Gulf Tornado/Patriot

[Distant Voice]

Are there any Bench Technicians out there? If there are, can you advise what failures trigger the failure light and tone? Also, the BoI Summary states that the Ground Crew checked Mode 4 just before engine start. How was that done? End to End testing or just BIT?

Why is it necessary to know that you are being interrogated on Mode 4? Is this a function of the Radar Warning Receiver rather than the IFF transponder?

DV

[Lima Juliet]

Like Courtney said, if you didn't have a buzz and/or light for a minute or so, something was up and best you get your 'parrot' checked by a C2 unit quickly! There were failure modes indicated by the IFF warning light on the Central Warning Panel - I'll look them up in my notes and let you know what they were.

LJ

[Ivor Fynn]

MAINJAFAD,

If memory serves me, I think it should be "the girl who fired that Patriot at the GR-4 was a muppetess"

Ivor

[Lima Juliet]

Here you go, straight from my notes circa 1995:

AMBER IFF CAPTION ON CENTRAL WARNING PANEL INDICATES:

-MODE 4 CODES LOST
-MODE 4 CODES NOT LOADED
-MASTER SWITCH OFF
-28V DC FAILURE
-MASTER SWITCH AT STANDBY & SYSTEM INTERROGATED (MOMENTARY)
-FAULTY MODE 4 (MKXII IFF COMPUTER DETECTS AN INTERNAL FAULT)
-TRANSPONDER FAILS TO REPLY TO MODE 4 INTERROGATION
-SIMULTANEOUS FAILURE OF BOTH TRANSMITTERS
-SYSTEM INTERROGATED BUT MODE 4 SWITCH TO OUT (IE. IT’S OFF!)

There was also a black/white failure test switch that only checked Mode 1 to 3 - so no good for Mode 4. I believe that SIFF has far more error detection than that above, but as Courtney says, there would be plenty of clues to a Mode 4 fail on the old system if you really understood it (sadly few really did and it was an ergonomic nightmare along with the HaveQuick radio).

LJ

[tucumseh]

Which begs the question why C-in-C RAFSC recommended "The Tornado IFF installation be modified to ensure that the cockpit warning is triggered in all failure modes". (MAAS para 19c). Para 19 concludes by stating this recommedation is being implemented.


This of course raises the issue of MoD(PE)'s DGAS2 being advised in 1998 that all aircraft IFF systems, especially Tornado, should be inspected for failure warning integration, using almost exactly the same words as C-in-C 6 years later. Also, DPA's XD5 in 2002. This, because the MoD IFF office habitually did not integrate such warnings and thought it acceptable to pay off the contract and knowingly deliver an an aircraft that was functionally unsafe. Both 2 Stars rejected the recommendations (also made by Boscombe), confirming the IFF office view that functional safety was unnecessary. In case you're wondering, yes, the same DGAS2 who was in charge of Nimrod and Chinook.

[Courtney Mil]

Thanks for all that extra info. I know my experience of it is a bit rusty and not on type, but everything you all say rings true in my head, especially the failure modes.

Of course, it's easy for me to say the absence of anything made me feel uncomfortable, but I know that's not easy to spot at the end af a long, tense combat mssion. Coming home is when it's easy to relax.

Courtney

[Courtney Mil]

Oh, of course, never forget that Patriot can also check Mode 1. But, IIRC, there were no Mode 1 codes entered into that SAM battery because they were "cut off" from their own network. So there is a lot more to all this...

[Just This Once...]

Perhaps a good time to remind people that Leon is quoting his notes from the F3, rather than the GR4. The integration of the IFF may have been a little different...

[Courtney Mil]

No, the installations may be different and the failure modes possibly, but unlikely. But IFF Mode 4 is IFF Mode 4. I've used it in three jets US and UK and it's pretty much the same fish. The failure modes he's describing chime with my recolection of the facts. We're not trying to second guess a BoI here, we would (generally) be foolish to try. So I'm not sure what your point is.

[tucumseh]

Perhaps a good time to remind people that Leon is quoting his notes from the F3, rather than the GR4. The integration of the IFF may have been a little different...

Correct. The point I made above is that, despite specifying a given performance (including failure warnings) the IFF office took the general view that "It works on the bench, so it'll work on the aircraft" and saw no need to check that it worked end-to-end. That is, verifying it had been integrated correctly and was physically and functionally safe. One "end" being the presentation of warnings and, arguably, reassurance that the crew had been trained to take "immediate action" upon a failure. (The warning is useless unless you know what it is and what to do). On the programme that gave rise to this issue in 1998, the crews had not been trained or the books amended. They fiddled with knobs until a hitherto (and still marked) "spare" actually switched off that annoying noise; rendering them vulnerable to friendly fire. The last is important because IFF office saw no need either for simulator modification or APs. As I said, 2 and 4 Stars agreed with them.

However, as well as being fraudulent, this ethos still causes major problems on programmes where the contract says "Fit equipment x" and the company do so - and MoD has no comeback when they find it doesn't work. "You asked and paid for it to be fitted, it costs more if you want it to work". This has become more prevalent as MoD rids itself of people who understand the concept of systems integration and its link to functional safety. And, crucially, HOW to do integration.

Another factor here is by what method was it fitted. DA Modification or Service Engineered Mod? To install and integrate an IFF with multiple warnings, especially aural, automatically breaches the SEM limits. For a start, the Service DA has no facilities to conduct the necessary integration testing - which in part leads to the "It works on the bench" (as a single LRU) notion. This follows the AMSO/AML decision many years ago to dismantle and destroy as many Integration Rigs as possible as a savings measure exercise, thus preventing even the DA, never mind the Services, from conducting proper testing without major expense and delay. Hence, Haddon-Cave's headline criticism "Savings at the expense of safety". (This precise example is what was given to him in evidence).

Yes, more to this than meets the eye.

[Distant Voice]

LJ

if you didn't have a buzz and/or light for a minute or so

Where was this light located, as it wasn't a failure light as such? And the ON/OFF switch?

AMBER IFF CAPTION ON CENTRAL WARNING PANEL INDICATES:

Just an AMBER for an IFF Mode 4 failure? Were the failure modes that you list displayed, or were they simlpy failures that you had been told about in training that would trigger a CWP Amber Warning.

Hope you do not mind me asking these questions but my training at Warton took place in 1989 on Saudi aircraft.

DV

[APG63]

DV, those are just the failures that would trigger a caption. As with so many things Tornado (and pretty well every other RAF a/c) the installation was done on the cheap and, perhaps, not quite ideal.

What Courtney says about seeing the REPLY or RESPOND light is right. On recovery to Ali, you'd get interrogated all the time. Lack of Mode 4 replies does trigger a warning in the head.

Same goes for RHWR. Patriot would often lock you up so any warning from that they may have seen, probably wouldn't have alarmed them (and would have been pretty quick too).

I think the RAF's BoI was VERY diplomatic and, IMHO, could have majored much more on a/c track, groundspeed, proximity to squawking a/c, lack of Mode 1 codes, etc, etc.

[Distant Voice]

APG63; Many thanks for that information. However, if the following failure modes were supposed to illuminate the amber IFF failure light on the CWP why didn't they?

-MODE 4 CODES LOST
-MODE 4 CODES NOT LOADED
-MASTER SWITCH OFF
-28V DC FAILURE
-MASTER SWITCH AT STANDBY & SYSTEM INTERROGATED (MOMENTARY)
-FAULTY MODE 4 (MKXII IFF COMPUTER DETECTS AN INTERNAL FAULT)
-TRANSPONDER FAILS TO REPLY TO MODE 4 INTERROGATION
-SIMULTANEOUS FAILURE OF BOTH TRANSMITTERS
-SYSTEM INTERROGATED BUT MODE 4 SWITCH TO OUT (IE. IT’S OFF!)

If, as you say, returning a/c were constantly being interrogated on Mode 4, why didn't alarm bells start ringing in the heads of the ZG710 crew, when everything would have been so quiet.

Considering the MoD "blown fuse" theory, would that have not have been similar to "MASTER SWITCH OFF", or "28V DC FAILURE, or "TRANSPONDER FAILS TO REPLY TO MODE 4 INTERROGATIONS" and as such triggered the CWP light? Of course one has to assume that all the failure mode signals were correctly integrated into the aircraft system and confirmed as being functional through end to end testing. The CinC's recommendation "The Tornado IFF installation be modified to ensure that the cockpit warning is triggered in all failure modes", indicates that they were not. So people like LJ, who believed that the CWP light would illuminate for all the modes that he has listed, were being mislead. The IFF system in the GR4 Tornado aircraft appears to have been delivered "Functionally Unsafe". I can not believe that Boscombe Down cleared such a system.

DV

[Courtney Mil]

I think APG63 is right, but if memory serves, when it was put in the jet they didn't realise that there were a couple of failures that didn't light the caption. I shall check for you, but I think one of these was if the system was switched on (the master switch was in the on position), but power to the RX was lost, then it wouldn't sense an interrogation and therefore not be concerned that it hadn't replied. There was also a particular power supply issue that I cannot recall just now, but may have it in my notes when I get home.

There were some changes later, so I would hope these issues have been fixed.

LESSON: Cheaper and safer to pay to have new kit integrated and tested properly in the first place! Oh, but we already knew that.

Courtney

[dervish]

I'm sure there is an excellent reason but...

If you accept the argument that failure to respond to an interrogation makes you vulnerable to friendly fire, why is IFF only Mission Critical but not Safety Critical? Or is this so in some aircraft and not others?

I can see that if an aircraft doesn't have IFF in the first place, then the crew are aware of the potential risks up front and plan accordingly. But it is surely a different matter if you have IFF, are trained that you have a problem if you get a warning, but the warnings aren't integrated. That would lull the crew into a false sense of safety.

Am I making sense? Grateful if anyone could enlighten me.

[MAINJAFAD]

Ivor Fynn: MAINJAFAD,

If memory serves me, I think it should be "the girl who fired that Patriot at the GR-4 was a muppetess"

Ivor

Patriot Guys I talked too at the time most likey didn't know it was a female EC either (we were well to the south with the F3's at the time).

[Courtney Mil]

Devish,

In a shooting war, there is never any point getting airborne with a missin critical failure, because it is judged that you cannot perform the mission. So if Mode 4 is an MC item, you wouoldn't bother getting airborne. Therefore, no safety issue.

Safety critical has different implications. So, in a shooting war (let's say your base is about to be bombed by Israel because you're developing nuclear weapond that they don't like) you may may have an ejection seat that is known not to work, but still chose to get airborne and try to do your bit for your country. You may even get away with it.

[tucumseh]

Surely this is the same debate we've been having for years on Mull, Nimrod, C130 threads.

Just because there are occasions when you would take the risk and go without, in this case IFF, doesn't mean you don't specify and fit (properly) in the first place.

So, assuming you're at the stages before making that decision, up to and including training for war fighting, the question Dervish asked (I think) is would you regard IFF as Safety Critical.

Let's look at the most discussed example - Chinook MoK, as applied to the FADEC software. The definition of Safety Critical is "Components whose failure could result in loss of life or serious damage to the environment in circumstances where there is no possibility of reversion to manual control”. I underlined "could" because for years MoD lied to every inquiry saying the definition was "would", which is entirely different.

In this sense, "manual" could be seen as the immediate action upon getting a failure warning. But, that pre-supposes the warnings are properly integrated. And if they haven't been, then how do you know to "revert to manual". Therefore, it could be argued it is Safety Critical, and that criticality demands end-to-end testing before take off - something which again was recommended and rejected. In other words, no compromises and everyone does their best to give the crews a fighting chance, by avoiding the avoidable, leaving them to manage the unavoidable. Or, at least, that's my opinion (and also the regulations); but I know it isn't shared and the regs are routinely ignored by very many of the senior MoD hierarchy.

[Courtney Mil]

Yeah, you're right, Tuc. The point is that Mission Critical pretty much always means "don't go" because there's no point AND you might die for nothing. Safety critical means don't go in peace time, but MAY be overridden by operational necesity.

As for the full and proper integration of equipment, yes, of course it always SHOULD be done fully and correctly. But that is not always the way. For example, a lot of kit cannot be afforded in peacetime, but becomes a necessity for an op. So we have a UOR. By definition, a rush job. We fly the jets and accept the risk. I'm not saying it makes it right. I'm saying that is what happens.

That risk is always signed off by someone. But that doesn't necessarily make that someone the "killer" when it all goes horribly wrong. No one ever considers how many more may have died if we hadn't had the kit - even if its integration was incomplete or flawed.

I'm not condoning this. I'm just trying to anser the question. After a few celebratory glasses of wine. I'll try to be clearer tomorrow.

Courtney

[tucumseh]

Courtney

Thanks, and I agree but would add -

Not being able to afford kit within the Defence budget is not the same as providing it and then wilfully failing to integrate it properly (rendering the aircraft functionally unsafe), but making the false declaration that the job is complete and paying off the contract.

In the case I mentioned, which gave rise to this question of failure warning integration and the recommendations Tornado be checked, the proper integration would have been carried out in parallel with other activities, with time saved at both Boscombe and during flight trials because they wouldn't have had to track down why none of the warnings were working. Not to mention the lengthy machinations in MoD(PE) while the aircraft office fought in vain trying to get 2 Stars to accept aircraft should be delivered safe, supported by valid Safety Cases.

The corrective action (not by the IFF office, who had been absolved from making the aircraft safe, rendering their existence completely pointless) was carried out by the aircraft office at a cost exceeding £4M and incurring 4-5 months slippage. That extra cost was, of course, the 2nd payment the company had received for doing this work. I had recommended MoD pursue free rectification / breach of contract, but it was decided this would have upset a few people, not least the original IFF PM and his mentor, so payment was made again, and something else chopped out of the design.

I explain this because it is wholly related to a number of issues regularly debated here. Wilful waste of money. Inappropriate procurement. Incompetent procurement. Delays. Unnecessary loss of life. Not that any of these concern the principals in this case.