Haddon-Cave, Airworthiness, Sea King et al (merged)
but dug into what it actually meant and took a view on the actual risk?
In response to many requests for this information, MoD say they cannot find it; yet have provided the documents either side from the same file. One can only conclude (a) the exchanges did not take place, in which case both the CAR and RTS are invalid; or (b) the exchanges are so embarrassing that they were destroyed, in which case we have further confirmation of who is being protected.
Of course, the CAR was not a conventional CAR. It provided Switch-On Only clearance (specifically, crew not permitted to rely on the complete Nav and Comms systems). I suggest this is what exercised Bagnall and Graydon's minds, because it drew their attention to the fact CHART compounded matters, as no effort had been made to remedy the systemic failings it outlined. CA had not been informed of CHART (something he confirmed in writing last year). As far as he was concerned there was a reasonably stable baseline (Mk1, with known problems). Had he known of CHART he would would be committing a grave offence if it were not mentioned in the CAR supporting papers. In fact, CHART should have led him to immediately withdraw his CAR for the Mk1. So, you get back to DV's question. Who received CHART, what did they do and why did MoD(PE) not get a copy?
JFZ90
The reports talk in numerical terms – hundreds of anomalies, and classify them but don’t describe each one. There were simply too many and testing stopped.
The evidence of MoD’s own expert, Mr Perks, to the House of Lords in 2001 is revealing. It is too long and complex to repeat here, but his main criticism is of the lack of understanding of how FADEC software was designed (essentially, the problem Boscombe faced) and the fact that no amount of patching can compensate for the fact the basic approach was flawed. Hence, Boscombe’s recommendation that it be redesigned was supported by MoD’s own expert, who had designed other FADECs on behalf of MoD. That is, he wasn’t merely a software expert, but a FADEC designer.
One particular example he discusses is the Fault Codes and how the software reacts when a fault exists and another develops. “There was too much reliance that FADEC would respond correctly to a second fault”. He discusses this in the context of Runaway Ups, which many thought explained the crash very well. The common example is fault E5. That in itself does not cause a Runaway Up, but in conjunction with a second fault could (and did, in 1989, resulting in the Wilmington incident). He points out that in 1994 E5 had been determined to be a nuisance fault in isolation, but the effect of a second fault was never addressed properly. And that this second fault could be hidden and not recorded in DECU memory. In other words, design immaturity and lack of understanding, which breeds uncertainty.
I can’t comment on what you think about Boscombe. If you ask a specific question I’ll try to answer. I mentioned one factor – the requirement for a Joint approach; it is clear Boscombe were alone. None of their correspondence on the subject (that I have) is copied to Boeing or the engine contractors, which you would expect them to do under a Joint programme. I admit I am a self confessed fan of A&AEE. In my 131 projects/programmes, they never once let me down; something I can say of only two significant contractors (Westland and Joyce-Loebl).
However, that was when they were A&AEE and part of MoD(PE). Things changed enormously in the late 90s with privatisation, but that is another story. Essentially, they started to rollover under pressure to tick boxes and ignore safety failings. (See Tornado/Patriot thread). If asked to offer a single thought regarding their involvement in Chinook, it is that I suspect they were tasked very late in the day, and on the basis that the Mid Life Update was a simple modification to Mk1. All the correspondence from July-Oct 1993 screams a complete lack of understanding in the RAF (especially) that a new, unique FADEC requires you to almost start again on aircraft testing and clearances. Again, we see MoD’s nervous hindsight in the lies they later told about this FADEC being used in other aircraft – I recall John Reid even implied it was used in Concorde. As Mr Perks said, “It was (and still is) a very different FADEC from anything else flying”.
The reports talk in numerical terms – hundreds of anomalies, and classify them but don’t describe each one. There were simply too many and testing stopped.
The evidence of MoD’s own expert, Mr Perks, to the House of Lords in 2001 is revealing. It is too long and complex to repeat here, but his main criticism is of the lack of understanding of how FADEC software was designed (essentially, the problem Boscombe faced) and the fact that no amount of patching can compensate for the fact the basic approach was flawed. Hence, Boscombe’s recommendation that it be redesigned was supported by MoD’s own expert, who had designed other FADECs on behalf of MoD. That is, he wasn’t merely a software expert, but a FADEC designer.
One particular example he discusses is the Fault Codes and how the software reacts when a fault exists and another develops. “There was too much reliance that FADEC would respond correctly to a second fault”. He discusses this in the context of Runaway Ups, which many thought explained the crash very well. The common example is fault E5. That in itself does not cause a Runaway Up, but in conjunction with a second fault could (and did, in 1989, resulting in the Wilmington incident). He points out that in 1994 E5 had been determined to be a nuisance fault in isolation, but the effect of a second fault was never addressed properly. And that this second fault could be hidden and not recorded in DECU memory. In other words, design immaturity and lack of understanding, which breeds uncertainty.
I can’t comment on what you think about Boscombe. If you ask a specific question I’ll try to answer. I mentioned one factor – the requirement for a Joint approach; it is clear Boscombe were alone. None of their correspondence on the subject (that I have) is copied to Boeing or the engine contractors, which you would expect them to do under a Joint programme. I admit I am a self confessed fan of A&AEE. In my 131 projects/programmes, they never once let me down; something I can say of only two significant contractors (Westland and Joyce-Loebl).
However, that was when they were A&AEE and part of MoD(PE). Things changed enormously in the late 90s with privatisation, but that is another story. Essentially, they started to rollover under pressure to tick boxes and ignore safety failings. (See Tornado/Patriot thread). If asked to offer a single thought regarding their involvement in Chinook, it is that I suspect they were tasked very late in the day, and on the basis that the Mid Life Update was a simple modification to Mk1. All the correspondence from July-Oct 1993 screams a complete lack of understanding in the RAF (especially) that a new, unique FADEC requires you to almost start again on aircraft testing and clearances. Again, we see MoD’s nervous hindsight in the lies they later told about this FADEC being used in other aircraft – I recall John Reid even implied it was used in Concorde. As Mr Perks said, “It was (and still is) a very different FADEC from anything else flying”.
Nevertheless, was the FADEC actually completely redesigned as per the recommendations? Did the 'E5 issue' actually have to be rectified?
JFZ90
Yes, there were subsequently major changes to the DECU software, including a change relating to E5. If you want the headline list I can give it. For years MoD claimed this upgrade only related to spurious caption warning, but it was far more significant than that.
Also remember that a major HF risk was the sheer lack of understanding of what it did and how it behaved. In time, that understanding matured and risks were mitigated. That is why the period to June 1994, and for a year or so thereafter, can be characterised as the formal "Training and Familiarisation Phase" - not a period in which you commit an immature aircraft to a VVIP transit when other assets were available.
Yes, there were subsequently major changes to the DECU software, including a change relating to E5. If you want the headline list I can give it. For years MoD claimed this upgrade only related to spurious caption warning, but it was far more significant than that.
Also remember that a major HF risk was the sheer lack of understanding of what it did and how it behaved. In time, that understanding matured and risks were mitigated. That is why the period to June 1994, and for a year or so thereafter, can be characterised as the formal "Training and Familiarisation Phase" - not a period in which you commit an immature aircraft to a VVIP transit when other assets were available.
JFZ90:
With good reason, because the process of CA/ACAS interaction in granting an RTS to a UK Military Aircraft is specifically designed to ensure that a knowingly unairworthy aircraft is not released into military service, and yet it was! Even if Boscombe, Boeing, Textron, EDS Scicon, or the half a hundred other bodies involved in the Chinook HC2 fiasco had not dotted all the i's and crossed all the t's, the CA and ACAS were the final stop checks in the system. They had to ensure that the i's were indeed dotted. Instead of which between the two of themselves they did exactly the opposite, did exactly what the RTS procedure was meant to prevent, and released a positively dangerous (my words JFZ90!) aircraft into RAF Squadron Service.
...everyone looks at the end you suggest...
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
CHART went to the Chief Engineer and Assistant Chief of the Air Staff (Alcock and Bagnall, respectively)
DV
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
RAF warned of Chinook defect before crash that killed 29
Documents seen by The Sunday Times reveal that officials were aware that key connectors could loosen in flight, putting pilots at risk
Michael Smith Published: 8 January 2012
The Chinook crash at the Mull of Kintyre in1994 killed all 29 on board (Chris Bacon)
The Royal Air Force warned pilots of a fault that could affect the safe operation of Chinook Mark 2 helicopters seven months before the Mull of Kintyre crash which killed 25 of Britain’s top counter-terrorism experts.
Documents seen by The Sunday Times show that the aircraft was brought into service despite evidence that key connectors could loosen in flight, putting control of the engines at risk.
The papers show that the problem was still in existence after the crash and that aircrew were subsequently warned to check during the flight that the connectors had not loosened.
The cause of the RAF’s worst peacetime disaster in June 1994 has never been determined and the Ministry of Defence continued to blame the dead pilots until July last year when a review ruled there was no justifiable reason to do so.
The original 1995 RAF board of inquiry could not determine the cause of the Chinook Mark 2 crash into a hillside in fog but was overruled by senior officers who concluded the pilots were “negligent to a gross degree”.
A “service instruction” issued to RAF aircrew in November 1993 warned that a connector on the digital engine control unit had “worked loose in flight”.
The instruction warned that “the connector loosened sufficiently enough to affect the functioning of the FADEC system.”
The Full Authority Digital Engine Control (FADEC) system which controls the running of the engines was at the heart of speculation over what might have gone wrong with the aircraft.
An RAF officer told a House of Lords inquiry into the crash that Chinook crews had lost control of engines as a result of FADEC failure on at least two occasions.
It has previously emerged that Flight Lieutenant Rick Cook, a pilot among a crew of four also killed in the tragedy, voiced concerns about the aircraft’s control units five hours before take-off.
He told a colleague that the FADEC system was proving unreliable and that engines had shut down unexpectedly or had surged.
The Chinook Mark 2 was introduced into service in November 1993, despite concerns over the FADEC system expressed by the Aircraft and Armament Evaluation Establishment, the MoD’s airworthiness experts, at Boscombe Down, Wiltshire.
The existence of the November 1993 “service instruction” was mentioned in an appendix to the board of inquiry into the crash but its contents have not been divulged until now.
Jimmy Jones, a former RAF engineer who obtained the documents under Freedom of Information legislation, said that the fault should have prevented the Chinook Mark 2 being brought into service.
He said: “In my opinion, as an ex-trials officer, Boscombe Down would not have approved such a defectively engineered system. This aircraft could not have been described as airworthy.”
The decision to blame the pilots Flight-Lieutenant Jonathan Tapper and Cook led to a 16-year campaign by friends and families to clear their names.
Successive defence secretaries refused to absolve them of any blame despite a Scottish fatal accident inquiry and investigations by three parliamentary committees which concluded that the cause of the crash was unknown.
The pilots were finally cleared last July by Liam Fox, the then defence secretary, after a review by Lord Philip ruled it was impossible to know what happened and that the pilots therefore could not be blamed.
An RAF spokesman said: “Exhaustive investigations have been completed into the tragic Mull of Kintyre incident, in which no evidence of technical or mechanical failure was identified.”
Documents seen by The Sunday Times reveal that officials were aware that key connectors could loosen in flight, putting pilots at risk
Michael Smith Published: 8 January 2012
The Chinook crash at the Mull of Kintyre in1994 killed all 29 on board (Chris Bacon)
The Royal Air Force warned pilots of a fault that could affect the safe operation of Chinook Mark 2 helicopters seven months before the Mull of Kintyre crash which killed 25 of Britain’s top counter-terrorism experts.
Documents seen by The Sunday Times show that the aircraft was brought into service despite evidence that key connectors could loosen in flight, putting control of the engines at risk.
The papers show that the problem was still in existence after the crash and that aircrew were subsequently warned to check during the flight that the connectors had not loosened.
The cause of the RAF’s worst peacetime disaster in June 1994 has never been determined and the Ministry of Defence continued to blame the dead pilots until July last year when a review ruled there was no justifiable reason to do so.
The original 1995 RAF board of inquiry could not determine the cause of the Chinook Mark 2 crash into a hillside in fog but was overruled by senior officers who concluded the pilots were “negligent to a gross degree”.
A “service instruction” issued to RAF aircrew in November 1993 warned that a connector on the digital engine control unit had “worked loose in flight”.
The instruction warned that “the connector loosened sufficiently enough to affect the functioning of the FADEC system.”
The Full Authority Digital Engine Control (FADEC) system which controls the running of the engines was at the heart of speculation over what might have gone wrong with the aircraft.
An RAF officer told a House of Lords inquiry into the crash that Chinook crews had lost control of engines as a result of FADEC failure on at least two occasions.
It has previously emerged that Flight Lieutenant Rick Cook, a pilot among a crew of four also killed in the tragedy, voiced concerns about the aircraft’s control units five hours before take-off.
He told a colleague that the FADEC system was proving unreliable and that engines had shut down unexpectedly or had surged.
The Chinook Mark 2 was introduced into service in November 1993, despite concerns over the FADEC system expressed by the Aircraft and Armament Evaluation Establishment, the MoD’s airworthiness experts, at Boscombe Down, Wiltshire.
The existence of the November 1993 “service instruction” was mentioned in an appendix to the board of inquiry into the crash but its contents have not been divulged until now.
Jimmy Jones, a former RAF engineer who obtained the documents under Freedom of Information legislation, said that the fault should have prevented the Chinook Mark 2 being brought into service.
He said: “In my opinion, as an ex-trials officer, Boscombe Down would not have approved such a defectively engineered system. This aircraft could not have been described as airworthy.”
The decision to blame the pilots Flight-Lieutenant Jonathan Tapper and Cook led to a 16-year campaign by friends and families to clear their names.
Successive defence secretaries refused to absolve them of any blame despite a Scottish fatal accident inquiry and investigations by three parliamentary committees which concluded that the cause of the crash was unknown.
The pilots were finally cleared last July by Liam Fox, the then defence secretary, after a review by Lord Philip ruled it was impossible to know what happened and that the pilots therefore could not be blamed.
An RAF spokesman said: “Exhaustive investigations have been completed into the tragic Mull of Kintyre incident, in which no evidence of technical or mechanical failure was identified.”
RAF warned of Chinook defect before crash that killed 29
Documents seen by The Sunday Times reveal that officials were aware that key connectors could loosen in flight, putting pilots at risk
Michael Smith Published: 8 January 2012
The Royal Air Force warned pilots of a fault that could affect the safe operation of Chinook Mark 2 helicopters seven months before the Mull of Kintyre crash which killed 25 of Britain’s top counter-terrorism experts.
Documents seen by The Sunday Times show that the aircraft was brought into service despite evidence that key connectors could loosen in flight, putting control of the engines at risk.
The papers show that the problem was still in existence after the crash and that aircrew were subsequently warned to check during the flight that the connectors had not loosened.
The cause of the RAF’s worst peacetime disaster in June 1994 has never been determined and the Ministry of Defence continued to blame the dead pilots until July last year when a review ruled there was no justifiable reason to do so.
The original 1995 RAF board of inquiry could not determine the cause of the Chinook Mark 2 crash into a hillside in fog but was overruled by senior officers who concluded the pilots were “negligent to a gross degree”.
A “service instruction” issued to RAF aircrew in November 1993 warned that a connector on the digital engine control unit had “worked loose in flight”.
The instruction warned that “the connector loosened sufficiently enough to affect the functioning of the FADEC system.”
The Full Authority Digital Engine Control (FADEC) system which controls the running of the engines was at the heart of speculation over what might have gone wrong with the aircraft.
An RAF officer told a House of Lords inquiry into the crash that Chinook crews had lost control of engines as a result of FADEC failure on at least two occasions.
It has previously emerged that Flight Lieutenant Rick Cook, a pilot among a crew of four also killed in the tragedy, voiced concerns about the aircraft’s control units five hours before take-off.
He told a colleague that the FADEC system was proving unreliable and that engines had shut down unexpectedly or had surged.
The Chinook Mark 2 was introduced into service in November 1993, despite concerns over the FADEC system expressed by the Aircraft and Armament Evaluation Establishment, the MoD’s airworthiness experts, at Boscombe Down, Wiltshire.
The existence of the November 1993 “service instruction” was mentioned in an appendix to the board of inquiry into the crash but its contents have not been divulged until now.
Jimmy Jones, a former RAF engineer who obtained the documents under Freedom of Information legislation, said that the fault should have prevented the Chinook Mark 2 being brought into service.
He said: “In my opinion, as an ex-trials officer, Boscombe Down would not have approved such a defectively engineered system. This aircraft could not have been described as airworthy.”
The decision to blame the pilots Flight-Lieutenant Jonathan Tapper and Cook led to a 16-year campaign by friends and families to clear their names.
Successive defence secretaries refused to absolve them of any blame despite a Scottish fatal accident inquiry and investigations by three parliamentary committees which concluded that the cause of the crash was unknown.
The pilots were finally cleared last July by Liam Fox, the then defence secretary, after a review by Lord Philip ruled it was impossible to know what happened and that the pilots therefore could not be blamed.
An RAF spokesman said: “Exhaustive investigations have been completed into the tragic Mull of Kintyre incident, in which no evidence of technical or mechanical failure was identified.”
Documents seen by The Sunday Times reveal that officials were aware that key connectors could loosen in flight, putting pilots at risk
Michael Smith Published: 8 January 2012
The Royal Air Force warned pilots of a fault that could affect the safe operation of Chinook Mark 2 helicopters seven months before the Mull of Kintyre crash which killed 25 of Britain’s top counter-terrorism experts.
Documents seen by The Sunday Times show that the aircraft was brought into service despite evidence that key connectors could loosen in flight, putting control of the engines at risk.
The papers show that the problem was still in existence after the crash and that aircrew were subsequently warned to check during the flight that the connectors had not loosened.
The cause of the RAF’s worst peacetime disaster in June 1994 has never been determined and the Ministry of Defence continued to blame the dead pilots until July last year when a review ruled there was no justifiable reason to do so.
The original 1995 RAF board of inquiry could not determine the cause of the Chinook Mark 2 crash into a hillside in fog but was overruled by senior officers who concluded the pilots were “negligent to a gross degree”.
A “service instruction” issued to RAF aircrew in November 1993 warned that a connector on the digital engine control unit had “worked loose in flight”.
The instruction warned that “the connector loosened sufficiently enough to affect the functioning of the FADEC system.”
The Full Authority Digital Engine Control (FADEC) system which controls the running of the engines was at the heart of speculation over what might have gone wrong with the aircraft.
An RAF officer told a House of Lords inquiry into the crash that Chinook crews had lost control of engines as a result of FADEC failure on at least two occasions.
It has previously emerged that Flight Lieutenant Rick Cook, a pilot among a crew of four also killed in the tragedy, voiced concerns about the aircraft’s control units five hours before take-off.
He told a colleague that the FADEC system was proving unreliable and that engines had shut down unexpectedly or had surged.
The Chinook Mark 2 was introduced into service in November 1993, despite concerns over the FADEC system expressed by the Aircraft and Armament Evaluation Establishment, the MoD’s airworthiness experts, at Boscombe Down, Wiltshire.
The existence of the November 1993 “service instruction” was mentioned in an appendix to the board of inquiry into the crash but its contents have not been divulged until now.
Jimmy Jones, a former RAF engineer who obtained the documents under Freedom of Information legislation, said that the fault should have prevented the Chinook Mark 2 being brought into service.
He said: “In my opinion, as an ex-trials officer, Boscombe Down would not have approved such a defectively engineered system. This aircraft could not have been described as airworthy.”
The decision to blame the pilots Flight-Lieutenant Jonathan Tapper and Cook led to a 16-year campaign by friends and families to clear their names.
Successive defence secretaries refused to absolve them of any blame despite a Scottish fatal accident inquiry and investigations by three parliamentary committees which concluded that the cause of the crash was unknown.
The pilots were finally cleared last July by Liam Fox, the then defence secretary, after a review by Lord Philip ruled it was impossible to know what happened and that the pilots therefore could not be blamed.
An RAF spokesman said: “Exhaustive investigations have been completed into the tragic Mull of Kintyre incident, in which no evidence of technical or mechanical failure was identified.”
Sure, if there had been no "service instruction", but the issue was known, then there would have been a breakdown in the airworthiness / defect reporting procedures.
But as the fault was picked up and what one must assume is an entirely appropriate "service instruction" is issued - then where is the problem?
I can see nothing in the above that suggests that the "service instruction" was not consistent and appropriate for the identified fault.
Anyone got a link to the entire SI to put it in context? What specific action were the engineers/aircrew supposed to do as a result and did this adequately mitigate the risk on a flight by flight basis?
Join Date: Oct 2011
Location: USA
Posts: 119
Likes: 0
Received 0 Likes
on
0 Posts
JFZ, you wouldn't by any chance be a former serving air rank officer, would you?
I think there's too much speculation there without knowing all the facts, i.e. as you say, what did the SI say and was it a reasonable mitigation of the real problem, was the Mk2 airworthy and was a formwer serving air rank officer justified on finding them grossly negligent? Some of those, clearly not.
I think there's too much speculation there without knowing all the facts, i.e. as you say, what did the SI say and was it a reasonable mitigation of the real problem, was the Mk2 airworthy and was a formwer serving air rank officer justified on finding them grossly negligent? Some of those, clearly not.
JFZ90
Yes, there were subsequently major changes to the DECU software, including a change relating to E5. If you want the headline list I can give it. For years MoD claimed this upgrade only related to spurious caption warning, but it was far more significant than that.
Yes, there were subsequently major changes to the DECU software, including a change relating to E5. If you want the headline list I can give it. For years MoD claimed this upgrade only related to spurious caption warning, but it was far more significant than that.
Just read a bit of Perks evidence. He makes it pretty clear the E5 issue at Wilmington was actually sorted before Mull and had no relevance to the accident.
JFZ, you wouldn't by any chance be a former serving air rank officer, would you?
I think there's too much speculation there without knowing all the facts, i.e. as you say, what did the SI say and was it a reasonable mitigation of the real problem, was the Mk2 airworthy and was a formwer serving air rank officer justified on finding them grossly negligent? Some of those, clearly not.
Funny how this is not mentioned by the Sunday Times - I wonder why Mick doesn't mention these bits - or perhaps he is not aware - surely he would have checked before writing - doh!).
I don't think they should have been found negligent, but then again I don't think that means we should pretend or build a case for a technical fault either.
That said, I don't dispute that there is considerable evidence that the entry to service of Mk2 was not without problems. How serious these were is where it strays into subjectivity a bit.
Last edited by JFZ90; 8th Jan 2012 at 16:19.
Just read a bit of Perks evidence. He makes it pretty clear the E5 issue at Wilmington was actually sorted before Mull and had no relevance to the accident.
The point he made was that the behaviour of the software was not known when a 2nd fault occurred in the presence of E5.
Tuc, I just read this, though I admit I've hardly touched the surface on all this.
I can see its all been done to death so I'll desist.
96. Mr Perks in his memoranda explained to us that the Wilmington incident was not caused by an E5 fault alone but by its conjunction with another fault and that by 1994 because of the action of the system designers an E5 fault was being dismissed as a nuisance fault of no significance. Furthermore Mr Cable explained that the DECU had two portions to the memory of faults namely (i) retained faults since its last overhaul and (ii) faults since the last engine start. The E5 fault in ZD 576's DECU was found in the former historical portion and not in that of the last flight. In all these circumstances we are satisfied that an E5 fault had no relevance to the accident.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
I can see nothing in the above that suggests that the "service instruction" was not consistent and appropriate for the identified fault.
Would you be happy to drive a car that had a wheel nut problem, but the supplier said it was save as long as you (1) checked after every journey that the wheel nuts were not loose, and (2) if you are travelling any distance you should stop ever 50 miles and check them.
DV
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
JFZ. You said,
The article, which appeared today in the Sunday Times, makes no mention of engineers, only pilots, and certainly does not suggest the the SI was on a "flight by flight basis". Do you have inside information?
DV
What specific action were the engineers/aircrew supposed to do as a result and did this adequately mitigate the risk on a flight by flight basis?
DV
The business of the DECU connector and installation design was discussed at length on the defunct MoK thread.
The main points were this;
1. A Servicing Instruction is issued by MoD(PE) (at the time), not the RAF EA or Units.
2. The original SI related to a ground check. Sqn Ldr Burke gave evidence to the HoL committee that this was extended by Odiham to encompass an in-flight check every 15 mins. As only PE could issue the SI, such an extension was “illegal”.
3. The EA (not the RAF station) is to assess the SI for “Effect on Operation and/or Handling”. If an effect is likely to be of concern to aircrew, the EA is to refer the draft instruction to RAF Handling Squadron at Boscombe Down. There is no record of this; and the view of the senior test pilot is clear. Even if it had got through RAFHS, MoD(PE) ATP would have immediately snagged it as they would know THEY were the issuing authority. That is, it wouldn’t pass even cursory scrutiny.
4. A Tradesman/Supervisor is required to certify application of an SI on a Maintenance Work Order, for each application. If conducted in flight, this is impossible.
5. SI/CHK/57 describes both preventative and corrective maintenance, which are not permitted by a Servicing Instruction.
All the above make anyone familiar with the regulations conclude the nature of the defect (correct word, not fault), and the fact it was discovered before RTS, means there should have been a Class AA mod schemed to correct it. That is, “Essential for initial approval, for Service Use or a new type of equipment. (e.g. FADEC/DECU). To be embodied prior to delivery, irrespective of cost, scrap or delay involved”.
Questions raised in the past include;
The Safety Case must reflect the current In-Use build standard (which is why one maintains it). Therefore,
· What safety and risk related documentation exists to support the SI?
· Was there an impact or risk assessment?
So many contradictions, this case alone cast enormous doubt on the RO’s verdict.
The main points were this;
1. A Servicing Instruction is issued by MoD(PE) (at the time), not the RAF EA or Units.
2. The original SI related to a ground check. Sqn Ldr Burke gave evidence to the HoL committee that this was extended by Odiham to encompass an in-flight check every 15 mins. As only PE could issue the SI, such an extension was “illegal”.
3. The EA (not the RAF station) is to assess the SI for “Effect on Operation and/or Handling”. If an effect is likely to be of concern to aircrew, the EA is to refer the draft instruction to RAF Handling Squadron at Boscombe Down. There is no record of this; and the view of the senior test pilot is clear. Even if it had got through RAFHS, MoD(PE) ATP would have immediately snagged it as they would know THEY were the issuing authority. That is, it wouldn’t pass even cursory scrutiny.
4. A Tradesman/Supervisor is required to certify application of an SI on a Maintenance Work Order, for each application. If conducted in flight, this is impossible.
5. SI/CHK/57 describes both preventative and corrective maintenance, which are not permitted by a Servicing Instruction.
All the above make anyone familiar with the regulations conclude the nature of the defect (correct word, not fault), and the fact it was discovered before RTS, means there should have been a Class AA mod schemed to correct it. That is, “Essential for initial approval, for Service Use or a new type of equipment. (e.g. FADEC/DECU). To be embodied prior to delivery, irrespective of cost, scrap or delay involved”.
Questions raised in the past include;
- · A check of transmission screens was required every 5 mins. When the two checks co-incided every 15mins, which took precedence?
- · As SIs are not to be used to circumvent modification procedures, who decided the defective design was satisfactory?
- · Odiham were unconvinced the SI addressed the true problem and felt the need to take further, extraordinary action. Where is their reasoning recorded?
- · Was this extension approved following rigorous evaluation of impact on the Safety Case and ICAR?
- · Did a suitable contract exist to investigate the problem?
- · Who authorised this in-flight servicing?
- · What was the impact if the connector came loose or detached? Catastrophic? Critical?
The Safety Case must reflect the current In-Use build standard (which is why one maintains it). Therefore,
· What safety and risk related documentation exists to support the SI?
· Was there an impact or risk assessment?
So many contradictions, this case alone cast enormous doubt on the RO’s verdict.
DV,
I have no inside info. I was guessing the SI was either/or eng/aircrew action.
I found the 15min info on the same site as Perks testimony.
House of Lords - Chinook ZD 576 - Report
I think the Sunday Times article is written to sensationalise this as a tangible safety issue, which is a bit misleading.
To use your own question:
I wouldn't be happy, but I would be safe. I'd be getting him to replace/fix the problem, but in the meantime I would do it if I had to get from A-to-B.
I'd be a lot more annoyed if the supplier knew about the nuts but didn't tell me and I drove about in ignorance of the risk. That would be a real safety (airworthiness) issue.
I have no inside info. I was guessing the SI was either/or eng/aircrew action.
I found the 15min info on the same site as Perks testimony.
House of Lords - Chinook ZD 576 - Report
I think the Sunday Times article is written to sensationalise this as a tangible safety issue, which is a bit misleading.
To use your own question:
Would you be happy to drive a car that had a wheel nut problem, but the supplier said it was save as long as you (1) checked after every journey that the wheel nuts were not loose, and (2) if you are travelling any distance you should stop ever 50 miles and check them.
I'd be a lot more annoyed if the supplier knew about the nuts but didn't tell me and I drove about in ignorance of the risk. That would be a real safety (airworthiness) issue.
JFZ90
I think you must have posted before reading mine!
Guesswork shouldn't come into it. SIs were issued by MoD(PE).
You may have been relatively safe in your car with a loose wheel nut. With luck you may even grind to a graceful halt. Unfortunately, not exactly the same as an aircraft.
I can't see how anyone would fail to see a loose connector on a Full Authority system is not one of the most serious defects imaginable. The above list of issues is inexcusable.
I think you must have posted before reading mine!
Guesswork shouldn't come into it. SIs were issued by MoD(PE).
You may have been relatively safe in your car with a loose wheel nut. With luck you may even grind to a graceful halt. Unfortunately, not exactly the same as an aircraft.
I can't see how anyone would fail to see a loose connector on a Full Authority system is not one of the most serious defects imaginable. The above list of issues is inexcusable.
Join Date: Dec 2006
Location: UK
Posts: 799
Likes: 0
Received 0 Likes
on
0 Posts
Guys,
Coming in quite carefully here, but as a previous EA for fixed and rotary and also an RTSA, I just cannot imagine what anyone was doing signing off an SI to check security of a flight safety critical DECU connector in flight. I had heard about this, but this is the first time I've seen it 'in clear'.
The procedure cannot have mitigated the risk unless they had some strong evidence on how long it took connectors to come loose and under what flight conditions.
Not good design? Quite awful design, full stop. Unfit for purpose, full stop.
In my professional view, this should have been a grounding until the connectors were made safe - I find it hard to imagine that a reasonable temporary solution could not have been devised fairly rapidly (locking wire?) pending a DA solution. But, as ever, I'm happy to be told I'm wrong.
Again, in my honest view, in engineering as in flying, there is always a danger of 'pressing on' when the right thing to do is 'stop'. The whole saga being laid out here is a great example of what looks horribly like a 'press on' culture.
Best Regards as ever to the people actually flying (and maintaining) in harm's way,
Engines
Coming in quite carefully here, but as a previous EA for fixed and rotary and also an RTSA, I just cannot imagine what anyone was doing signing off an SI to check security of a flight safety critical DECU connector in flight. I had heard about this, but this is the first time I've seen it 'in clear'.
The procedure cannot have mitigated the risk unless they had some strong evidence on how long it took connectors to come loose and under what flight conditions.
Not good design? Quite awful design, full stop. Unfit for purpose, full stop.
In my professional view, this should have been a grounding until the connectors were made safe - I find it hard to imagine that a reasonable temporary solution could not have been devised fairly rapidly (locking wire?) pending a DA solution. But, as ever, I'm happy to be told I'm wrong.
Again, in my honest view, in engineering as in flying, there is always a danger of 'pressing on' when the right thing to do is 'stop'. The whole saga being laid out here is a great example of what looks horribly like a 'press on' culture.
Best Regards as ever to the people actually flying (and maintaining) in harm's way,
Engines
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
I can't see how anyone would fail to see a loose connector on a Full Authority system is not one of the most serious defects imaginable
DV