Haddon-Cave, Airworthiness, Sea King et al (merged)
LL - Although the RAF and QQ have made some forms of acceptance and adjustment statements I dont think BAE have (yet). So it is difficult to remark on any change in their stance to date.
Example of Tolerable: - Mainwheel tyre rapid deflation on landing.
Likelyhood is high - Consequence is Potentially Fatal.
CURE is to build a totally damage resistant tyre (of approx 1 ton(ne) weight). and having to redesign the whole aircraft to pick the landing gear up!
Within my understanding of "As Low As Reasonably Practicable". The practicality aspect has passed the 'reasonable' point.
...unless you know a better example?
Example of Tolerable: - Mainwheel tyre rapid deflation on landing.
Likelyhood is high - Consequence is Potentially Fatal.
CURE is to build a totally damage resistant tyre (of approx 1 ton(ne) weight). and having to redesign the whole aircraft to pick the landing gear up!
Within my understanding of "As Low As Reasonably Practicable". The practicality aspect has passed the 'reasonable' point.
...unless you know a better example?
Rigga
That is a bad example for a number of reasons - are you pulling legs?
If it was high prob & likely to be fatal - then it clearly is never ever going to be a tolerable risk.
That is a bad example for a number of reasons - are you pulling legs?
If it was high prob & likely to be fatal - then it clearly is never ever going to be a tolerable risk.
Rigga, you seem to have fallen into a common trap, which is to take the probability of something happening and then apply the worst severity to it to generate a risk.
If this was an aircraft with a large number of mainwheels (B52 or similar?), then the probability of a single tyre failing on landing may indeed be high, but the probable severity of that is unlikely to be a fatal accident. Of course you should consider the situation where a failing tyre does somehow result in a fatal accident, but the likelihood of that occurring will be much more remote. You will then have 2 risk factors, both of which would be closer to the real risk. IIRC, a fatal accident is always classed Catastrophic (happy to be corrected though), so anything higher than a Remote probability in this case would lead to the risk classification of A – Unacceptable. This would seem to rather overstate the actual risk of a single tyre failing on something like B-52 causing a fatal accident. That’s not to say it can’t happen (Concorde?), but that it is very unlikely.
If this was an aircraft with a large number of mainwheels (B52 or similar?), then the probability of a single tyre failing on landing may indeed be high, but the probable severity of that is unlikely to be a fatal accident. Of course you should consider the situation where a failing tyre does somehow result in a fatal accident, but the likelihood of that occurring will be much more remote. You will then have 2 risk factors, both of which would be closer to the real risk. IIRC, a fatal accident is always classed Catastrophic (happy to be corrected though), so anything higher than a Remote probability in this case would lead to the risk classification of A – Unacceptable. This would seem to rather overstate the actual risk of a single tyre failing on something like B-52 causing a fatal accident. That’s not to say it can’t happen (Concorde?), but that it is very unlikely.
Perhaps I should have said "Hypothetical..." and my assessment was swayed by ### Police risk assessment training - where everything ends in a death or a potential death! (no, I don't work there now)
...Adjust the risk constituents to your own values - my point was to get the 'practicability' to exceed 'reasonable'-ness.
IMO The complete elimination of blow-outs can only be achieved by the removal of the gas element from tyres.
Apply this to any (wheeled landing gear) type you wish and discuss the changes required.
...and like I said - Unless you know of a better example?
...Adjust the risk constituents to your own values - my point was to get the 'practicability' to exceed 'reasonable'-ness.
IMO The complete elimination of blow-outs can only be achieved by the removal of the gas element from tyres.
Apply this to any (wheeled landing gear) type you wish and discuss the changes required.
...and like I said - Unless you know of a better example?
Join Date: Mar 2006
Location: wilts
Posts: 1,667
Likes: 0
Received 0 Likes
on
0 Posts
Got airborne off the grass at Valley on one occasion, after a main tyre burst. Half an hour later landed safely and a nice fireman helped me out still on the runway.
Transfer your scenario to an airliner and you wouldn't even abort the take off at high speed for a tyre failure.
Not a good example at all. Landing an airliner with a tyre failure is straightforward. Concorde is interesting, but don't get me started on fuel tank protection!
Problem is that v senior officers did not appear to understand safety management systems. Was chatting to a middle ranking officer the other day, he was explaining that at his level the understanding of what they are trying to achieve is improving all the time. I was reassured that in response to H-C the military will not swing violently in the opposite direction. There are a lot of bright minds out there, just a question of pointing them in the right direction.
Signs are encouraging from what I can see, simplistic arguments put forward by Rigga do not reflect the current thinking IMHO.
Transfer your scenario to an airliner and you wouldn't even abort the take off at high speed for a tyre failure.
Not a good example at all. Landing an airliner with a tyre failure is straightforward. Concorde is interesting, but don't get me started on fuel tank protection!
Problem is that v senior officers did not appear to understand safety management systems. Was chatting to a middle ranking officer the other day, he was explaining that at his level the understanding of what they are trying to achieve is improving all the time. I was reassured that in response to H-C the military will not swing violently in the opposite direction. There are a lot of bright minds out there, just a question of pointing them in the right direction.
Signs are encouraging from what I can see, simplistic arguments put forward by Rigga do not reflect the current thinking IMHO.
Join Date: Jul 2002
Location: Bath
Posts: 9
Likes: 0
Received 0 Likes
on
0 Posts
Tolerable
I have just been shown the Nimrod report - isn't it amazing how someone can be so wrong and so self-satisfied about it. Perhaps the QC should have listened to the York safety folk or gone to the local library rather than jetting off to the States at Taxpayers' expense.
There are 3 main elements in an ALARPassessment and a couple of influencing elements. First there is the tolerability measurement. There are 3 levels of tolerability: intolerable, tolerable and broadly acceptable. These are set with one of the influencing elements in mind - the industry sector or the environment (ie what is tolerable in the aviaition industry may be acceptable in a coal mine). Second there is the ALARP judgement. Third there is the acceptability of the risk. These are influenced by the passage of time.
The QC is quite wrong to say that a tolerable risk that is not ALARP is intolerable. It is generally unacceptable - but in principle any risk can be accepted in dire circunmstances - but once it is determined it fits into the tolerable basket there it stays unless the measurment of tolerability changes.
ALARP is more difficult. The 'temporal' bit has 3 ways of interpretation - all valid. The obvious one is that risks change with time and you should re-evaluate then regularly. The second is that just because your competitor has brought in a safer piece of equipment than the one you are using does not mean that you have to retrospectively apply a higher standard to your old kit - relevant to the old Nimrod. The third is that once you have determined that there is a reasonably practicable measure that you could take you are no longer ALARP but clearly there is no reason why your kit suddenly becomes unacceptable - there is a reasonable amount of time allowed to become ALARP again.
As for tyre burst - that is why you have a clear area around a runway as an ALARP measure. Just take care when you put in your runway monitoring radar to allow enough space!
There are 3 main elements in an ALARPassessment and a couple of influencing elements. First there is the tolerability measurement. There are 3 levels of tolerability: intolerable, tolerable and broadly acceptable. These are set with one of the influencing elements in mind - the industry sector or the environment (ie what is tolerable in the aviaition industry may be acceptable in a coal mine). Second there is the ALARP judgement. Third there is the acceptability of the risk. These are influenced by the passage of time.
The QC is quite wrong to say that a tolerable risk that is not ALARP is intolerable. It is generally unacceptable - but in principle any risk can be accepted in dire circunmstances - but once it is determined it fits into the tolerable basket there it stays unless the measurment of tolerability changes.
ALARP is more difficult. The 'temporal' bit has 3 ways of interpretation - all valid. The obvious one is that risks change with time and you should re-evaluate then regularly. The second is that just because your competitor has brought in a safer piece of equipment than the one you are using does not mean that you have to retrospectively apply a higher standard to your old kit - relevant to the old Nimrod. The third is that once you have determined that there is a reasonably practicable measure that you could take you are no longer ALARP but clearly there is no reason why your kit suddenly becomes unacceptable - there is a reasonable amount of time allowed to become ALARP again.
As for tyre burst - that is why you have a clear area around a runway as an ALARP measure. Just take care when you put in your runway monitoring radar to allow enough space!
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
QC's understanding of ALARP is not correct
In his report he stressed the point that the "R" in ALARP has a temporal element, and criticize the Coroner for calling for the grounding of the Nimrod, because in his opinion "a reasonable time is allowed" to mitigate identified risks. He makes constant reference to Lord Cullen's guidance in the Edwards v The National Coal Board in which Cullen states:
"'Resaonably practicable' is a narrow term than 'physically posible' and seems to imply that a computation must be made by the owner in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time OR trouble) is placed in the other, and that, if it is shown that there is gross disproportion between them - the risk being insignificant in relation to the sacrifice - the defendants discharge the onus on them"
Now, having read Lord Cullen's findings, and the Health and Safety guidelines, I believe that "time" in this context means downtime (lost time) of the plant or equipment and its associated costs and trouble. It does not mean, as Group Capt. Hickman (inquest witness) and the QC claim that "we have got time to reduce the risk to ALARP". In the case of the current hot air duct replacement programme "time" means the downtime of the aircraft and/or the trouble of not having them operational. It does not mean, as Group Capt Hickman suggested at the inquest, that he had until mid 2009 to complete the modification, and that aircraft were "tolerably safe but not ALARP".
In Lord Cullen's findings "time or trouble" are linked and viewed as a "sacrifice", or cost to be borne by a company or organisation in order to achieve ALARP. To view "time" in the manner in which the QC described in his report can only be seen as a let out, not a sacrifice.
DV
"'Resaonably practicable' is a narrow term than 'physically posible' and seems to imply that a computation must be made by the owner in which the quantum of risk is placed on one scale and the sacrifice involved in the measures necessary for averting the risk (whether in money, time OR trouble) is placed in the other, and that, if it is shown that there is gross disproportion between them - the risk being insignificant in relation to the sacrifice - the defendants discharge the onus on them"
Now, having read Lord Cullen's findings, and the Health and Safety guidelines, I believe that "time" in this context means downtime (lost time) of the plant or equipment and its associated costs and trouble. It does not mean, as Group Capt. Hickman (inquest witness) and the QC claim that "we have got time to reduce the risk to ALARP". In the case of the current hot air duct replacement programme "time" means the downtime of the aircraft and/or the trouble of not having them operational. It does not mean, as Group Capt Hickman suggested at the inquest, that he had until mid 2009 to complete the modification, and that aircraft were "tolerably safe but not ALARP".
In Lord Cullen's findings "time or trouble" are linked and viewed as a "sacrifice", or cost to be borne by a company or organisation in order to achieve ALARP. To view "time" in the manner in which the QC described in his report can only be seen as a let out, not a sacrifice.
DV
Radweld The QC is quite wrong to say that a tolerable risk that is not ALARP is intolerable.
DV Now, having read Lord Cullen's findings, and the Health and Safety guidelines, I believe that "time" in this context means downtime (lost time) of the plant or equipment and its associated costs and trouble. It does not mean, as Group Capt. Hickman (inquest witness) and the QC claim that "we have got time to reduce the risk to ALARP".
Time to Embody / Make Safe
The concept of time (urgency) to embody a safety modification is dealt with in Def Stans 05-123, 125 and elsewhere. The decision manifests itself in the Class of modification.
For example, a Class 1 (Service) or A (Contractor) mod is “essential for safety, the absence of which would involve, or may have already involved, the grounding of aircraft, the imposition on the use of aircraft, vehicles or ground equipment, or the shutdown of ground radio installations. They MUST be embodied, irrespective of the scrap or equipment downtime involved”.
In practice, the problem is failure to apply the mandated regulations. These regs require complete independence in that the decision must not be made by the proposer of the modification (normally the IPT or the Design Authority).
The regs still state that the proposer shall submit a “Cost and Brief Sheet” to the relevant HQ Mods Committee, the chairman of which holds a key person in the airworthiness chain. Such is the independence required that, should the Chairman be a MoD Technical Agency (the named individual responsible for maintaining the Build Standard) in his own right and his name appears on a modification proposal, then he must hand over the decision to the Deputy Chair.
It follows that if a mod is deemed Class A or 1 (when safety is involved, this decision is normally made within hours, before work commences to develop a mod) then the RTSA is automatically informed so that the question of grounding can be addressed.
Of course, this system was effectively scrapped in 1992 with the disbandment of most HQMCs. The mandated requirement for independent scrutiny was lost as the proposer was given authority to decide. That meant other factors (financial mainly) could cloud their judgment.
In practice, this immediately resulted in a raft of mods being hastily “approved”, many falling into the “nice to have” or complete bollox category. Then, a safety mod requirement would come along and there was no in-year money left, so you would get urgent mods deferred (by financiers, who were given the authority to over-rule engineering/safety decisions). Also, the HQMC would always ensure provision was made for support, training, embodiment etc. Not any more – the rush to buy the mod sets would be followed by a hiatus lasting years as squadrons, workshops and contractors were overloaded with unplanned work. Anyone at 2nd line sees the result on a daily basis.
If you read the criticisms in the Haddon-Cave report, very often the solution is to simply follow these regulations.
The above raises a few questions, including;
Finally, and no apologies for labouring this point, but the H-C report contains absolutely NOTHING new that has not been notified to senior staffs and Ministers numerous times over the last 18 years. To quote MoD’s own Directorate of Internal Audit (June 1996) when reporting to PUS… “We are unable to provide an assurance to PUS that (the above regulations are) operating efficiently in all Service PAO areas”. There followed 19 recommendations. Read them, then Haddon-Cave’s, and weep at the commonality.
My MoD(PE) 2 Star dismissed the report as “of no concern to MoD(PE)”.
For example, a Class 1 (Service) or A (Contractor) mod is “essential for safety, the absence of which would involve, or may have already involved, the grounding of aircraft, the imposition on the use of aircraft, vehicles or ground equipment, or the shutdown of ground radio installations. They MUST be embodied, irrespective of the scrap or equipment downtime involved”.
In practice, the problem is failure to apply the mandated regulations. These regs require complete independence in that the decision must not be made by the proposer of the modification (normally the IPT or the Design Authority).
The regs still state that the proposer shall submit a “Cost and Brief Sheet” to the relevant HQ Mods Committee, the chairman of which holds a key person in the airworthiness chain. Such is the independence required that, should the Chairman be a MoD Technical Agency (the named individual responsible for maintaining the Build Standard) in his own right and his name appears on a modification proposal, then he must hand over the decision to the Deputy Chair.
It follows that if a mod is deemed Class A or 1 (when safety is involved, this decision is normally made within hours, before work commences to develop a mod) then the RTSA is automatically informed so that the question of grounding can be addressed.
Of course, this system was effectively scrapped in 1992 with the disbandment of most HQMCs. The mandated requirement for independent scrutiny was lost as the proposer was given authority to decide. That meant other factors (financial mainly) could cloud their judgment.
In practice, this immediately resulted in a raft of mods being hastily “approved”, many falling into the “nice to have” or complete bollox category. Then, a safety mod requirement would come along and there was no in-year money left, so you would get urgent mods deferred (by financiers, who were given the authority to over-rule engineering/safety decisions). Also, the HQMC would always ensure provision was made for support, training, embodiment etc. Not any more – the rush to buy the mod sets would be followed by a hiatus lasting years as squadrons, workshops and contractors were overloaded with unplanned work. Anyone at 2nd line sees the result on a daily basis.
If you read the criticisms in the Haddon-Cave report, very often the solution is to simply follow these regulations.
The above raises a few questions, including;
- Why, if the current practice does not reflect the regulations, have the latter not been changed? Answer – because formally changing them would bring senior staffs into conflict with PUS, whose mandated regs they ignore. D/Stan can’t bring themselves to amend the books because they would be forced to take sides, so just leave them. For example, the key Def Stan, quoted above, has not been amended since January 1990, yet every MoD Technical Agency should know it off by heart. Today, few have heard of it. It calls up 20 specifications instructing Technical Agencies on how to maintain, inter alia, safety, but try asking D/Stan for a copy of them. Why is it ignored? Because funding has been cut so far that IPTs very often simply cannot afford to maintain safety, so you get to the stage where new entrants are simply not taught what they are meant to do. They lose sight of the need for safety to the point, nowadays, where people are shouted down (or booed, as happened on Nimrod) and told not to waste money maintaining airworthiness.
- Has senior MoD management been informed of this critical safety issue? YES. The last time I did so was January 2000, to a 3 Star (DCE of DPA). He didn’t reply. Perhaps if he did the IPTs would have been directed to comply with the regs and this thread wouldn’t exist. However, I do realise that if he had done something he, in turn, would have had to choose between the regs and his boss (CDP) who had already ruled that functional safety was optional. But, a 3 Star gets paid a lot of money to make hard decisions and have quiet words in the boss’s ear. A mere project manager is paid peanuts to make decisions within his remit, and seek decisions outwith his own remit. Any breakdown in this process leads to …… Haddon-Cave.
Finally, and no apologies for labouring this point, but the H-C report contains absolutely NOTHING new that has not been notified to senior staffs and Ministers numerous times over the last 18 years. To quote MoD’s own Directorate of Internal Audit (June 1996) when reporting to PUS… “We are unable to provide an assurance to PUS that (the above regulations are) operating efficiently in all Service PAO areas”. There followed 19 recommendations. Read them, then Haddon-Cave’s, and weep at the commonality.
My MoD(PE) 2 Star dismissed the report as “of no concern to MoD(PE)”.
Join Date: Mar 2006
Location: wilts
Posts: 1,667
Likes: 0
Received 0 Likes
on
0 Posts
Don't know why the MoD doesn't just bite the bullet and employ you again Tuc!
Even in your retirement your knowledge and understanding of airworthiness regulations continue to impress. God, they must be regretting the way they [MoD] responded to your insistence on maintaining safety standards.
Guess the mandarins have been well and truly found out for the slap dash approach that followed in the brave new world of "command" of budgets.
Idiots..
Even in your retirement your knowledge and understanding of airworthiness regulations continue to impress. God, they must be regretting the way they [MoD] responded to your insistence on maintaining safety standards.
Guess the mandarins have been well and truly found out for the slap dash approach that followed in the brave new world of "command" of budgets.
Idiots..
Tuc:
"...but try asking D/Stan for a copy of them."
I know mr Google wasn't around 18 years ago, but if you typed "05-123 Part" or "dstan" you might find them quite easily.
"...but try asking D/Stan for a copy of them."
I know mr Google wasn't around 18 years ago, but if you typed "05-123 Part" or "dstan" you might find them quite easily.
Join Date: Jul 2002
Location: Bath
Posts: 9
Likes: 0
Received 0 Likes
on
0 Posts
Time
Lovechild, it's a culture thing - just keep your head in the clouds and you won't know what is likely to hit you. I am glad I was ignorant about the underlying (lack of) rigorous safety thinking when filling out my logbooks!
DV - You are right, downtime is one of the costs that you need to consider if you are arguing ALARP with a cost benefit analysis. The 'temporal' thing is usually considered outside that, but since everyone has their own ideas I don't think that there is a right and wrong - the only way you find our is if a Judge decides that your argument is not reasonable, I guess!
Incidentally, I was hoping that someone might comment on my possibly contradictory suggestion that you can be tolerable and not ALARP and still acceptable during the period when it is reasonable to allow newly determined ALARP measures to be introduced.
Also, apologies to the coal miners. Two counts: first I should have compared 'tolerable' to 'broadly acceptable' (not just 'acceptable'); second with the modern miners' approach to safety you might suggest that a risk that was tolerable in aviation would be intolerable in mining - if you could think of equivalent risks in the 2 contrasting industries that is. Oh well - at least my high horse is not as high as the QC's.
I have continued to read the QC's report - despite flashes of common sense it is remarkable in its ignorance and naivety. Shame - because I guess the MOD will use this as an excuse to bury it quietly and carry on much as before.
DV - You are right, downtime is one of the costs that you need to consider if you are arguing ALARP with a cost benefit analysis. The 'temporal' thing is usually considered outside that, but since everyone has their own ideas I don't think that there is a right and wrong - the only way you find our is if a Judge decides that your argument is not reasonable, I guess!
Incidentally, I was hoping that someone might comment on my possibly contradictory suggestion that you can be tolerable and not ALARP and still acceptable during the period when it is reasonable to allow newly determined ALARP measures to be introduced.
Also, apologies to the coal miners. Two counts: first I should have compared 'tolerable' to 'broadly acceptable' (not just 'acceptable'); second with the modern miners' approach to safety you might suggest that a risk that was tolerable in aviation would be intolerable in mining - if you could think of equivalent risks in the 2 contrasting industries that is. Oh well - at least my high horse is not as high as the QC's.
I have continued to read the QC's report - despite flashes of common sense it is remarkable in its ignorance and naivety. Shame - because I guess the MOD will use this as an excuse to bury it quietly and carry on much as before.
I have continued to read the QC's report - despite flashes of common sense it is remarkable in its ignorance and naivety.
I would never have used terms such as 'ignorance' and 'naivety' in describing the review itself, but might be tempted to ascribe them to the MoD chumps involved in not doing their jobs. As for Qinetic and BAE Systems - well, 'greed' and 'laziness' would probably be my chosen terms.
Join Date: Mar 2007
Location: Bristol Temple Meads
Posts: 869
Likes: 0
Received 0 Likes
on
0 Posts
I have continued to read the QC's report - despite flashes of common sense it is remarkable in its ignorance and naivety. Shame - because I guess the MOD will use this as an excuse to bury it quietly and carry on much as before.
I agree. As I have already indicated on another thread, his attack on the Coroner is based on a misunderstanding of what was said. As an example, on page 105, Under "The coroner's Source of Fuel", the QC states that following:
The Oxfordshire Assistant Deputy Coroner, Mr Andrew Walker, found the most likely source for the fuel was a leak from the fuel feed system to engines Nos. 3 and 4. Such a leak, he said would have provided a "continuous source of fuel" which would "travel along the aircraft into dry bay 7" to the seat of the fire. In my view this is highly unlikely.
This is not the the "Coroner's Source of the Fuel". The extracts come from his statement (page 25 of his summing up) where he is in fact challenging Mr Bell's engine based theory . The full statement is as follows:
The flow from a leak in the fuel feed systems to engine 3 or 4 would have had to increase up to 15 gallons a minute before the engine performance would be affected, and this leak would not be determined in terms of engine warnings to the crew. The flow rate of such a leak would supply a continuous source of fuel. Interestingly, the supply of fuel would travel along the aircraft into dry bay 7 where the seat of the fire was believed to have started.
There are several other serious mistakes in the report which distort the actual evidence.
DV
Last edited by Distant Voice; 3rd Dec 2009 at 14:26.
remarkable in its ignorance and naivety
However, I am reasonably satisfied from statements and correspondence that he actually understood, or came to understand, the importance of this detail as applied to the regulations and the failure to implement them (which was the basic criticism in the Nimrod BoI report). But, like Distant Voice, I am concerned at the factual distortions in the report, and wonder if he simply accepted the advice of his MoD “advisors” who, very clearly, had an agenda - ensure criticism of MoD is contained to a few scapegoats. And the wider Government, including MoD, would have loved the criticism of Mr Walker and the general muddying of waters.
I still think there are quite a few MoD staff, past and present, who are nervous in case this gets to a court, where those named would be mad not to cite higher rulings and precedent.