable stock, only to replace it the next day.
AMSO was very quickly trashed by an Equipment Accounting Centre (EAC) audit (January 1988), which they responded to by declaring many LRUs "consumable", thus avoiding the need to repair them in the first place. This promptly made the supply situation even worse, but because different branches managed "Repairable" and "Consumable" stock, it also had the effect of transferring the problem to the C branch, who of course didn't have any money to replace this kit. The R branch, despite being the root of the problem, was seen to be efficient as their annual spend plummeted.
To give you an idea of relative costs, the recently emerged HEART report (Hercules Airworthiness Review Team) of 1997 points to an avionics system (CCWR) as being the major airworthiness problem. C130 pilots of the day will confirm this. On that one equipment, nearly £3M worth of spares were ordered to be scrapped. (The contract was one of seven test cases in the above EAC audit report). To maintain it's Build Standard, a pre-requisite to the Safety Case and airworthiness, cost around £100k per year. This £100k was ring-fenced for obvious reasons, but AMSO un-ringed it and used the funding to compensate, in a small part, for their policy. (Noted in CHART - it cited a further 25% general cut in 1992). So, not only was the kit not available, it could not be demonstrated to be airworthy. A knock-on effect was that Lyneham workshops attempted Depth C and D repairs, lacking tools, spares and test equipment to do so. One example that emerged was severely cracked scanner gearboxes being fitted to C130 (they didn't have the necessary crack detection kit). Had one of them gone, I imagine it would have ruptured the radome and been ingested. (Ex-PE staffs intervened quickly after being warned by Lyneham, diverted monies from other contracts and bought new casings behind the Suppliers' backs - but that was last ditch fire fighting). Something else AMSO did to save money was to no longer maintain War Reserves serviceable - a decision made shortly before GW1. (Good timing). They stopped AP amendments (remember the crap FRCs on Chinook?). They reduced MF760 investigations (noted in all the ARTs). They dismantled Integration Rigs, preventing a key element of functional safety being assessed. (This remained a problem in to the early 00s). One Gp Capt under DGSM even tried to say a company (GEC) had stolen the Rigs and demanded legal action! GEC then produced a letter proving they'd been instructed to dismantle it.
Does the effect on Front Line of that simple snapshot ring bells with anyone? It was repeated in dozens of "support" offices, across many fleets. MoD(PE) railed against this waste, but their staffs were subsumed into AMSO in 1991, meaning they were now challenging their own bosses. This came to a head in December 1992 when Director General Support Management (DGSM - 2 Star immediately below Chief Engineer) threatened ex-PE staffs with dismissal if they continued complaining about being instructed to waste money. To offset this threat, Director Internal Audit (DIA) was commsisioned to conduct an independent audit. He reported to PUS, formally notifying him that the PE staffs were correct, and every AMSO department, with the exception of Tornado engines (don't know how they arrived at this), was indeed wasting money on an industrial scale. DIA made 19 recommednations. If #13, for example, had been implemented, Haddon-Cave would have been unnecessary. 3 years ago, in response to a FoI request, MoD conceded that no action had been taken on the 19 recommendations and, because it was marked "NFA", the report had been destroyed after 5 years. They did not take up the offer of an original copy.
Just my direct experience (as the person who switched on EAC and DIA). I retain all correspondence. The direct link between this, frankly fraudulent, policy and systemic airworthiness failings is crystal clear to me.
The first major problem was when AMSO issued a policy in June 1987, without discussing it with anyone (especially those who would have to deal with the fallout), whereby all serviceable support spares held at contractors were to be scrapped. The purpose of these spares was to facilitate a contracted turn round time. The immediate effect was to place a high percentage of demands for LRUs at inability, with no predicted delivery date. Swiftly followed by approval to spend more money replacing the spares that had been scrapped - money which of course the MoD didn't have, because the rules rather assume you don't go around scrapping hundreds of millions of pounds worth of perfectly serviceable stock, only to replace it the next day.
AMSO was very quickly trashed by an Equipment Accounting Centre (EAC) audit (January 1988), which they responded to by declaring many LRUs "consumable", thus avoiding the need to repair them in the first place. This promptly made the supply situation even worse, but because different branches managed "Repairable" and "Consumable" stock, it also had the effect of transferring the problem to the C branch, who of course didn't have any money to replace this kit. The R branch, despite being the root of the problem, was seen to be efficient as their annual spend plummeted.
To give you an idea of relative costs, the recently emerged HEART report (Hercules Airworthiness Review Team) of 1997 points to an avionics system (CCWR) as being the major airworthiness problem. C130 pilots of the day will confirm this. On that one equipment, nearly £3M worth of spares were ordered to be scrapped. (The contract was one of seven test cases in the above EAC audit report). To maintain it's Build Standard, a pre-requisite to the Safety Case and airworthiness, cost around £100k per year. This £100k was ring-fenced for obvious reasons, but AMSO un-ringed it and used the funding to compensate, in a small part, for their policy. (Noted in CHART - it cited a further 25% general cut in 1992). So, not only was the kit not available, it could not be demonstrated to be airworthy. A knock-on effect was that Lyneham workshops attempted Depth C and D repairs, lacking tools, spares and test equipment to do so. One example that emerged was severely cracked scanner gearboxes being fitted to C130 (they didn't have the necessary crack detection kit). Had one of them gone, I imagine it would have ruptured the radome and been ingested. (Ex-PE staffs intervened quickly after being warned by Lyneham, diverted monies from other contracts and bought new casings behind the Suppliers' backs - but that was last ditch fire fighting). Something else AMSO did to save money was to no longer maintain War Reserves serviceable - a decision made shortly before GW1. (Good timing). They stopped AP amendments (remember the crap FRCs on Chinook?). They reduced MF760 investigations (noted in all the ARTs). They dismantled Integration Rigs, preventing a key element of functional safety being assessed. (This remained a problem in to the early 00s). One Gp Capt under DGSM even tried to say a company (GEC) had stolen the Rigs and demanded legal action! GEC then produced a letter proving they'd been instructed to dismantle it.
Does the effect on Front Line of that simple snapshot ring bells with anyone? It was repeated in dozens of "support" offices, across many fleets. MoD(PE) railed against this waste, but their staffs were subsumed into AMSO in 1991, meaning they were now challenging their own bosses. This came to a head in December 1992 when Director General Support Management (DGSM - 2 Star immediately below Chief Engineer) threatened ex-PE staffs with dismissal if they continued complaining about being instructed to waste money. To offset this threat, Director Internal Audit (DIA) was commsisioned to conduct an independent audit. He reported to PUS, formally notifying him that the PE staffs were correct, and every AMSO department, with the exception of Tornado engines (don't know how they arrived at this), was indeed wasting money on an industrial scale. DIA made 19 recommednations. If #13, for example, had been implemented, Haddon-Cave would have been unnecessary. 3 years ago, in response to a FoI request, MoD conceded that no action had been taken on the 19 recommendations and, because it was marked "NFA", the report had been destroyed after 5 years. They did not take up the offer of an original copy.
Just my direct experience (as the person who switched on EAC and DIA). I retain all correspondence. The direct link between this, frankly fraudulent, policy and systemic airworthiness failings is crystal clear to me.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Chinook DECU
I know this is not the ideal thread to make this posting, but the Chinook thread has been closed.
In a 2006 US student's handout for the Chinook "power plant", the DECU box is described as being a,
In a 2006 US student's handout for the Chinook "power plant", the DECU box is described as being a,
"Cast aluminum housing, protecting the internal operation from Electromagnetic Interference (EMI), Radio Frequency Interference (RMI), and Electromagnetic Pulse (EMP)".
Does anyone know if it was alway constructed this way, as I find this an unusual statement to make in this type of handout.
DV
Just let it go.
If DV is implying proper testing wasn't carried out, the chances are other people under the same senior officers didn't bother either. I think that is what Hadden Cave meant by systemic failings.
"Cast aluminum housing, protecting the internal operation from Electromagnetic Interference (EMI), Radio Frequency Interference (RMI), and Electromagnetic Pulse (EMP)".
Does anyone know if it was alway constructed this way, as I find this an unusual statement to make in this type of handout.
Does anyone know if it was alway constructed this way, as I find this an unusual statement to make in this type of handout.
DV
If you are asking about EMC testing, as you know it is extremely unlikely Boscombe would commence testing on an immature or unrepresentative build standard. It is a waste of money; the only exception being if the EMC baseline of the previous build standard (Mk1) had never been established. If that were the case, there could be no valid Safety Case for the Mk1.
The PE Fleet aircraft they had in Aug-Oct 1993 was NOT a representative Chinook Mk2 – the records show they had warned MoD that they awaited delivery of one before full testing could commence.
Also, there is absolutely no point conducting EMC testing (where the primary aim is to prove the new Fuel Computers are not affected) if the build standard of the device (i.e. DECU, with Safety Critical Software) is immature. As we know, not only was it immature, it was “positively dangerous”.
These same letters tell us testing was due to commence in April 1994, but would have been delayed somewhat as the aircraft was grounded, twice, on airworthiness grounds.
In summary, ACAS issued a Release to Service in November 1993, knowing the general build standard of the Chinook HC Mk2 was grossly immature, and the aircraft allotted to Boscombe was unrepresentative. That would account for 95% of the RTS being complete rubbish and non-compliant with mandated regulations. And for the Switch-On Only clearance status (withheld from aircrew). ACAS even sought an extension to this Switch-On Only clearance shortly before the crash, to be issued by mid-June (when, presumably, the existing RTS expired somehow - MoD have not released all the papers, conveniently mislaying those which record this part of the audit trail) .
I therefore agree with Dervish. The people who permitted, nay encouraged, the above were dangerous lunatics. As their roles meant they had oversight of many aircraft, in all Services, the question you ask affects all aircraft.
If you are asking about EMC testing, as you know it is extremely unlikely Boscombe would commence testing on an immature or unrepresentative build standard. It is a waste of money; the only exception being if the EMC baseline of the previous build standard (Mk1) had never been established. If that were the case, there could be no valid Safety Case for the Mk1.
The PE Fleet aircraft they had in Aug-Oct 1993 was NOT a representative Chinook Mk2 – the records show they had warned MoD that they awaited delivery of one before full testing could commence.
Also, there is absolutely no point conducting EMC testing (where the primary aim is to prove the new Fuel Computers are not affected) if the build standard of the device (i.e. DECU, with Safety Critical Software) is immature. As we know, not only was it immature, it was “positively dangerous”.
These same letters tell us testing was due to commence in April 1994, but would have been delayed somewhat as the aircraft was grounded, twice, on airworthiness grounds.
In summary, ACAS issued a Release to Service in November 1993, knowing the general build standard of the Chinook HC Mk2 was grossly immature, and the aircraft allotted to Boscombe was unrepresentative. That would account for 95% of the RTS being complete rubbish and non-compliant with mandated regulations. And for the Switch-On Only clearance status (withheld from aircrew). ACAS even sought an extension to this Switch-On Only clearance shortly before the crash, to be issued by mid-June (when, presumably, the existing RTS expired somehow - MoD have not released all the papers, conveniently mislaying those which record this part of the audit trail) .
I therefore agree with Dervish. The people who permitted, nay encouraged, the above were dangerous lunatics. As their roles meant they had oversight of many aircraft, in all Services, the question you ask affects all aircraft.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
Thanks Tuc. What you say also makes a joke of SI/Chinook/57, which states:
"Electromagnetic Compatibility (EMC). The EMC of the aircraft is not affected"
How did they know, seeing as no EMC test had ever been carried out and a base line established.
I asked the question in order to try and establish if the construction of the DECU box was changed in the late 1990's. The training notes (2006) go to great length to point out that the box is RFI/EMI proof. Was it not before? I do not recall seeing this as a general statement for other LRUs.
DV
"Electromagnetic Compatibility (EMC). The EMC of the aircraft is not affected"
How did they know, seeing as no EMC test had ever been carried out and a base line established.
I asked the question in order to try and establish if the construction of the DECU box was changed in the late 1990's. The training notes (2006) go to great length to point out that the box is RFI/EMI proof. Was it not before? I do not recall seeing this as a general statement for other LRUs.
DV
DV
Similar thing in the RTS which MUST list "Essential Modifications". It says "none", despite an essential DASH mod, as a result of the fatal FI crash in Feb 1987, being outstanding. Extract from evidence to Philip, Nov 2010;
On 30th September 1993, Boscombe Down advised MoD that;
·The FADEC software implementation was “positively dangerous”.
·Essential modifications were still outstanding.
·Other modifications were recommended.
·The Chinook HC Mk2 should not be released to service.
It is important to view these events at Boscombe Down in conjunction with the CHART report of August 1992. During ZD576 inquiries MoD consistently denigrated Boscombe’s views and actions yet CHART, issued by the RAF’s own Inspectorate of Flight Safety, wholly supports Boscombe. This is a recurring theme – had CHART been made available to each inquiry and, indeed, non-RAF MoD departments, the iniquitousness of the decision to blame only the pilots would have been immediately exposed.
Similar thing in the RTS which MUST list "Essential Modifications". It says "none", despite an essential DASH mod, as a result of the fatal FI crash in Feb 1987, being outstanding. Extract from evidence to Philip, Nov 2010;
On 30th September 1993, Boscombe Down advised MoD that;
·The FADEC software implementation was “positively dangerous”.
·Essential modifications were still outstanding.
·Other modifications were recommended.
·The Chinook HC Mk2 should not be released to service.
It is important to view these events at Boscombe Down in conjunction with the CHART report of August 1992. During ZD576 inquiries MoD consistently denigrated Boscombe’s views and actions yet CHART, issued by the RAF’s own Inspectorate of Flight Safety, wholly supports Boscombe. This is a recurring theme – had CHART been made available to each inquiry and, indeed, non-RAF MoD departments, the iniquitousness of the decision to blame only the pilots would have been immediately exposed.
I don't follow why you think a simple statement of fact about how a metal case can help protect against RFI/EMC issues is unusual? If anything I find the statement entirely benign.
I would be more surprised if anyone reading these notes was not aware already of the routinely employed faraday cage principle.
I have always found this statement bizarre, and frankly it seems a bit unprofessional - I have not yet seen any evidence released to support this statement.
Usually when a dangerous or erroneous error is detected in a piece of critical software then there is information available as to what the error is, what condition it could lead to and what could be done to avoid its repetition. Examples are numerous, interesting and informative - Ariane 5* etc.
This leads me to assume that there was no real basis upon which to state that the software was 'positively dangerous'. If there were features in the code that were dangerous, leading to hazardous events on the ac, I have no doubt that the failure mode would have been widely reported and discussed. It hasn't. It sounds more like here was some dispute as to the level of anaysis that was applied to demonstrate the correctness of the coding - a notoriously controversial area between those that regulate and those who actually develop systems - which IMO is no basis to make a declaration of it being "positively dangerous". The language is inappropriate for such a report unless there was such clear "Ariane 5" type evidence - which it seems very likely there isn't!
Just my opinion.
(* Ariane 5 was shown to have a coding feature in its INS platform related to its reuse from Ariane 4. To cut a long story short the Ariane 5 'profile of use' was different to those of Ariane 4 which has previously been used to define the software of the INS - and hence it could be shown that the different profile would cause the software to 'fail' every time in Ariane 5 - this was a clearly demonstrable and repeatable error which led to the complete loss of the first Ariane 5).
I would be more surprised if anyone reading these notes was not aware already of the routinely employed faraday cage principle.
·The FADEC software implementation was “positively dangerous”.
Usually when a dangerous or erroneous error is detected in a piece of critical software then there is information available as to what the error is, what condition it could lead to and what could be done to avoid its repetition. Examples are numerous, interesting and informative - Ariane 5* etc.
This leads me to assume that there was no real basis upon which to state that the software was 'positively dangerous'. If there were features in the code that were dangerous, leading to hazardous events on the ac, I have no doubt that the failure mode would have been widely reported and discussed. It hasn't. It sounds more like here was some dispute as to the level of anaysis that was applied to demonstrate the correctness of the coding - a notoriously controversial area between those that regulate and those who actually develop systems - which IMO is no basis to make a declaration of it being "positively dangerous". The language is inappropriate for such a report unless there was such clear "Ariane 5" type evidence - which it seems very likely there isn't!
Just my opinion.
(* Ariane 5 was shown to have a coding feature in its INS platform related to its reuse from Ariane 4. To cut a long story short the Ariane 5 'profile of use' was different to those of Ariane 4 which has previously been used to define the software of the INS - and hence it could be shown that the different profile would cause the software to 'fail' every time in Ariane 5 - this was a clearly demonstrable and repeatable error which led to the complete loss of the first Ariane 5).
DV
CHART went to the Chief Engineer and Assistant Chief of the Air Staff (Alcock and Bagnall, respectively). Lord Philip took the quite sensible view that if ACAS got a copy, then it must be assumed CAS (Graydon) did too. It should be noted this would have been almost the first paper to hit Bagnall’s desk upon taking up appointment on 14.8.92, so I doubt if he kept it to himself, given it called into question the validity of the Mk1 RTS he had just that morning assumed control of.
I know MoD (and in particular Alcock, in media statements) claims CHART applied only to Mk1. First, it mentions Mk2/Mid Life Upgrade no less than 383 times; which can hardly be characterised as “Mk1 only”. Second, as recently as 2006, Adam Ingram/MoD implied Mk2 was a new aircraft, not a modification to Mk1. Always ask why they would deceive about such a thing. The answer is this is a Configuration Control issue, and the loss of Configuration Control featured heavily in CHART (as it renders the Safety Case and RTS progressively invalid). Third, one should always remember the Chief of Defence Procurement (Walmsley) admitted to the Public Accounts Committee in March 1999 that these systemic failings remained extant on Chinook. An admission that makes a nonsense of Alcock’s claims.
JFZ90
Forgive me if I don’t go into all the detail, but the salient points are these.
Therefore, “positively dangerous” is, I think, an apt description. It may seem emotive, but from Boscombe’s point of view they had spent years trying to persuade MoD to deliver a stable version to test and, as said earlier, were still awaiting a representative Mk2. When you are MoD’s own appointed Subject Matter Experts, and you are continually told you’re talking rubbish, such emotive language is often what it takes (or is borne out of frustration).
Also, and this has seldom been aired, when MoD’s “trainers of trainers” visited Boeing in 1993 to ask how FADEC worked (so they could develop training material), Boeing stated THEY did not know and were expecting MoD to train THEM! This is not a criticism of Boeing. They were “only” the Aircraft Design Authority. One must look at the convoluted contracting strategy on FADEC to understand that MoD was obliged to deliver a fully operational FADEC to Boeing. (Ask why Boscombe were conducting testing themselves, when policy demanded a Joint programme). Such a strategy was, and is, expressly forbidden in MoD unless approved by God Himself. And even then, weekly progress reports are demanded. Any report in the 4 years preceding the crash would have highlighted the enormous risk MoD had taken on, and were failing miserably to mitigate. Hence, yet again, one must look at the failures of “management oversight”. And, surprise surprise, if you look at the names........
CHART went to the Chief Engineer and Assistant Chief of the Air Staff (Alcock and Bagnall, respectively). Lord Philip took the quite sensible view that if ACAS got a copy, then it must be assumed CAS (Graydon) did too. It should be noted this would have been almost the first paper to hit Bagnall’s desk upon taking up appointment on 14.8.92, so I doubt if he kept it to himself, given it called into question the validity of the Mk1 RTS he had just that morning assumed control of.
I know MoD (and in particular Alcock, in media statements) claims CHART applied only to Mk1. First, it mentions Mk2/Mid Life Upgrade no less than 383 times; which can hardly be characterised as “Mk1 only”. Second, as recently as 2006, Adam Ingram/MoD implied Mk2 was a new aircraft, not a modification to Mk1. Always ask why they would deceive about such a thing. The answer is this is a Configuration Control issue, and the loss of Configuration Control featured heavily in CHART (as it renders the Safety Case and RTS progressively invalid). Third, one should always remember the Chief of Defence Procurement (Walmsley) admitted to the Public Accounts Committee in March 1999 that these systemic failings remained extant on Chinook. An admission that makes a nonsense of Alcock’s claims.
JFZ90
Forgive me if I don’t go into all the detail, but the salient points are these.
- 1. The FADEC software met the criteria for “Safety Critical” and Boscombe rightly treated it as such. MoD always denied it was SC, but finally came unstuck when the policy document was produced in evidence.
- 2. Safety Critical requires a higher degree of testing, as I think you’d agree. This testing produced so many anomalies, parties other than Boscombe gave up trying.
- 3. Given the software had not been validated or verified on 2nd June 1994, there is absolutely no possibility of there being a valid Certificate of Design for the DECU; therefore at most it would only be allowed in the PE Fleet aircraft at Boscombe (which had been grounded!).
Therefore, “positively dangerous” is, I think, an apt description. It may seem emotive, but from Boscombe’s point of view they had spent years trying to persuade MoD to deliver a stable version to test and, as said earlier, were still awaiting a representative Mk2. When you are MoD’s own appointed Subject Matter Experts, and you are continually told you’re talking rubbish, such emotive language is often what it takes (or is borne out of frustration).
Also, and this has seldom been aired, when MoD’s “trainers of trainers” visited Boeing in 1993 to ask how FADEC worked (so they could develop training material), Boeing stated THEY did not know and were expecting MoD to train THEM! This is not a criticism of Boeing. They were “only” the Aircraft Design Authority. One must look at the convoluted contracting strategy on FADEC to understand that MoD was obliged to deliver a fully operational FADEC to Boeing. (Ask why Boscombe were conducting testing themselves, when policy demanded a Joint programme). Such a strategy was, and is, expressly forbidden in MoD unless approved by God Himself. And even then, weekly progress reports are demanded. Any report in the 4 years preceding the crash would have highlighted the enormous risk MoD had taken on, and were failing miserably to mitigate. Hence, yet again, one must look at the failures of “management oversight”. And, surprise surprise, if you look at the names........
JFZ90
Forgive me if I don’t go into all the detail, but the salient points are these.
1. The FADEC software met the criteria for “Safety Critical” and Boscombe rightly treated it as such. MoD always denied it was SC, but finally came unstuck when the policy document was produced in evidence.
2. Safety Critical requires a higher degree of testing, as I think you’d agree. This testing produced so many anomalies, parties other than Boscombe gave up trying.
3. Given the software had not been validated or verified on 2nd June 1994, there is absolutely no possibility of there being a valid Certificate of Design for the DECU; therefore at most it would only be allowed in the PE Fleet aircraft at Boscombe (which had been grounded!).
Therefore, “positively dangerous” is, I think, an apt description. It may seem emotive, but from Boscombe’s point of view they had spent years trying to persuade MoD to deliver a stable version to test and, as said earlier, were still awaiting a representative Mk2. When you are MoD’s own appointed Subject Matter Experts, and you are continually told you’re talking rubbish, such emotive language is often what it takes (or is borne out of frustration).
Also, and this has seldom been aired, when MoD’s “trainers of trainers” visited Boeing in 1993 to ask how FADEC worked (so they could develop training material), Boeing stated THEY did not know and were expecting MoD to train THEM! This is not a criticism of Boeing. They were “only” the Aircraft Design Authority. One must look at the convoluted contracting strategy on FADEC to understand that MoD was obliged to deliver a fully operational FADEC to Boeing. (Ask why Boscombe were conducting testing themselves, when policy demanded a Joint programme). Such a strategy was, and is, expressly forbidden in MoD unless approved by God Himself. And even then, weekly progress reports are demanded. Any report in the 4 years preceding the crash would have highlighted the enormous risk MoD had taken on, and were failing miserably to mitigate. Hence, yet again, one must look at the failures of “management oversight”. And, surprise surprise, if you look at the names........
Forgive me if I don’t go into all the detail, but the salient points are these.
1. The FADEC software met the criteria for “Safety Critical” and Boscombe rightly treated it as such. MoD always denied it was SC, but finally came unstuck when the policy document was produced in evidence.
2. Safety Critical requires a higher degree of testing, as I think you’d agree. This testing produced so many anomalies, parties other than Boscombe gave up trying.
3. Given the software had not been validated or verified on 2nd June 1994, there is absolutely no possibility of there being a valid Certificate of Design for the DECU; therefore at most it would only be allowed in the PE Fleet aircraft at Boscombe (which had been grounded!).
Therefore, “positively dangerous” is, I think, an apt description. It may seem emotive, but from Boscombe’s point of view they had spent years trying to persuade MoD to deliver a stable version to test and, as said earlier, were still awaiting a representative Mk2. When you are MoD’s own appointed Subject Matter Experts, and you are continually told you’re talking rubbish, such emotive language is often what it takes (or is borne out of frustration).
Also, and this has seldom been aired, when MoD’s “trainers of trainers” visited Boeing in 1993 to ask how FADEC worked (so they could develop training material), Boeing stated THEY did not know and were expecting MoD to train THEM! This is not a criticism of Boeing. They were “only” the Aircraft Design Authority. One must look at the convoluted contracting strategy on FADEC to understand that MoD was obliged to deliver a fully operational FADEC to Boeing. (Ask why Boscombe were conducting testing themselves, when policy demanded a Joint programme). Such a strategy was, and is, expressly forbidden in MoD unless approved by God Himself. And even then, weekly progress reports are demanded. Any report in the 4 years preceding the crash would have highlighted the enormous risk MoD had taken on, and were failing miserably to mitigate. Hence, yet again, one must look at the failures of “management oversight”. And, surprise surprise, if you look at the names........
As you say the testing produced anomolies - but what were they? Were they significant? What parts were redesigned, which coding issues had to be removed? I assume the Mk2 FADEC came through all this mud slinging in the end as it is flying, presumably safely with revelant paperwork now - so what were these anomolies? The fact that they are never reported, clarified or explained as a tangible problem that could have contributed to an in-flight hazard suggests perhaps they were not as serious as "positively dangerous" may lead you to conclude.
I don't know, but there is something about the boscombe end of this that doesn't feel right.
there is something about the boscombe end of this that doesn't feel right.
JFZ90
The reports talk in numerical terms – hundreds of anomalies, and classify them but don’t describe each one. There were simply too many and testing stopped.
The evidence of MoD’s own expert, Mr Perks, to the House of Lords in 2001 is revealing. It is too long and complex to repeat here, but his main criticism is of the lack of understanding of how FADEC software was designed (essentially, the problem Boscombe faced) and the fact that no amount of patching can compensate for the fact the basic approach was flawed. Hence, Boscombe’s recommendation that it be redesigned was supported by MoD’s own expert, who had designed other FADECs on behalf of MoD. That is, he wasn’t merely a software expert, but a FADEC designer.
One particular example he discusses is the Fault Codes and how the software reacts when a fault exists and another develops. “There was too much reliance that FADEC would respond correctly to a second fault”. He discusses this in the context of Runaway Ups, which many thought explained the crash very well. The common example is fault E5. That in itself does not cause a Runaway Up, but in conjunction with a second fault could (and did, in 1989, resulting in the Wilmington incident). He points out that in 1994 E5 had been determined to be a nuisance fault in isolation, but the effect of a second fault was never addressed properly. And that this second fault could be hidden and not recorded in DECU memory. In other words, design immaturity and lack of understanding, which breeds uncertainty.
I can’t comment on what you think about Boscombe. If you ask a specific question I’ll try to answer. I mentioned one factor – the requirement for a Joint approach; it is clear Boscombe were alone. None of their correspondence on the subject (that I have) is copied to Boeing or the engine contractors, which you would expect them to do under a Joint programme. I admit I am a self confessed fan of A&AEE. In my 131 projects/programmes, they never once let me down; something I can say of only two significant contractors (Westland and Joyce-Loebl).
However, that was when they were A&AEE and part of MoD(PE). Things changed enormously in the late 90s with privatisation, but that is another story. Essentially, they started to rollover under pressure to tick boxes and ignore safety failings. (See Tornado/Patriot thread). If asked to offer a single thought regarding their involvement in Chinook, it is that I suspect they were tasked very late in the day, and on the basis that the Mid Life Update was a simple modification to Mk1. All the correspondence from July-Oct 1993 screams a complete lack of understanding in the RAF (especially) that a new, unique FADEC requires you to almost start again on aircraft testing and clearances. Again, we see MoD’s nervous hindsight in the lies they later told about this FADEC being used in other aircraft – I recall John Reid even implied it was used in Concorde. As Mr Perks said, “It was (and still is) a very different FADEC from anything else flying”.
The reports talk in numerical terms – hundreds of anomalies, and classify them but don’t describe each one. There were simply too many and testing stopped.
The evidence of MoD’s own expert, Mr Perks, to the House of Lords in 2001 is revealing. It is too long and complex to repeat here, but his main criticism is of the lack of understanding of how FADEC software was designed (essentially, the problem Boscombe faced) and the fact that no amount of patching can compensate for the fact the basic approach was flawed. Hence, Boscombe’s recommendation that it be redesigned was supported by MoD’s own expert, who had designed other FADECs on behalf of MoD. That is, he wasn’t merely a software expert, but a FADEC designer.
One particular example he discusses is the Fault Codes and how the software reacts when a fault exists and another develops. “There was too much reliance that FADEC would respond correctly to a second fault”. He discusses this in the context of Runaway Ups, which many thought explained the crash very well. The common example is fault E5. That in itself does not cause a Runaway Up, but in conjunction with a second fault could (and did, in 1989, resulting in the Wilmington incident). He points out that in 1994 E5 had been determined to be a nuisance fault in isolation, but the effect of a second fault was never addressed properly. And that this second fault could be hidden and not recorded in DECU memory. In other words, design immaturity and lack of understanding, which breeds uncertainty.
I can’t comment on what you think about Boscombe. If you ask a specific question I’ll try to answer. I mentioned one factor – the requirement for a Joint approach; it is clear Boscombe were alone. None of their correspondence on the subject (that I have) is copied to Boeing or the engine contractors, which you would expect them to do under a Joint programme. I admit I am a self confessed fan of A&AEE. In my 131 projects/programmes, they never once let me down; something I can say of only two significant contractors (Westland and Joyce-Loebl).
However, that was when they were A&AEE and part of MoD(PE). Things changed enormously in the late 90s with privatisation, but that is another story. Essentially, they started to rollover under pressure to tick boxes and ignore safety failings. (See Tornado/Patriot thread). If asked to offer a single thought regarding their involvement in Chinook, it is that I suspect they were tasked very late in the day, and on the basis that the Mid Life Update was a simple modification to Mk1. All the correspondence from July-Oct 1993 screams a complete lack of understanding in the RAF (especially) that a new, unique FADEC requires you to almost start again on aircraft testing and clearances. Again, we see MoD’s nervous hindsight in the lies they later told about this FADEC being used in other aircraft – I recall John Reid even implied it was used in Concorde. As Mr Perks said, “It was (and still is) a very different FADEC from anything else flying”.
As compared to a Controller Aircraft Release for the Chinook Mk2 of "Switch On Only" status which is then granted an ACAS "limited" Release to Service into RAF Squadrons perhaps? If Boscombe doesn't "feel right" (as I'm quite sure they didn't), what were the Controller Aircraft and the Assistant Chief of the Air Staff feeling? Anything?
At the end of the day no project should ever find itself in a position where there is such a breakdown between key players, but I sometimes feel like it is too easy to point at one end only.